PT-2026-82160

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The zcrypt msgtype6 send ep11 cprb function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload. This approach assumes a fixed payload structure a...

Linux Distros Unpatched Vulnerability : CVE-2026-80544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing The...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Fixed a memory leak in the error path of hciallocdev. Early failures in Bluetooth HCI UART configuration cause a leak of percpu memory through the SRCU struct initialized early in hciallocdev. When device...

CVE-2026-74708

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsktxmetadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the...

CVE-2026-74730: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfsserver' during a FREESTATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREESTATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct...

Linux Distros Unpatched Vulnerability : CVE-2026-76641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parse...

ALPINE-CVE-2026-76641

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between ELEMENTTYPE members causes storeAtts to read the attIndex...

AZL-96932 CVE-2026-76641 affecting package expat for versions less than 2.8.3-2

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between ELEMENTTYPE members causes storeAtts to read the attIndex...

ANT-2026-MHV0A2SD · FreeType2 · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-MHV0A2SD: Heap buffer overflow in Type 1...

PT-2026-76715

The flash copy system call is verified by z vrfy flash copy in drivers/flash/flash util.c. On builds with CONFIG USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer K SYSCALL MEMORY WRITE and passed the two...

AZL-96111 CVE-2026-74458 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...

CVE-2026-74466

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

UBUNTU-CVE-2026-72172

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes th...

CVE-2026-72172

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes th...

CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

UBUNTU-CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

EUVD-2026-58930

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes th...

CVE-2026-72172

CVE-2026-72172 affects the Linux kernel, specifically the mm/mm_init path related to ZONE_DEVICE. The issue occurs when DAX memory is hotplugged into an unoccupied subsection of an early section, causing section_activate() to reuse the boot memmap while compound_nr_pages() assumes vmemmap optimiz...

EUVD-2026-59100

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

PT-2026-72360

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management initialization where section activate reuses the unoptimized boot memmap when DAX memory is hotplugged into an unoccupied subsection of an early...