CVE-2026-80710

CVE-2026-80710 affects the s390/dasd subsystem of the Linux kernel. In dasd_eckd_check_device_format(), the variable fmt_buffer_size is declared as a 32-bit int, but the expression trkcount * rpt_max * sizeof(struct eckd_count) is evaluated at 64-bit width. When the track range (controlled by cal...

CVE-2026-80710 s390/dasd: Fix undersized format-check buffer

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

CVE-2026-80710 s390/dasd: Fix undersized format-check buffer

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

EUVD-2026-67548

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80672 ntfs: fix u16 truncation of restart-area length check

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80672 ntfs: fix u16 truncation of restart-area length check

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80672

CVE-2026-80672 is a u16 truncation in the Linux kernel's in-kernel NTFS driver, specifically in ntfs_check_restart_area(). The variable ra_len is declared as u16, but the computed length of the $LogFile log client record array can exceed 65535 (e.g., log_clients of 410 yields 65600), causing trun...

CVE-2026-80672

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

Linux Distros Unpatched Vulnerability : CVE-2026-80710

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098733)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098733 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: fix divide-by-zero in rtscmin m2sm converts a u32 slope to a u64 scaled value...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xalan-j2 (UTSA-2026-054046)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054046 advisory. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class...

CVE-2026-59985

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when ...

EUVD-2026-65695

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when ...

CVE-2026-59985

OpenEXR versions 3.2.0–3.2.10, 3.3.0–3.3.12, and 3.4.0–3.4.13 are vulnerable to a heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32 builds . A crafted RLE-compressed EXR file causes a 64-bit unpacked size to truncate before allocation in decoding.c, leading unpack_32bit() to read beyon...

PT-2026-81478

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.2.0 through 3.2.10 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description On ILP32 builds, a heap out-of-bounds read occurs when processing a crafted RLE-compressed EXR image. The issue arise...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a heap overflow in NLnet Labs Unbound [CVE-2026-42944]

Summary IBM Watson Speech Services Cartridge is vulnerable to a heap overflow in NLnet Labs Unbound, due to an issue that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet CVE-2026-42944. NLnet Labs Unbound is used as part ...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

CVE-2026-68552

A flaw was found in Coturn. An unauthenticated remote client can send a specially crafted STUN message over TCP or TLS. This message, with a specific body-length field, causes an integer truncation overflow, leading to the desynchronization of the stream parser. Consequently, the attacking client...