1172 matches found
CVE-2026-90386
This Linux kernel vulnerability affects the DesignWare I3C master driver (drivers/i3c/master/dw-i3c-master.c:905). On an empty I3C bus, the ENTDAA (Enhanced Dynamic Address Assignment) command assigns no devices, causing cmd->rx_len to equal master->maxdevs. The resulting GENMASK() index be...
EUVD-2026-81916
In the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid cirange initialization syzbot reported a shift-out-of-bounds in vccconnect: UBSAN: shift-out-of-bounds in net/atm/common.c:382:32 shift exponent -1 is negative CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18...
UBUNTU-CVE-2026-89783
In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...
DEBIAN-CVE-2026-89814
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...
CVE-2026-89814
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...
EUVD-2026-80414
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...
CVE-2026-89814
CVE-2026-89814 is an out-of-bounds array index vulnerability in the Linux kernel 's drm/amdgpu driver. The adev->isolation[] array has one slot per partition, but a ring not assigned to a partition retains the AMDGPU_XCP_NO_PARTITION value (~0), causing an out-of-bounds access. This is trigger...
CVE-2026-89814 drm/amdgpu: clamp the isolation index for rings outside a partition
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: nbd: Fixed incomplete validation of ioctl arguments. We identified an alarm caused by incomplete validation of ioctl arguments without proper verification. The UBSAN warning appears as follows: UBSAN: Undefined behavior in...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: netsched: clsflow: validate TCAFLOWRSHIFT attribute The syzbot found that the TCAFLOWRSHIFT attribute was not validated. Shifting a 32-bit integer is undefined for large shift values. UBSAN: Shift-out-of-bounds in...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Do not return “unset power” in ieee80211gettxpower. We may receive a UBSAN warning if ieee80211gettxpower returns the INTMIN value that mac80211 internally uses for “unset power level”. UBSAN:...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: iscsistart: A UBSAN out-of-bounds warning has been fixed in ibftattrshownic. When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64,...
DEBIAN-CVE-2026-89596
In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...
AZL-100386 CVE-2026-89596 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...
UBUNTU-CVE-2026-89436
In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpipccretrievebiosdata rejects SINF packages only when pcc-numsifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...
UBUNTU-CVE-2026-89596
In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...
CVE-2026-89596
In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...
CVE-2026-89596 forcedeth: fix off-by-one when saving/restoring non-PCI config space
In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...
CVE-2026-89596
CVE-2026-89596 affects the Linux kernel's forcedeth driver (NVIDIA). An off-by-one error in nv_suspend() and nv_resume() causes an out-of-bounds write one element past the saved_config_space array during system suspend and resume (S3). The bug is triggered by a loop using <= instead of <. W...
CVE-2026-89596 forcedeth: fix off-by-one when saving/restoring non-PCI config space
In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...