CVE-2026-98567 net: xps: reject an out of range traffic class

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

CVE-2026-98567

The Linux kernel contains a vulnerability where netdev_set_num_tc() lowers dev->num_tc without clearing the dev->tc_to_txq[] or dev->prio_tc_map[] arrays. This allows netdev_txq_to_tc() to return a traffic class value greater than or equal to the new num_tc. When __netif_set_xps_queue() ...

EUVD-2026-103590

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

CVE-2026-98545 ata: libata-scsi: bound the ATA passthru sense descriptor writes

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

CVE-2026-98545

The Linux kernel is vulnerable to an out-of-bounds read and write in the libata-scsi component. Specifically, when an ATA PASS-THROUGH command to an ATAPI device fails, the ata_scsi_set_passthru_sense_fields() function incorrectly trusts the additional length byte (sb[7] ) of the REQUEST SENSE re...

CVE-2026-98545 ata: libata-scsi: bound the ATA passthru sense descriptor writes

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

CVE-2026-98532

A flaw in the Linux kernel IPv6 extension header parsing mechanism allows a remote attacker to cause a Denial of Service (DoS) or memory corruption by sending specially crafted IPv6 network packets. The ipv6_find_hdr() function fails to verify that a header's declared length fits within the actua...

CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

EUVD-2026-103577

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network...

EUVD-2026-103696

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98456 Bluetooth: mgmt: fix race in read_unconf_index_list()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98456

A race condition in the Linux kernel's Bluetooth subsystem within the read_unconf_index_list() function allows for a local privilege escalation or Denial of Service (DoS) . The flaw occurs because hci_dev_list_lock stabilizes list membership but fails to serialize per-device flags. During asynchr...

CVE-2026-98456 Bluetooth: mgmt: fix race in read_unconf_index_list()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

DEBIAN-CVE-2026-112060

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

DEBIAN-CVE-2026-112062

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...

CVE-2026-112062

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...

CVE-2026-112060

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

CVE-2026-112059

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...