Linux Distros Unpatched Vulnerability : CVE-2026-98819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc (CENTOS8.4:CLSA-2026:1784277735)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784277735 advisory. - In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK...

CVE-2026-98844: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

CVE-2026-98615: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AWFLUSHMODE alongside AWFLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnicmbxresetdescring writes AWCFG with FLUSH set and everything else, BME included, cleared. Clearing BME halts th...

CVE-2026-98621: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to skbremcsumprocess, whose partial path stores offset - start in the u16...

CVE-2026-98635: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

CVE-2026-112059: Out-of-bounds Write

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112007: Out-of-bounds Write

Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmtultloadsong in fmt/ult.c that fails to clamp the one-byte sample count to MAXSAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csfdestroy to free...

CVE-2026-112051: Improper Limitation of a Pathname to a Restricted Directory

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...

CVE-2026-112018: Out-of-bounds Write

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...

CVE-2026-112005: Improper Limitation of a Pathname to a Restricted Directory

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use readtext, readblob, COPY ... ...

CVE-2026-98776: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

CVE-2026-98703: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

CVE-2026-98741: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detectusbformat cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize...

PT-2026-116675

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read unconf index list read unconf index list counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hci dev list lock stabilizes list...

PT-2026-116840

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue remcsum passes them to skb remcsum process, whose partial path stores offset - start in the u16 skb-csu...

PT-2026-117059

In the Linux kernel, the following vulnerability has been resolved: vc screen: reload vc pointer before if ret in vcs write to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vc screen: reload load of struct vc data pointer in vcs write to avoid UAF" sits after the 'if ret' block, so t...

PT-2026-116611

Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt ult load song in fmt/ult.c that fails to clamp the one-byte sample count to MAX SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf destroy to free...

PT-2026-116642

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

PT-2026-116807

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max entries INT MAX in sock map alloc sock map alloc only rejects max entries == 0 and otherwise allows any u32 value. sock map free then walks the sks array with a signed int iterator: int i; for i = 0; i...