CVE-2026-98532

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98588

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject maxentries INTMAX in sockmapalloc sockmapalloc only rejects maxentries == 0 and otherwise allows any u32 value. sockmapfree then walks the sks array with a signed int iterator: int i; for i = 0; i...

DEBIAN-CVE-2026-98456

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

AZL-108825 CVE-2026-98456 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98456

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

UBUNTU-CVE-2026-98456

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98456

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

IBM MQ Operator path traversal vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a path traversal...

GIMP buffer error vulnerability

GIMP has a buffer error vulnerability. This vulnerability stems from the PSD thumbnail loader using a fixed 3-byte step for BGR-to-RGB channel swapping, without verifying whether the JPEG thumbnail is in RGB format. Specialized grayscale PSD thumbnails can lead to out-of-bound read and write...

H3C Magic NX15 has a vulnerability in input validation.

The H3C Magic NX15 NX15V100R017 version has a security vulnerability. This vulnerability stems from the improper handling of the path parameter in the write function of the RPC Interface component. This could lead to code injection, allowing attackers to execute attacks remotely...

CVE-2026-98867

The Linux kernel is affected by a vulnerability in dm-pcache where the cache_key_decode() function fails to properly validate the logical offset of a key from persistent memory. An offset exceeding the device size allows the creation of a subtree pointer outside the req_key_tree->subtrees[] ar...

CVE-2026-98867 dm-pcache: bound the logical key offset from persistent memory

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cachekeydecode takes a key's logical off from the cache device and later indexes reqkeytree-subtrees by it in getsubtree. An off past the device forms a subtree point...

CVE-2026-98867 dm-pcache: bound the logical key offset from persistent memory

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cachekeydecode takes a key's logical off from the cache device and later indexes reqkeytree-subtrees by it in getsubtree. An off past the device forms a subtree point...

EUVD-2026-103807

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cachekeydecode takes a key's logical off from the cache device and later indexes reqkeytree-subtrees by it in getsubtree. An off past the device forms a subtree point...

EUVD-2026-103784

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

CVE-2026-98844 netfs: clear post-EOF pagecache when extending a file via write

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

CVE-2026-98844

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

CVE-2026-98844

The Linux kernel contains a vulnerability in the netfs component where the pagecache is not properly cleared when a file is extended via a write operation. Specifically, dirty data left by writes through an mmapped region in a hole created after the End-of-File (EOF) could persist. The fix involv...

CVE-2026-98844 netfs: clear post-EOF pagecache when extending a file via write

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

CVE-2026-98836

A slab-out-of-bounds vulnerability exists in the Linux kernel ALSA line6 driver. The issue occurs in submit_audio_out_urb() because the number of bytes written into an out.buffer slice is not validated against the slice size. On devices with a large IN wMaxPacketSize and a small OUT wMaxPacketSiz...