CVE-2026-98456: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

PT-2026-117046

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k htc: bound TX aggregation to MAX TX BUF SIZE hif usb tx dequeues up to MAX TX AGGR NUM 20 frames into a single tx buf of MAX TX BUF SIZE 32768 bytes, limiting the batch by record count but never by cumulative byte...

PT-2026-116622

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf accessor unpack floats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory,...

CVE-2026-112007: Out-of-bounds Write

Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmtultloadsong in fmt/ult.c that fails to clamp the one-byte sample count to MAXSAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csfdestroy to free...

VulnCheck KEV: CVE-2026-96656

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-112060: Out-of-bounds Write

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

PT-2026-116974

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc send ctl The stack-allocated struct vio vcc pkt was partially initialized, leaving the tag.stype env field uninitialized before being sent via ldc write, potentially leaking kernel...

PT-2026-116643

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3 Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

Linux Distros Unpatched Vulnerability : CVE-2026-98836

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized...

PT-2026-116768

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP implementation where socket buffer skb collapsing can occur across boundaries in the retransmission rtx queue. When a switch to device encryption occurs, the t...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2024:1719933179)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2024:1719933179 advisory. - In parsehidreportdescriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an H...

PT-2026-116786

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-num tc are valid in dev-tc to txq, and dev-prio tc map may only name classes below it. netdev set num tc lowers dev-num tc without touching either array...

PT-2026-116922

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrel ht: validate fixed rate index The fixed rate idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel ht update stats then copies the value into mi-max tp rate and mi-max pro...

CVE-2026-98725: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge nvmetauthchallenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A shor...

PT-2026-116642

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

PT-2026-116616

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta decoder process stream and tta decoder process frame because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 wi...

PT-2026-116787

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan na create samples LL RESERVED SPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan changelink can update needed headroom betwee...

CVE-2026-98568: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

CVE-2026-112059: Out-of-bounds Write

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

Linux Distros Unpatched Vulnerability : CVE-2026-98725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet-auth: fix out-of-bounds write in nvmetauthchallenge nvmetauthchallenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one wi...