PT-2026-116611

Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt ult load song in fmt/ult.c that fails to clamp the one-byte sample count to MAX SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf destroy to free...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2024:1719933179)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2024:1719933179 advisory. - In parsehidreportdescriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an H...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2024:1705927008)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2024:1705927008 advisory. - It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free...

Linux Distros Unpatched Vulnerability : CVE-2026-98703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2024:1719932549)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2024:1719932549 advisory. - In parsehidreportdescriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an H...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability arises from the function nvmetauthchallenge, which treats the output buffer as a void pointer. This leads to an incorrect calculation of sizeofd, resulting in the omission of 15 bytes from the fixed challenge header. The short...

PT-2026-116657

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mptcp module where the mptcp write data fin function fails to initialize certain values when sending a DATA FIN without data. Because a DATA FIN occupies one octet...

VulnCheck KEV: CVE-2026-96656

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

PT-2026-128512

In the Linux kernel, the following vulnerability has been resolved: vc screen: reload vc pointer before if ret in vcs write to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vc screen: reload load of struct vc data pointer in vcs write to avoid UAF" sits after the 'if ret' block, so t...

PT-2026-128522

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst dev overhead The seg6, ioam6 and rpl lwtunnels size their skb cow head request as the length they are about to push plus dst dev overhead, then push the new headers and rebuild the m...

CVE-2026-112012: Out-of-bounds Write

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

CVE-2026-112059: Out-of-bounds Write

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-98703: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

PT-2026-116764

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where the ata scsi set passthru sense fields function improperly trusts the additional length byte sb7 from a device's REQUEST SENSE reply during a...

PT-2026-128477

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max entries INT MAX in sock map alloc sock map alloc only rejects max entries == 0 and otherwise allows any u32 value. sock map free then walks the sks array with a signed int iterator: int i; for i = 0; i...

PT-2026-116768

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP implementation where socket buffer skb collapsing can occur across boundaries in the retransmission rtx queue. When a switch to device encryption occurs, the t...

PT-2026-116786

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the network subsystem where the kernel fails to reject out-of-range traffic classes. When netdev set num tc lowers the number of traffic classes dev-num tc, it does no...

PT-2026-116840

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Generic UDP Encapsulation GUE implementation where the gue remcsum function passes checksum start and field offset values to skb remcsum process. If the offset is...

CVE-2026-98456: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98532: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...