Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability arises from the function nvmetauthchallenge, which treats the output buffer as a void pointer. This leads to an incorrect calculation of sizeofd, resulting in the omission of 15 bytes from the fixed challenge header. The short...

Linux Distros Unpatched Vulnerability : CVE-2026-98703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it...

CVE-2026-112012: Out-of-bounds Write

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

CVE-2026-112059: Out-of-bounds Write

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

PT-2026-116616

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta decoder process stream and tta decoder process frame because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 wi...

CVE-2026-98456: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98703: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

PT-2026-116768

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP implementation where socket buffer skb collapsing can occur across boundaries in the retransmission rtx queue. When a switch to device encryption occurs, the t...

PT-2026-116611

Name of the Vulnerable Software and Affected Versions Schism Tracker versions prior to 20260524 Description A heap out-of-bounds write occurs in the fmt ult load song function within fmt/ult.c because the one-byte sample count is not clamped to MAX SAMPLES. A remote attacker can use a specially...

PT-2026-116854

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write occurs in the SCSI block layer during zone report processing. The blk revalidate disk zones function determines the size of the zones cond array based on disk...

PT-2026-116807

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.6 through 7.3-rc2 Description An issue exists in the bpf sockmap component where the sock map alloc function fails to properly validate the max entries variable, allowing any u32 value other than zero. When a SOCKMAP is...

Security update for gimp (important)

openSUSE security update: security update for gimp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22123-1 Rating: important References: bsc1277594 bsc1277618 bsc1277622 bsc1284473 bsc1284474 bsc1284475 Cross-References: CVE-2026-106061...

Security update for libXpm (moderate)

openSUSE security update: security update for libxpm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22056-1 Rating: moderate References: bsc1281669 Cross-References: CVE-2026-94287 CVSS scores: CVE-2026-94287 SUSE : 6.2...

PT-2026-116642

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

PT-2026-116645

Name of the Vulnerable Software and Affected Versions lwIP versions prior to 2.2.2 Description A stack out-of-bounds write exists in the mdns handle response function. Adjacent attackers can corrupt stack memory by sending mDNS responses containing invalid domain names. Specifically, attackers on...

PT-2026-116609

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read text, read blob, COPY...

CVE-2026-98741: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detectusbformat cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.17 contains a security vulnerability. This vulnerability arises from the use of readunconfindexlist, which checks the device flags again when filling the response after counting controllers that are not configured. However, hcidevlistlock does not serialize each device...

PT-2026-117055

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA line6 driver where playback packets are not validated against the allocated buffer size. The submit audio out urb function calculates the frame count based on...

PT-2026-128533

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet auth challenge nvmet auth challenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A...