CVE-2026-71223

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-71222

A heap out-of-bounds read vulnerability was found in gfs2-utils. The eanumptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem...

CVE-2026-71221

A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images...

CVE-2026-71220

A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2edit, the diheight field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem image...

CVE-2026-71219

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with an exponentially-derived size from the untrusted on-disk didepth field without bounds validation. A crafted GFS2 filesystem image with a large didepth value causes stack exhaustion...

CVE-2026-76642

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with...

CVE-2026-85150

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

CVE-2026-76178

A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...

CVE-2026-76177

Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...

CVE-2026-76176

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-76175

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

CVE-2026-76174

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

CVE-2026-80757

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread takes that nprim verbatim...

CVE-2026-80756

In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started selwriteload calls selinuxpolicycancel when selmakepolicynodes fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first...

CVE-2026-80755

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count permread bounds a permission value by SELVECMAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image...

CVE-2026-80754

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitter TX electrode count was incorrectly assigned the value of the receiver RX electrode count due to copy-paste typos. This...

CVE-2026-80753

In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point tha...

CVE-2026-80751

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prevo in mtkmfgattachdev mtkmfgattachdev reads prevo on the first iteration of its loop, in "if prevo && prevo-freq == o-freq", before prevo is assigned at the end of the loop body. On that fir...

CVE-2026-80752

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

CVE-2026-80750

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after ofnodeput scpsysgetbusprotectionlegacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap...

CVE-2026-80749

In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination a generic target, sized to accept many different data blocks...

CVE-2026-80748

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry...

CVE-2026-80747

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...

CVE-2026-80746

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix dispccmdssmdpclksrc RCG stall on Eliza EVK Eliza EVK eliza-cqs-evk.dts does not have display enabled, however its Display Clock Controller is enabled and references parent clocks from DSI PHYs, which...

CVE-2026-80745

In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEGtable mapping does not match the FP9931 datasheet. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h - 7.04V -7.04V 05h - 7.26V -7.26V 06h - 7.49V...

CVE-2026-80744

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftablesoffload: suppress WARNONONCE for ENOMEM in abort path In nftflowruleoffloadabort, WARNONONCEerr is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under...

CVE-2026-80743

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: pass auddrvdata to irq handlers The irq handlers take a struct device pointer and call devgetdrvdata to obtain the driver data. However, the driver data is only set at the end of probe, after...

CVE-2026-80742

In the Linux kernel, the following vulnerability has been resolved: afpacket: Don't send zero-byte data in tpacketsnd. syzbot reported a WARNING in devqueuexmit triggered via tpacketsnd: skbassertlen WARNING: at include/linux/skbuff.h:2753 skbassertlen WARNING: at devqueuexmit+0x21bc/0x4970...

CVE-2026-80741

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drmlogdrawkmsgrecord accesses slen - 1 to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINTMAX, causing an out-of-bounds read...

CVE-2026-80740

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scale is large enough that scaledfont exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in...

CVE-2026-80739

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock In case mlx5eaddfdbflow fails in lower levels, the flow is deleted via mlx5etcdelflow, and mlx5etcdelflow is acquiring ESW devcom lock without condition. In...

CVE-2026-80738

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skstate before skprotocol in bpftcpsyncookie bpftcpgensyncookie and bpftcpchecksyncookie accept a socket pointer 'sk' with argument type ARGPTRTOBTFIDSOCKCOMMON. However, they access sk-skprotocol without validating...

CVE-2026-80737

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port...

CVE-2026-80735

In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref skuserdata Some subsystems, like BPF SOCKMAP, set skuserdata without actually setting the encaptype. For this reason, we must make sure that the type is the one ovpn expects befor...

CVE-2026-80736

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAXGROUPS, while Group ID 0 is reserved. tbconsumeddpbandwidth uses the Group ID directly to index its local groupreserved array...

CVE-2026-80733

In the Linux kernel, the following vulnerability has been resolved: net: remove WARNONONCE from skmcloop skmcloop can be called for sockets that are neither AFINET nor AFINET6 e.g. AFPACKET sockets when sending packets via raw/packet socket over virtual devices such as VRF or ipvlan. In such case...

CVE-2026-80734

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: dropcaches: 3 assertion...

CVE-2026-80732

In the Linux kernel, the following vulnerability has been resolved: ata: patasl82c105: fix bridge revision use-after-free pcigetslot returns a referenced PCI device. Commit 44c10138fd4b "PCI: Change all drivers to use pcidevice-revision" replaced a configuration-space read with direct access to t...

CVE-2026-80731

In the Linux kernel, the following vulnerability has been resolved: net: remove CAPSYSRAWIO zero-padding in devvalidateheader devvalidateheader reads dev-hardheaderlen directly when zero-padding short link layer headers for CAPSYSRAWIO holders: if capableCAPSYSRAWIO memsetllheader + len, 0,...

CVE-2026-80730

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix crash passing ERRPTR to kthreadstop In testringbuffer's outfree cleanup loop, the check !rbthreadscpu only catches NULL entries and misses entries that hold an ERRPTR. rbthreads is static, so unassigned slots are...

CVE-2026-80729

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: initialise workingset state before folio split xastrysplit adds GFPACCOUNT for page-cache xanodes, but foliosplit leaves the xastate's xalru unset. That lets a live, memcg-charged xanode exist without being linked...

CVE-2026-80728

In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amdgpu: fix aperture mapping leak" devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devresreleaseall unmaps the aperture before the DRM device release callback fires...

CVE-2026-80727

In the Linux kernel, the following vulnerability has been resolved: x86/mce: Set up the polling timer before CMCI discovery I hit the following on one of my machines: mce: CPU0 BANK15 CMCI inherited storm ------------ cut here ------------ ODEBUG: assertinit not available active state 0 object:...

CVE-2026-80726

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's...

CVE-2026-85091

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gzvacate function when processing non-blocking gzwrite operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf or gzvprintf after a write stall, causing an...

CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

CVE-2026-85090

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84292

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

CVE-2026-78662

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...