CVE-2026-89787

This vulnerability affects the Linux kernel's ext4 filesystem in ext4_search_dir() (fs/ext4/namei.c). For casefolded encrypted directories , ext4 stores an 8-byte hash trailer after the directory entry name. The pre-check in ext4_search_dir() only verifies that the name fits within the block boun...

CVE-2026-89785

CVE-2026-89785 is an out-of-bounds read in the Linux kernel's NTFS3 filesystem driver. The functions ntfs_reparse_init() and ntfs_objid_init() parse the INDEX_ROOT attributes ($R and $O) of the $Extend/$Reparse and $Extend/$ObjId metafiles using resident_data() , which fails to verify that the re...

CVE-2026-89786

CVE-2026-89786 is an out-of-bounds read in the Linux kernel's ext4 filesystem, specifically in ext4_read_inline_dir(). The dirent buffer is allocated as inline_size bytes, but directory iteration operates in a larger position space (extra_size). Because ext4_check_dir_entry() is called with extra...

CVE-2026-89784

CVE-2026-89784 affects the Linux kernel SUNRPC subsystem. The functions rpcb_register_inet4() and rpcb_register_inet6() store the result of rpc_sockaddr2uaddr() into map->r_addr without checking for NULL . When the final kstrdup() inside rpc_sockaddr2uaddr() fails under memory pressure , the u...

CVE-2026-89782

CVE-2026-89782 affects the Linux kernel's ntfs3 filesystem driver (fs/ntfs3). During $LogFile replay , log_replay() uses transact_id from a log record header as an index into the restart table without checking its magnitude. When the resulting growth request exceeds U16_MAX , the count is truncat...

CVE-2026-89783

CVE-2026-89783 is an out-of-bounds write in the Linux kernel's xfrm6_input_addr() function (net/ipv6/xfrm6_input.c). An off-by-one in the depth check (1 + sp->len == XFRM_MAX_DEPTH instead of >=) allows a write to index 6 of a 6-element xvec[] array when the security path is already at maxi...

CVE-2026-89781

CVE-2026-89781 is an out-of-bounds read in the Linux kernel fs/ntfs3 driver, specifically in read_log_rec_buf() (fs/ntfs3/fslog.c). The function copies a log record using an offset derived from log->record_header_len, which is read verbatim from the on-disk restart area and only validated for ...

CVE-2026-89779

A slab-out-of-bounds read in the Linux kernel's ntfs3 filesystem driver occurs when a crafted NTFS image contains an Extended Attribute (EA) record with a mismatched ef->size and elength. The function ntfs_read_ea() in fs/ntfs3/xattr.c validates only that the record fits in the remaining buffe...

CVE-2026-89780

CVE-2026-89780 is a null-pointer dereference in the Linux kernel's Qualcomm RMNET driver (drivers/net/ethernet/qualcomm/rmnet). The function rmnet_map_deaggregate() allocates sub-frames via alloc_skb() leaving skb->dev as NULL. Because MAP command frames are dispatched to rmnet_map_command() b...

CVE-2026-89778

CVE-2026-89778 is an out-of-bounds page array access in the Linux kernel's zisofs (compressed ISO9660) filesystem. The root cause is in zisofs_uncompress_block()'s empty-block fast path, which returns pcount <

CVE-2026-89776

CVE-2026-89776 affects the Linux kernel VXLAN VNI filter (vxlan: vnifilter). The root cause is that GROUP/GROUP6 address attributes were declared with NLA_BINARY and only a maximum length, allowing validate_nla() to accept payloads shorter than the address. The consumer then performs an unconditi...

CVE-2026-89777

A use-after-free vulnerability in the Linux kernel's VFIO/PCI subsystem (drivers/vfio/pci/vfio_pci_config.c) occurs when vdev->msi_perm is freed via kfree() on an init failure path but not NULLed , leaving a dangling pointer that persists across device open/close cycles. On the next vfio_confi...

CVE-2026-89775

CVE-2026-89775 affects the Linux kernel in the KVM arm64 subsystem. When the S1 MMU is disabled, the page-table walk level is set to −127 (S1_MMU_DISABLED), but pgshift_level_to_ttl() casts it to an unsigned 8-bit value, yielding an invalidation size of 0 during VNCR TLB evaluation. This can leav...

CVE-2026-73464

Arista EOS is affected via its gRPC Network Management Interface (gNMI) component. A specially crafted request from an authenticated client with gNMI access can execute arbitrary code with root privileges on the switch. The root cause is classified as CWE-94 (Code Injection) . Exploitation requir...

CVE-2026-85501

NLnet Labs Unbound up to and including 1.26.0 is vulnerable to a set of DNSSEC algorithmic complexity attacks collectively termed ReTrap . Four distinct vectors are identified: TagTrap (mismatched DNSKEY, RRSIG, and DS records in responses), DelegationTrap (iterative chain-of-trust validation fro...

CVE-2026-82720

NLnet Labs Unbound versions 1.12.0 through 1.26.0 contain a use-after-free vulnerability in the DNS-over-HTTPs (DoH) code path when compiled with --with-libnghttp2. During failure code paths (e.g., RPZ drop query or jostle due to heavy traffic), a dropped DoH stream tears down the entire DoH sess...

CVE-2026-82717

NLnet Labs Unbound versions up to and including 1.26.0 are affected by a heap buffer overflow in CNAME synthesis during upstream response processing. When the resolver enforces a max TTL value in the packet buffer, a compression pointer pointing to the overwritten value invalidates the domain nam...

CVE-2026-81642

NLnet Labs Unbound (up to and including 1.26.0 ) contains a heap buffer overflow in the DNSSEC validator when digesting DNSKEY records. A DNSKEY with an owner compression pointer referencing its own RDATA can overflow the digest buffer, enabling denial of service and possible remote code executio...

CVE-2026-81634

NLnet Labs Unbound up to and including 1.26.0 is affected by a heap buffer overflow in the RRSet canonicalisation routine. The root cause is a missing first owner name in the buffer length check, which can be triggered by a 255-length query name combined with a large TCP response. Since canonical...

CVE-2026-80225

NLnetLabs Unbound versions up to and including 1.26.0 are affected by a degradation of service vulnerability in the TCP/DoT reading procedure . The root cause is the absence of a limit on consecutive reads : a remote, unauthenticated attacker who can sustain a rate of distinct uncached DNS querie...