CWE-125
CVEs classified under CWE-125, newest first.
2103 CVEsRSS
CVE-2026-98728Low· 2.5kernel: tpm: fix off-by-four bounds check in tpm2_get_random() (CVE-2026-98728)
A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a tr…
CVE-2026-98726Medium· 4.4nvme-multipath: fix underflow in ANA log bounds checks
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and…
CVE-2026-98732Low· 3.4Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel_hw_error() The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-te…
CVE-2026-98797Medium· 5.5kernel: net: cap skb->queue_mapping when the tx queue is picked (CVE-2026-98797)
A flaw was found in the Linux kernel. A local user with network administration privileges in a network namespace can cause a Denial of Service (DoS) by triggering an out-of-bounds memory read. When redirecting packets between network inter…
CVE-2026-98807Medium· 4.4kernel: net/mlx5: Fix slab-out-of-bounds when handling team device events (CVE-2026-98807)
A flaw was found in the Linux kernel's Mellanox ConnectX (mlx5) network driver. It allows a privileged local user to cause a Denial of Service (DoS) via an out-of-bounds memory read. When processing Link Aggregation (LAG) events, the drive…
CVE-2026-98810Medium· 6.1kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() (CVE-2026-98810)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory by transmitting specially crafted network packets. This issue occurs because …
CVE-2026-98819Medium· 4.4Bluetooth: btintel: validate DDC record lengths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byt…
CVE-2026-98828Medium· 6.2kernel: wifi: ath9k: reject short WMI command responses (CVE-2026-98828)
A flaw was found in the Linux kernel's ath9k wireless driver. When handling Wireless Module Interface (WMI) command responses, the driver copies data into a response buffer without verifying that the received message is sufficiently long. …
CVE-2026-98835Medium· 5.5kernel: iio: accel: kionix-kx022a: Fix array boundary check (CVE-2026-98835)
A flaw was found in the Linux kernel's Kionix KX022A accelerometer driver. A local user could trigger a Denial of Service (DoS) or kernel memory disclosure due to an off-by-one array bounds validation check when converting device register …
CVE-2026-98838Medium· 4.4vt: skip screen update for DEC alignment test on backgroup consoles
In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles [BUG] Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fb_pa…
CVE-2026-98839Medium· 6.1kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() (CVE-2026-98839)
A flaw was found in the Linux kernel's virtual terminal selection subsystem. When pasting console selections, a race condition can occur if another process concurrently replaces the selection buffer with shorter content while the operation…
CVE-2026-98852Medium· 5.9kernel: net: extend IPv6 exthdr detection of tunneled packets (CVE-2026-98852)
A flaw was found in the Linux kernel's networking subsystem. An attacker could exploit this vulnerability by sending specially crafted encapsulated IPv6 network traffic, leading to a Denial of Service (DoS). This issue stems from improper …
CVE-2026-98454High· 8.1smb: client: fix create context out-of-bounds reads
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field b…
CVE-2026-98481Medium· 6.2kernel: nfc: port100: reject frames whose declared length exceeds the received data (CVE-2026-98481)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Port-100 driver. An attacker connecting a malicious USB device can provide a response frame whose declared length exceeds the actual received data size. This flaw causes…
CVE-2026-98482Medium· 6.5kernel: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (CVE-2026-98482)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. The Logical Link Control Protocol (LLCP) implementation does not verify the length of incoming network packets before reading sequence information. An attacke…
CVE-2026-98485Medium· 5.9kernel: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (CVE-2026-98485)
A flaw was found in the Linux kernel's netfilter subsystem. This flaw allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted IPv6 packets to an affected system. The issue occurs when an IPv6 routing header…
CVE-2026-98499Medium· 6.8kernel: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (CVE-2026-98499)
A flaw was found in the Linux kernel's Wacom Human Interface Device (HID) driver. When processing a device report descriptor with mismatched usage and count configurations, the driver can calculate an invalid memory offset and perform an o…
CVE-2026-98517Medium· 5.5⚖ disputedkernel: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (CVE-2026-98517)
A flaw was found in the Linux kernel's Nouveau graphics driver. When handling buffer objects in system memory, the driver improperly accesses memory past the allocated resource boundary. A local attacker could exploit this flaw to cause a …
CVE-2026-98576Medium· 5.3kernel: nfc: llcp: fix slab-out-of-bounds reads when logging service names (CVE-2026-98576)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. When processing certain service names and requests, the kernel attempts to log strings that lack null-termination using an unbounded format specifier. A local…
CVE-2026-98575Medium· 6.2kernel: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (CVE-2026-98575)
A flaw was found in the Linux kernel's PN533 NFC (Near Field Communication) driver. An attacker capable of connecting a malicious or malfunctioning USB device can supply a crafted response frame with an arbitrary data length value. Because…
CVE-2026-98578Medium· 6.5kernel: nfc: st21nfca: validate ISO15693 inventory length (CVE-2026-98578)
A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. This vulnerability allows a Denial of Service (DoS) when the system encounters malformed wireless NFC responses. A nearby attacker with a crafted NFC de…
CVE-2026-98582Medium· 6.5kernel: nfc: st21nfca: validate received frame size (CVE-2026-98582)
A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. The driver fails to properly validate the length of received frames when processing escape sequences. An attacker capable of sending crafted NFC frames …
CVE-2026-98583Medium· 4.4kernel: nfc: nfcmrvl: validate helper command length before pull (CVE-2026-98583)
A flaw was found in the Linux kernel's Marvell NFC (Near Field Communication) driver. During firmware download operations, the driver removes packet headers and reads command data before verifying that the received packet length is valid. …
CVE-2026-98597Medium· 6.5kernel: net: usb: sr9700: include receive overhead in the length check (CVE-2026-98597)
A flaw was found in the Linux kernel's sr9700 USB Ethernet driver. When processing incoming packets, the driver fails to properly account for packet header overhead during buffer length validation. An attacker capable of sending crafted pa…
CVE-2026-98612Medium· 6.8kernel: net: usb: catc: bound the RX packet length in catc_rx_done() (CVE-2026-98612)
A flaw was found in the Linux kernel's CATC USB Ethernet driver. The driver fails to properly validate packet length boundaries when processing incoming multi-packet network transfers. An attacker could exploit this flaw by providing craft…
CVE-2026-98611Medium· 4.4kernel: bpf: Check params size before reading reserved fields (CVE-2026-98611)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The bpf_crypto_ctx_create() function attempts to read reserved fields from a parameter structure prior to verifying that the supplied buffer is sufficiently lar…
CVE-2026-112055Medium· 5.5PoCwvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP
wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes…
CVE-2026-112052Medium· 6.1PoClibspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing
libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BL…
CVE-2026-112053Medium· 5.5PoCSchroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix
Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can d…
CVE-2026-112057Medium· 5.5PoClibdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a craft…