https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 11:42:41 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-97990 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>vdpa_sim_net: check TX pull result before RX copy</p> <p>vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path.</p> <p>Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes.</p> <p>I found this bug myself, though the patch was written with AI assistance.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>vdpa_sim_net: check TX pull result before RX copy</p> <p>vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path.</p> <p>Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes.</p> <p>I found this bug myself, though the patch was written with AI assistance.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-97990 https://vulnerability.circl.lu/vuln/ghsa-w85p-r6cx-8whc <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>vdpa_sim_net: check TX pull result before RX copy</p> <p>vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path.</p> <p>Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes.</p> <p>I found this bug myself, though the patch was written with AI assistance.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>vdpa_sim_net: check TX pull result before RX copy</p> <p>vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path.</p> <p>Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes.</p> <p>I found this bug myself, though the patch was written with AI assistance.</p> https://vulnerability.circl.lu/vuln/ghsa-w85p-r6cx-8whc https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-97990 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 246 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path. Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes. I found this bug myself, though the patch was written with AI assistance.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 246 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path. Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes. I found this bug myself, though the patch was written with AI assistance.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-97990 https://vulnerability.circl.lu/vuln/wid-sec-w-2026-3579 <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Zustand herbeizuführen oder nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Zustand herbeizuführen oder nicht näher spezifizierten Angriff durchzuführen.</p> https://vulnerability.circl.lu/vuln/wid-sec-w-2026-3579