https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T15:48:33.398741+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-98298 BELL-CVE-2026-98298 2026-10-09T15:48:33.492443+00:00

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

 https://cve.radiocsirt.org/vuln/euvd-2026-383410 EUVD-2026-383410 2026-10-09T15:48:33.492497+00:00 EUVD-2026-383410 https://cve.radiocsirt.org/vuln/fkie_cve-2026-98298 fkie_cve-2026-98298 2026-10-09T15:48:33.492513+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry):

for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */

Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.

 https://cve.radiocsirt.org/vuln/ghsa-262v-749m-59x9 GHSA-262v-749m-59x9 2026-10-09T15:48:33.492548+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry):

for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */

Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-98298 msrc_CVE-2026-98298 — dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() 2026-10-09T15:48:33.492571+00:00 msrc_CVE-2026-98298 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-98298 UBUNTU-CVE-2026-98298 2026-10-09T15:48:33.492589+00:00

Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 247 more

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry): for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */ Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.