https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T11:49:14.865424+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-80603 CVE-2026-80603 — netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read 2026-10-19T11:49:15.138423+00:00

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read

parse_dcc() treats data_end as an inclusive end pointer, but its only caller passes data_limit = ib_ptr + datalen, which points one past the last valid byte.

The newline search loop iterates while tmp <= data_end, so when no newline is present, *tmp is read at tmp == data_end, one byte beyond the region filled by skb_header_pointer().

irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte is uninitialized or stale; if it contains an ASCII digit, simple_strtoul will consume it and produce a wrong DCC IP or port in the conntrack expectation. The extra allocation byte is also a fragile guard: if the cap or allocation size changes, this becomes a real out-of-bounds read.

Change the loop and its post-loop check to use strict less-than, consistent with the caller's exclusive-end convention. Update the function comment accordingly.

 https://cve.radiocsirt.org/vuln/usn-8875-1 USN-8875-1 — linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips… 2026-10-19T11:49:15.138569+00:00

Affected: Ubuntu:Pro:20.04:LTS: linux-aws-5.15, Ubuntu:Pro:20.04:LTS: linux-azure-5.15, Ubuntu:Pro:20.04:LTS: linux-azure-fde-5.15, Ubuntu:Pro:20.04:LTS: linux-hwe-5.15, Ubuntu:Pro:20.04:LTS: linux-ibm-5.15, Ubuntu:Pro:20.04:LTS: linux-intel-iotg-5.15, Ubuntu:Pro:20.04:LTS: linux-lowlatency-hwe-5.15, Ubuntu:22.04:LTS: linux, Ubuntu:22.04:LTS: linux-aws, Ubuntu:22.04:LTS: linux-azure and 13 more

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - User-space API (UAPI); - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - Android drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Bluetooth drivers; - Cdrom driver; - Character device driver; - Hardware random number generator core; - TPM device driver; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - DAX dirext access to differentiated memory framework; - DMA engine subsystem; - FireWire subsystem; - Arm Firmware Framework for ARMv8-A(FFA); - ARM SCMI message protocol; - Intel Stratix 10 firmware drivers; - FPGA Framework; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - In…