https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:05:34 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10737 bdu:2026-10737 https://cve.radiocsirt.org/vuln/bdu:2026-10737 https://cve.radiocsirt.org/vuln/bell-cve-2026-31747 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-31747 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0547 certfr-2026-avi-0547 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0547 https://cve.radiocsirt.org/vuln/euvd-2026-315684 EUVD-2026-315684 https://cve.radiocsirt.org/vuln/euvd-2026-315684 https://cve.radiocsirt.org/vuln/fkie_cve-2026-31747 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>comedi: me4000: Fix potential overrun of firmware buffer</p> <p>`me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards.</p> <p>Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`.</p> <p>Note: The firmware loading was totally broken before commit ac584af59945 (&#34;staging: comedi: me4000: fix firmware downloading&#34;), but that is the most sensible target for this fix.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>comedi: me4000: Fix potential overrun of firmware buffer</p> <p>`me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards.</p> <p>Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`.</p> <p>Note: The firmware loading was totally broken before commit ac584af59945 (&#34;staging: comedi: me4000: fix firmware downloading&#34;), but that is the most sensible target for this fix.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-31747 https://cve.radiocsirt.org/vuln/ghsa-28wg-v83v-vrgh <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>comedi: me4000: Fix potential overrun of firmware buffer</p> <p>`me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards.</p> <p>Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`.</p> <p>Note: The firmware loading was totally broken before commit ac584af59945 (&#34;staging: comedi: me4000: fix firmware downloading&#34;), but that is the most sensible target for this fix.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>comedi: me4000: Fix potential overrun of firmware buffer</p> <p>`me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards.</p> <p>Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`.</p> <p>Note: The firmware loading was totally broken before commit ac584af59945 (&#34;staging: comedi: me4000: fix firmware downloading&#34;), but that is the most sensible target for this fix.</p> https://cve.radiocsirt.org/vuln/ghsa-28wg-v83v-vrgh https://cve.radiocsirt.org/vuln/oesa-2026-3303 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>comedi: me4000: Fix potential overrun of firmware buffer</p> <p>`me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards.</p> <p>Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`.</p> <p>Note: The firmware loading was totally broken before commit ac584af59945 (&amp;quot;staging: comedi: me4000: fix firmware downloading&amp;quot;), but that is the most sensible target for this fix.(CVE-2026-31747)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ASoC: soc-core: flush delayed work before removing DAIs and widgets</p> <p>When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm_stream_event(), called from the close_delayed_work workqueue handler.</p> <p>During unbind, snd_soc_unbind_card() flushes delayed work and then calls soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors, and the resulting PCM close path can call snd_soc_dapm_stream_stop() which schedules new delayed…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>comedi: me4000: Fix potential overrun of firmware buffer</p> <p>`me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards.</p> <p>Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`.</p> <p>Note: The firmware loading was totally broken before commit ac584af59945 (&amp;quot;staging: comedi: me4000: fix firmware downloading&amp;quot;), but that is the most sensible target for this fix.(CVE-2026-31747)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ASoC: soc-core: flush delayed work before removing DAIs and widgets</p> <p>When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm_stream_event(), called from the close_delayed_work workqueue handler.</p> <p>During unbind, snd_soc_unbind_card() flushes delayed work and then calls soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors, and the resulting PCM close path can call snd_soc_dapm_stream_stop() which schedules new delayed…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3303 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21555-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21555-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-31747 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge and 232 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: comedi: me4000: Fix potential overrun of firmware buffer `me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards. Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`. Note: The firmware loading was totally broken before commit ac584af59945 (&#34;staging: comedi: me4000: fix firmware downloading&#34;), but that is the most sensible target for this fix.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge and 232 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: comedi: me4000: Fix potential overrun of firmware buffer `me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards. Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`. Note: The firmware loading was totally broken before commit ac584af59945 (&#34;staging: comedi: me4000: fix firmware downloading&#34;), but that is the most sensible target for this fix.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-31747 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1346 <p>Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Root-Rechte zu erlangen, um Sicherheitsmechanismen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder Auswirkungen unbestimmter Art zu erzielen.</p> <p>Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Root-Rechte zu erlangen, um Sicherheitsmechanismen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder Auswirkungen unbestimmter Art zu erzielen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1346