https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:16:34 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-46294 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-46294 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0862 certfr-2026-avi-0862 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0862 https://cve.radiocsirt.org/vuln/euvd-2026-327205 EUVD-2026-327205 https://cve.radiocsirt.org/vuln/euvd-2026-327205 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46294 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm: fix a buffer overflow in ioctl processing</p> <p>Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status:</p> <p>1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the &#34;outptr&#34; variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn&#39;t check overflow, so outptr could point past the buffer end 4. The &#34;for&#34; loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If &#34;outptr&#34; points past &#34;outbuf + len&#34;, the arithmetics wraps around and the variable &#34;remaining&#34; contains unusually high number 6. With &#34;remaining&#34; being high, the code writes more data past the end of the buffer</p> <p>Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, &#34;outptr = align_ptr(outptr)&#34; can&#39;t overshoot the input buffer and the bug can&#39;t happen accidentally</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm: fix a buffer overflow in ioctl processing</p> <p>Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status:</p> <p>1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the &#34;outptr&#34; variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn&#39;t check overflow, so outptr could point past the buffer end 4. The &#34;for&#34; loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If &#34;outptr&#34; points past &#34;outbuf + len&#34;, the arithmetics wraps around and the variable &#34;remaining&#34; contains unusually high number 6. With &#34;remaining&#34; being high, the code writes more data past the end of the buffer</p> <p>Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, &#34;outptr = align_ptr(outptr)&#34; can&#39;t overshoot the input buffer and the bug can&#39;t happen accidentally</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46294 https://cve.radiocsirt.org/vuln/ghsa-c9hh-9962-q529 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm: fix a buffer overflow in ioctl processing</p> <p>Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status:</p> <p>1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the &#34;outptr&#34; variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn&#39;t check overflow, so outptr could point past the buffer end 4. The &#34;for&#34; loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If &#34;outptr&#34; points past &#34;outbuf + len&#34;, the arithmetics wraps around and the variable &#34;remaining&#34; contains unusually high number 6. With &#34;remaining&#34; being high, the code writes more data past the end of the buffer</p> <p>Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, &#34;outptr = align_ptr(outptr)&#34; can&#39;t overshoot the input buffer and the bug can&#39;t happen accidentally</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm: fix a buffer overflow in ioctl processing</p> <p>Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status:</p> <p>1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the &#34;outptr&#34; variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn&#39;t check overflow, so outptr could point past the buffer end 4. The &#34;for&#34; loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If &#34;outptr&#34; points past &#34;outbuf + len&#34;, the arithmetics wraps around and the variable &#34;remaining&#34; contains unusually high number 6. With &#34;remaining&#34; being high, the code writes more data past the end of the buffer</p> <p>Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, &#34;outptr = align_ptr(outptr)&#34; can&#39;t overshoot the input buffer and the bug can&#39;t happen accidentally</p> https://cve.radiocsirt.org/vuln/ghsa-c9hh-9962-q529 https://cve.radiocsirt.org/vuln/oesa-2026-2753 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm: fix a buffer overflow in ioctl processing</p> <p>Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status:</p> <p>1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the &amp;quot;outptr&amp;quot; variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn&amp;apos;t check overflow, so outptr could point past the buffer end 4. The &amp;quot;for&amp;quot; loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If &amp;quot;outptr&amp;quot; points past &amp;quot;outbuf + len&amp;quot;, the arithmetics wraps around and the variable &amp;quot;remaining&amp;quot; contains unusually high number 6. With &amp;quot;remaining&amp;quot; being high, the code writes more data past the end of the buffer</p> <p>Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, &amp;quot;outptr = align_ptr(outptr)&amp;quot; can&amp;apos;t overshoot the input buffer and the bug can&amp;apos;t happen accidentally(CVE-2026-46294)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm: fix a buffer overflow in ioctl processing</p> <p>Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status:</p> <p>1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the &amp;quot;outptr&amp;quot; variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn&amp;apos;t check overflow, so outptr could point past the buffer end 4. The &amp;quot;for&amp;quot; loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If &amp;quot;outptr&amp;quot; points past &amp;quot;outbuf + len&amp;quot;, the arithmetics wraps around and the variable &amp;quot;remaining&amp;quot; contains unusually high number 6. With &amp;quot;remaining&amp;quot; being high, the code writes more data past the end of the buffer</p> <p>Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, &amp;quot;outptr = align_ptr(outptr)&amp;quot; can&amp;apos;t overshoot the input buffer and the bug can&amp;apos;t happen accidentally(CVE-2026-46294)</p> https://cve.radiocsirt.org/vuln/oesa-2026-2753 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11014-1 <p>kernel-devel-7.0.12-1.1 on GA media</p> <p>kernel-devel-7.0.12-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11014-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-46294 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 253 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the &#34;outptr&#34; variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn&#39;t check overflow, so outptr could point past the buffer end 4. The &#34;for&#34; loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If &#34;outptr&#34; points past &#34;outbuf + len&#34;, the arithmetics wraps around and the variable &#34;remaining&#34; contains unusually high number 6. With &#34;remaining&#34; being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, &#34;outptr = align_ptr(outptr)&#34; can&#39;t overshoot the input buffer and the bug can&#39;t happen accidentally</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 253 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the &#34;outptr&#34; variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn&#39;t check overflow, so outptr could point past the buffer end 4. The &#34;for&#34; loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If &#34;outptr&#34; points past &#34;outbuf + len&#34;, the arithmetics wraps around and the variable &#34;remaining&#34; contains unusually high number 6. With &#34;remaining&#34; being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, &#34;outptr = align_ptr(outptr)&#34; can&#39;t overshoot the input buffer and the bug can&#39;t happen accidentally</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-46294 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1827 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder nicht bekannte Auswirkungen zu erzielen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder nicht bekannte Auswirkungen zu erzielen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1827