← All credits

Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue.

10 vulnerability records and advisories credit this contributor.

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk

Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing

Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta

Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit

Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal

CVE-2026-115486

Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning

CVE-2026-115485

Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio

CVE-2026-115484

Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly