EUVD-2026-66475

In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restoresigcontext copies the whole supervision register SR from the signal frame and only clears SPRSRSM before the value is reloaded into the hardware SR through E...

EUVD-2026-66483

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

EUVD-2026-66466

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full...

EUVD-2026-66484

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmif54work reads a diagnostics report from the device into f54-reportdata, sizing the transfer with rmif54getreportsize: reportsize = rmif54getreportsizef5...

EUVD-2026-66480

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devmqceregisteralgs If ops-registeralgs fails, the error path repeatedly calls the same ops-unregisteralgs from the failed registration. Use the loop index to unregister the previously registered...

EUVD-2026-66468

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Cancel existing workqueues The initialization of the iowork and crwwork workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in releasedev to ensure work isn't...

EUVD-2026-66474

In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40probe, inputregisterdevice was previously called early before the V4L2 video device and vb2queue components were fully initialized. If userspace opened the input devic...

EUVD-2026-66473

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primarytemp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pgtemp, primarytemp, pgupmap, and pgupmapitems parts that don't exist, i.e., that are...

EUVD-2026-66470

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Free all memory if cpinit fails The routine cpfree is called to unpin/free any memory once an I/O is completed successfully, or if cpprefetch fails. But if cpinit fails, and cp-initialized is not enabled, the same...

EUVD-2026-66485

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmif54work, if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where...

EUVD-2026-66491

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

EUVD-2026-66469

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary but not architectural limit to the number of CCWs that c...

EUVD-2026-66471

In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmciremove due to race condition In atmciprobe, &host-bhwork is bound with atmciworkfunc, and atmciinterrupt, atmcitimeouttimer and atmcidmacomplete can all queue this work on systembhwq. If...

EUVD-2026-66488

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

EUVD-2026-66490

In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50add copies the custom data of an FFPERIODIC/FFCUSTOM effect straight from the ffeffect the user passed to EVIOCSFF, without requiring it to hold anything:...

EUVD-2026-66467

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing...

EUVD-2026-66465

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Fix out of bounds check on CCW array The routine ccwchaincalclength counts the number of channel command words CCWs that are chained together in a single channel program, and rejects anything larger than...

EUVD-2026-66487

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byddisconnect uses timerdelete before freeing the driver's private data. This does not wait for a running bydcleartouch callback, which dereferences the private...

EUVD-2026-66489

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

EUVD-2026-66459

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing The zcryptmsgtype6sendep11cprb function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, creating maintainability and...