CVE-2026-74447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

CVE-2026-74447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

EUVD-2026-59754

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

CVE-2026-74447

In the Linux kernel (drm/amdkfd), a uint32_t overflow in EOP ring buffer size alignment was fixed. The issue occurred because eop_ring_buffer_size (u32) is aligned with PAGE_SIZE in kfd_queue_acquire_buffers() using 32‑bit arithmetic, allowing a user size like 0xFFFFF001 to wrap to 0 and bypass t...

CVE-2026-74447 drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

CVE-2026-74356 vhost: fix vhost_get_avail_idx for a non empty ring

In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhostgetavailidx for a non empty ring vhostgetavailidx is supposed to report whether it has updated vq-availidx. Instead, it returns whether all entries have been consumed, which is usually the same. But not always - i...

CVE-2026-74356 vhost: fix vhost_get_avail_idx for a non empty ring

In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhostgetavailidx for a non empty ring vhostgetavailidx is supposed to report whether it has updated vq-availidx. Instead, it returns whether all entries have been consumed, which is usually the same. But not always - i...

CVE-2026-68365

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

UBUNTU-CVE-2026-68365

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

CVE-2026-68365 USB: serial: io_edgeport: cap received transmit credits

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

CVE-2026-68365

The CVE concerns the Linux kernel USB serial driver for io_edgeport. The vulnerability arises because edge_interrupt_callback() adds a 16-bit transmit-credits value to txCredits without enforcing maxTxCredits. edge_write() then uses (txCredits − software FIFO count) as the data that fits, and sin...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Tracing: Ring-buffer: A fix was made to check the length of events before using them. Check the length of events before adding them for accessing the next index in rbreaddatabuffer. Since this function is used to validate possibl...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Ensuring that pending IRQ work is processed before freeing the ring buffer. A race condition was addressed in this fix, where irqwork could be queued in bpfringbufcommit, but the ring buffer was freed before the work execute...

Linux Distros Unpatched Vulnerability : CVE-2026-68365

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds t...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

CVE-2026-64258

A flaw was found in the fuse-uring component of the Linux kernel. When a copy operation to the userspace ring buffer fails, a request can be terminated improperly, leading to a NULL pointer dereference. This vulnerability could allow a local attacker to cause a system crash, resulting in a Denial...

CVE-2026-64300

A flaw was found in the Linux kernel's perf/aux subsystem. A use-after-free UAF vulnerability exists in the maprange function due to a race condition. This can occur when two performance events share a ring buffer, allowing a local attacker to map a memory page that has already been freed...

CVE-2026-64464

In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhciringtosgtable allocates a temporary pages array and uses it to build the returned sgtable with sgalloctablefrompages. The error paths free the pages array, but the success path...

CVE-2026-64464

Consolidated details show CVE-2026-64464 affects the Linux kernel xhci sideband path: xhci_ring_to_sgtable() allocates a temporary pages array used to build an sg_table via sg_alloc_table_from_pages(). On success, the temporary array isn’t freed, causing a leak each time a sideband client uses an...