CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64276

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmif30mapgpios allocates gpioledkeymap with mingpioledcount, TRACKSTICKRANGEEND == at most 6 entries, but rmif30attention iterates the full f30-gpioledcount devic...

CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

UBUNTU-CVE-2026-64363

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input device via hiddisconnect - hidinputdisconnect - inputunregisterdevice,...

UBUNTU-CVE-2026-64273

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the device-reported force-feedback effect index iforceprocesspacket handles a status report packet id 0x02 by taking a force-feedback effect index straight from the device wire and using it to address the...

UBUNTU-CVE-2026-64487

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser sndusbcaiaqtks4dispatch decodes the Traktor Kontrol S4 input stream in fixed 16-byte TKS4MSGBLOCKSIZE message blocks. On every iteration it advances buf a...

UBUNTU-CVE-2026-64366

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacomwacqueueinsert wacomwacqueueinsert calls kfifoskip in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifoskip reads stale data lef...

UBUNTU-CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

CVE-2026-64529

Summary: CVE-2026-64529 exists in the Linux kernel and concerns the QAT driver. The vulnerability stems from a previously exposed character device (qat_adf_ctl) with IOCTLs used for device configuration, start/stop, status, and enumeration that were not part of public user-space API headers and h...

CVE-2026-64498

The CVE-2026-64498 issue affects the Linux kernel IIO subsystem (iio: buffer: hw-consumer). The root cause was a lifetime change for scan_mask: it moved to a separate bitmap allocation (buffer.scan_mask) but iio_hw_buf_release() remained unchanged, risking improper cleanup. The fix ensures the sc...

EUVD-2026-48831

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser sndusbcaiaqtks4dispatch decodes the Traktor Kontrol S4 input stream in fixed 16-byte TKS4MSGBLOCKSIZE message blocks. On every iteration it advances buf a...

CVE-2026-64487

The CVE-2026-64487 entry is concrete: a Linux kernel ALSA caiaq issue in the Traktor Kontrol S4 input parser. The bug arises in snd_usb_caiaq_tks4_dispatch() when decoding the 16-byte message blocks: urb->actual_length (len) is device-supplied and may not be a multiple of 16. When the final sh...

CVE-2026-64487

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser sndusbcaiaqtks4dispatch decodes the Traktor Kontrol S4 input stream in fixed 16-byte TKS4MSGBLOCKSIZE message blocks. On every iteration it advances buf a...

CVE-2026-64487 ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser sndusbcaiaqtks4dispatch decodes the Traktor Kontrol S4 input stream in fixed 16-byte TKS4MSGBLOCKSIZE message blocks. On every iteration it advances buf a...

EUVD-2026-48822

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the...

CVE-2026-64478 ALSA: usb-audio: avoid kobject path lookup in DualSense match

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the...

CVE-2026-64478

Summary (CVE-2026-64478) : In the Linux kernel, the ALSA: usb-audio path for DualSense devices has been resolved to avoid an unsafe kobject path lookup during rapid hotplug reconnects. The vulnerable code path was in the DualSense jack-detection input handler, where snd_dualsense_ih_match() compa...

CVE-2026-64445 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...

CVE-2026-64409

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix infinite loop in btmtksdiotxrxwork Every once in a while we see a hung btmtksdioflush task: INFO: task kworker/u17:0:189 blocked for more than 122 seconds. cancelworktimer+0x3f4/0x460...

CVE-2026-64385

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2ioctl replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit fails before the next send, cleanup retains the previous buffer type and fre...