CVE-2026-64363 HID: appleir: fix UAF on pending key_up_timer in remove()

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input device via hiddisconnect - hidinputdisconnect - inputunregisterdevice,...

EUVD-2026-48907

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input device via hiddisconnect - hidinputdisconnect - inputunregisterdevice,...

CVE-2026-64309

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCOMMIT Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

CVE-2026-64290 iommufd: Break the loop on failure in iommufd_fault_fops_read()

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

EUVD-2026-48992

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afudmamapregion afuioctldmamap accepts a 64-bit length from userspace via DFLFPGAPORTDMAMAP ioctl without an upper bound check. The value is passed to afudmapinpages where npages is...

CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64276

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmif30mapgpios allocates gpioledkeymap with mingpioledcount, TRACKSTICKRANGEEND == at most 6 entries, but rmif30attention iterates the full f30-gpioledcount devic...

CVE-2026-64274 Input: goodix - clamp the device-reported contact count

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

EUVD-2026-48986

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

CVE-2026-64274

The CVE-2026-64274 issue is in the Linux kernel Goodix touchscreen driver. The code reads device-reported touch counts without clamping, allowing a malfunctioning/malicious controller (or I2C bus tampering) to advertise up to 15 contacts. This enables a stack out-of-bounds write in goodix_ts_read...

CVE-2026-64274 Input: goodix - clamp the device-reported contact count

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

CVE-2026-64272 Input: mms114 - fix touch indexing for MMS134S and MMS136

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

EUVD-2026-48983

In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet twinterrupt accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received and t...

CVE-2026-64271

CVE-2026-64271 affects the Linux kernel with a heap-out-of-bounds risk in TouchWindow serio touchscreen handling. The issue arises when a malicious peripheral streams non-zero bytes where the device-supplied 2nd and 3rd bytes do not match; tw->idx can reach TW_LENGTH and never reset, allowing ...

Infinite loop on invalid input in golang.org/x/text

...

Chromium: CVE-2026-16804 Use after free in Input

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-64501

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where afu ioctl dma map accepts a 64-bit length from userspace via the DFL FPGA PORT DMA MAP ioctl without an upper bound check. This value is passed to afu dma pin pages...

PT-2026-64584

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending key up timer in remove appleir remove runs hid hw stop before timer delete sync. hid hw stop synchronously unregisters the HID input device via hid disconnect - hidinput disconnect - input...

PT-2026-64552

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the vep dequeue function within the usbip vudc component. The issue occurs because vep alloc request fails to initialize the vrequest-udc variable...

Linux Distros Unpatched Vulnerability : CVE-2026-64273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: iforce - bound the device-reported force-feedback effect index iforceprocesspacket handles a status report packet id 0x02 by taking a force-feedback effe...