388323 matches found
CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...
CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...
CVE-2026-89619 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...
EUVD-2026-76531
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...
CVE-2026-89619 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...
CVE-2026-89620
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...
CVE-2026-89620 HID: intel-thc-hid: intel-quickspi: validate report size before copy
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...
CVE-2026-89619
A buffer overflow in the Linux kernel's intel-quickspi HID driver (part of the intel-thc-hid subsystem) occurs because quickspi_get_report() copies the entire device-supplied report into the caller's buffer without validating it against the caller-provided length. A malicious HID touch controller...
EUVD-2026-76532
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...
CVE-2026-89620 HID: intel-thc-hid: intel-quickspi: validate report size before copy
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...
CVE-2026-89619
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...
CVE-2026-89620
CVE-2026-89620 affects the Linux kernel HID Intel QuickSPI driver (intel-thc-hid: intel-quickspi). The function write_cmd_to_txdma() copies a caller-supplied report into a heap buffer (report_buf) sized to the device-descriptor-derived max_report_len (a few hundred bytes) without validating that ...
CVE-2026-89618 eventfs: Initialize ei->children and ei->list in init_ei()
In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei-children and ei-list in initei eventfscreatedir allocates the eventfsinode and initializes it with initei. But this does not initialize the eventfsinode listheads. If the eventfscreatedir fails due to memor...
CVE-2026-89618
CVE-2026-89618 affects the Linux kernel 's eventfs (event filesystem) subsystem. The root cause is that init_ei() does not initialize the eventfs_inode list heads (ei->children and ei->list). When eventfs_create_dir() fails due to memory pressure , it calls free_ei() before the lists are in...
EUVD-2026-76530
In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei-children and ei-list in initei eventfscreatedir allocates the eventfsinode and initializes it with initei. But this does not initialize the eventfsinode listheads. If the eventfscreatedir fails due to memor...
CVE-2026-89618 eventfs: Initialize ei->children and ei->list in init_ei()
In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei-children and ei-list in initei eventfscreatedir allocates the eventfsinode and initializes it with initei. But this does not initialize the eventfsinode listheads. If the eventfscreatedir fails due to memor...
CVE-2026-89616 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...
EUVD-2026-76529
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...
CVE-2026-89617
A vulnerability in the Linux kernel NTFS3 filesystem driver (fs/ntfs3) allows a local attacker to craft a malicious NTFS log file where a tampered lcns_follow field in a DIR_PAGE_ENTRY causes an out-of-bounds write during log replay. The root cause is that check_rstbl() validates table bookkeepin...
CVE-2026-89616 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...