CVE-2026-80830

This vulnerability affects the Linux kernel USB core subsystem, specifically the usb_wakeup_notification() function, which lacked a spin lock. The xHCI driver calls this function from IRQ context, creating a race condition with hub_disconnect() that can lead to dereferencing freed memory (use-aft...

CVE-2026-80829 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput sndusbmidinovationoutput lays out a two-byte header at transferbuffer0..1 and passes &transferbuffer2 together with a length of ep-maxtransfer - 2 to sndrawmiditransmit:...

EUVD-2026-71279

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput sndusbmidinovationoutput lays out a two-byte header at transferbuffer0..1 and passes &transferbuffer2 together with a length of ep-maxtransfer - 2 to sndrawmiditransmit:...

CVE-2026-80829

CVE-2026-80829 is an out-of-bounds write in the Linux kernel 's ALSA usb-audio subsystem, specifically in snd_usbmidi_novation_output(). A malformed or malicious USB device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1, causing the length passed to snd_rawmidi_transmit() to become ...

EUVD-2026-71278

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usbaudioresume jumps to errout when sndusbpcmresume or sndusbmixerresume fails. The error path skips th...

CVE-2026-80828 ALSA: usb-audio: Complete cleanup after system-resume errors

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usbaudioresume jumps to errout when sndusbpcmresume or sndusbmixerresume fails. The error path skips th...

CVE-2026-80828

CVE-2026-80828 affects the Linux kernel ALSA usb-audio subsystem. When usb_audio_resume() encounters a failure in snd_usb_pcm_resume() or snd_usb_mixer_resume() during system resume, it jumps to err_out, skipping the out: block that restores D0 power state and decrements chip->num_suspended_in...

CVE-2026-80827

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

CVE-2026-80827 USB: serial: option: fix slab OOB read in interrupt URB callback

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

CVE-2026-80827

CVE-2026-80827 affects the Linux kernel's USB serial option driver (usb-serial-option). The interrupt URB buffer is allocated in setup_port_interrupt_in() using the endpoint's wMaxPacketSize via kmalloc(). When a USB device declares wMaxPacketSize = 8, the buffer is exactly 8 bytes. If the device...

EUVD-2026-71277

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

CVE-2026-80826 USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00addisourb When TD creation fails for the last packet of an isochronous URB, c67x00addisourb gives the URB back before updating the endpoint scheduling state. c67x00givebackurb frees the UR...

EUVD-2026-71276

In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00addisourb When TD creation fails for the last packet of an isochronous URB, c67x00addisourb gives the URB back before updating the endpoint scheduling state. c67x00givebackurb frees the UR...

CVE-2026-80826

CVE-2026-80826 is a use-after-free in the Linux kernel's c67x00 USB driver , specifically in c67x00_add_iso_urb(). When TD creation fails for the last packet of an isochronous URB, the driver gives the URB back before updating the endpoint scheduling state. Since c67x00_giveback_urb() frees the U...

EUVD-2026-71275

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated...

CVE-2026-80825

CVE-2026-80825 affects the Linux kernel mt76 WiFi driver for mt7925 USB/SDIO devices (mt7925u). The function mt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and USB header onto every skb, assuming sufficient headroom is already present. This assumption holds for locally generated traffic ...

CVE-2026-80825 wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated...

EUVD-2026-71274

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs, but that drain path reads back through the same object:...

CVE-2026-80824

CVE-2026-80824 is a use-after-free in the Linux kernel's usbfs subsystem. In usbdev_release(), the reference to struct usb_device is dropped before draining completed async URBs; the drain path then dereferences the already-freed device via bus_to_hcd(ps->dev->bus) in dec_usb_memory_use_cou...

CVE-2026-80824

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs, but that drain path reads back through the same object:...