EUVD-2026-76641

In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensorhubgetfeature sensorhubgetfeature clamps its return value to the caller's buffer size, but the copy loop still copies field-reportsize / 8 bytes for each report value. A malicious...

CVE-2026-89728

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA Dynamic Address Assignment, the controller reports the result via the NRSPQP Normal Response Queue Port Register. The data length field of the...

CVE-2026-89729 HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensorhubgetfeature sensorhubgetfeature clamps its return value to the caller's buffer size, but the copy loop still copies field-reportsize / 8 bytes for each report value. A malicious...

CVE-2026-89728 i3c: renesas: Fix out-of-bounds access for newdevs mask

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA Dynamic Address Assignment, the controller reports the result via the NRSPQP Normal Response Queue Port Register. The data length field of the...

CVE-2026-89727

CVE-2026-89727 affects the Linux kernel KVM arm64 GICv2 implementation. In vgic_v2_deactivate(), a guest-written INTID is passed directly to vgic_get_vcpu_irq(), where a failed lookup triggers WARN_ON_ONCE()—treated as a "can't happen" condition. Since GICv2 has no LPIs, any INTID outside the SGI...

CVE-2026-89727 KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID vgicv2deactivate passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq, and treats a failed lookup as a "can't happen" condition with WARNONONCE. The gues...

EUVD-2026-76639

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID vgicv2deactivate passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq, and treats a failed lookup as a "can't happen" condition with WARNONONCE. The gues...

CVE-2026-89726

CVE-2026-89726 is an off-by-one out-of-bounds read in the Linux kernel's lib/ucs2_string.c, specifically in the ucs2_strnlen() function. The root cause is that ucs2_strnlen() checks the current character before verifying whether the caller-provided maximum length has been reached. If the input is...

EUVD-2026-76638

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

CVE-2026-89726 lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

CVE-2026-89726

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

CVE-2026-89726 lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

EUVD-2026-76637

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

CVE-2026-89725 media: cec: stm32: prevent out-of-bounds write on RX overflow

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

CVE-2026-89725

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

CVE-2026-89725

CVE-2026-89725 affects the Linux kernel's media: cec: stm32 driver, where stm32_rx_done() writes received CEC bytes into a fixed 16-byte buffer (rx_msg.msg[]) without bounds-checking the write index. A remote CEC device on an adjacent network that transmits bytes without an end-of-message signal ...

CVE-2026-89723

CVE-2026-89723 affects the nilfs2 file system component of the Linux kernel . The root cause is that when a B-tree mapping collapses into a direct mapping during file truncation, an intermediate node block immediately below the B-tree root is left orphaned in the B-tree node cache in a dirty stat...

EUVD-2026-76635

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfsdirectpropagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfsdirectpropagate during testing. Analysis revealed that after truncating a file...

CVE-2026-89724 media: vicodec: fix out-of-bounds write in FWHT encoder

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

CVE-2026-89724

CVE-2026-89724 is an out-of-bounds write in the Linux kernel's media: vicodec FWHT encoder. The function vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer using pixfmt_fwht.sizeimage_mult of 3, but for 4-component pixel formats where all planes are full resolution, the unencoded fallback pa...