EUVD-2026-76654

In the Linux kernel, the following vulnerability has been resolved: rapidio: mportcdev: fix use-after-free in dmareqfree dmareqfree acquires bufmutex through req-map, drops the mapping reference with krefput, and then dereferences req-map again to unlock the mutex. If krefput drops the last...

CVE-2026-89742 rapidio: mport_cdev: fix use-after-free in dma_req_free()

In the Linux kernel, the following vulnerability has been resolved: rapidio: mportcdev: fix use-after-free in dmareqfree dmareqfree acquires bufmutex through req-map, drops the mapping reference with krefput, and then dereferences req-map again to unlock the mutex. If krefput drops the last...

CVE-2026-89719 zram: fix out-of-bounds access in read_block_state()

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in readblockstate readblockstate calculates nrpages before taking devlock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nrpages still describes the old...

CVE-2026-89719

CVE-2026-89719 affects the zram subsystem of the Linux kernel . The vulnerability is an out-of-bounds access in read_block_state() caused by a race condition: nr_pages is calculated before acquiring dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition...

CVE-2026-89718 zram: fix out-of-bounds access in writeback_store()

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writebackstore Patch series "zram: fix stale scan bounds after reinitialization". Both writebackstore and readblockstate derive their table scan bounds from zram-disksize before acquiring devlock...

EUVD-2026-76539

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccatreportevent duplicates each report with kmemdup and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The...

CVE-2026-89627

CVE-2026-89627 affects the Linux kernel 's HID roccat driver. The root cause is a memory leak : roccat_report_event() duplicates each report via kmemdup() into a circular buffer (cbuf[]), but the device destruction paths free struct roccat_device without releasing reports still stored in those sl...

CVE-2026-89627 HID: roccat: free buffered reports when destroying device

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccatreportevent duplicates each report with kmemdup and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The...

CVE-2026-89627

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccatreportevent duplicates each report with kmemdup and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The...

CVE-2026-89627 HID: roccat: free buffered reports when destroying device

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccatreportevent duplicates each report with kmemdup and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The...

CVE-2026-89623 HID: mcp2221: stop device IO before hid_hw_stop

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

CVE-2026-89623

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

EUVD-2026-76535

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

CVE-2026-89623

CVE-2026-89623 affects the Linux kernel's HID mcp2221 driver . During probe failure or device removal, incoming HID reports could race with hardware teardown in the mcp2221_hid_unregister() devm cleanup callback, resulting in a potential use-after-free . The fix quiesces device I/O by calling hid...

CVE-2026-89623 HID: mcp2221: stop device IO before hid_hw_stop

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

CVE-2026-89621

CVE-2026-89621 is a Linux kernel vulnerability in the HID mcp2221 driver's mcp2221_raw_event() function. The function fails to validate the size of incoming HID reports in the MCP2221_I2C_GET_DATA path, trusting a device-supplied data[3] field as the copy length without verifying that 4 + data[3]...

EUVD-2026-76533

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89621

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89619 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

CVE-2026-89619 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...