PT-2026-98021

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the PCI altera component when stopping and removing a root bus. The issue occurs when the pci rescan remove lock lock is not held, allowing concurrent rescan o...

PT-2026-97830

Name of the Vulnerable Software and Affected Versions Altera Trusted Firmware on HPS versions prior to socfpga v2.14.0 Description An untrusted pointer dereference issue in the Altera SoCFPGA BL31 Mailbox output pointer validation allows for the exploitation of improperly configured or implemente...

CVE-2026-58007: Untrusted Pointer Dereference

Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpgav2.14.0...

PT-2026-97829

Name of the Vulnerable Software and Affected Versions Altera Trusted Firmware on HPS versions prior to socfpga v2.14.0 Description An out-of-bounds read issue exists where unvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3. This can lead to...

PT-2026-97817

Name of the Vulnerable Software and Affected Versions Altera Trusted Firmware on HPS versions prior to socfpga v2.14.0 Description A stack-based buffer overflow exists in the EL3 Exception Level 3, the highest privilege level in ARMv8-A architecture during an FCS HKDF request. This flaw allows fo...

PT-2026-97828

Name of the Vulnerable Software and Affected Versions Altera Trusted Firmware on HPS versions prior to socfpga v2.14.0 Description An out-of-bounds read issue occurs when a crafted oversized firmware image is processed, leading to an EL3 stack overflow during VAB authentication. This can result i...

PT-2026-104938

In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Protect root bus removal with rescan lock Hold the pci rescan remove lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may...

CVE-2026-93821: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead...

PT-2026-97818

Name of the Vulnerable Software and Affected Versions Altera Trusted Firmware on HPS versions prior to socfpga v2.14.0 Description An incorrect calculation of buffer size in the Altera Trusted Firmware on HPS allows for buffer overflows. This occurs due to unit confusion during VAB authentication...

CVE-2026-13465: Stack-based Buffer Overflow

Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpgav2.14.0...

CVE-2026-58008: Stack-based Buffer Overflow

Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpgav2.14.0...

SUSE CVE-2026-89730

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in alteracvpsendblock dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: altera-tse: a bug has been fixed regarding a skb leak during DMA mapping in tsestartxmit. When dmamapsingle fails in tsestartxmit, the function returns NETDEVTXOK without freeing the skb. Since NETDEVTXOK signals to the stac...

Linux Distros Unpatched Vulnerability : CVE-2026-89730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in alteracvpsendblock dereferences a u32 pointer even when only 1-3 byt...

CVE-2026-89730

A flaw was found in the altera-cvp FPGA driver within the Linux kernel. The alteracvpsendblock function can perform an out-of-bounds read when processing the trailing bytes of an input buffer. This occurs if the buffer ends at a page or scatterlist boundary, causing the function to read past vali...

AZL-100439 CVE-2026-89730 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in alteracvpsendblock dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

DEBIAN-CVE-2026-89730

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in alteracvpsendblock dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

CVE-2026-89730

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in alteracvpsendblock dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

CVE-2026-89730

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in alteracvpsendblock dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

UBUNTU-CVE-2026-89730

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in alteracvpsendblock dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...