EUVD-2026-62294

On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables...

CVE-2026-8810

On ARM platforms, an architecture-design flaw in HDD Password handling allows an attacker to retrieve the password from UEFI variables. CVSS 6.9 MEDIUM; physical access, high complexity, low privileges required. Exploitation details not provided in the documents.

CVE-2026-72181

A flaw was found in the Linux kernel's scheduler component, specifically when handling CPU masks on MIPS architecture with CONFIGCPUMASKOFFSTACK enabled. An incorrect size calculation during the copyfromuser operation could lead to memory corruption. This vulnerability allows a local attacker to...

CVE-2026-72292

A flaw was found in the kernel. A local user could exploit a vulnerability in the KVMS390GETCMMABITS ioctl, specifically within the kvms390getcmmabits function. This function allocates memory without properly initializing all pages, leading to uninitialized memory regions. These uninitialized...

UBUNTU-CVE-2026-72412

In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of PAGEUNUSED pte bit The PAGEUNUSED softbit should not really be lying around. Its sole purpose is to signal to trytounmapone and trytomigrateone that the page can be discarded instead of being moved /...

UBUNTU-CVE-2026-74551

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg which maps this buffer directly for DMA. When the DMA mapping flushes or...

EUVD-2026-59663

In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN before deriving the descriptor count: repmaxzones =...

CVE-2026-72341

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-channelstats mlx5echannelstatsalloc publishes a new entry to priv-channelstats and then increments priv-statsnch as a publication token, but neither store carries any memory barrier:...

CVE-2026-72215

In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Ensure 32-bit stack location for o32 promprintf In 64-bit configurations calling any firmware entry points from a kernel thread other than the initial one will result in a situation where the stack has been placed in t...

CVE-2026-72105

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72412 s390/mm: Fix handling of _PAGE_UNUSED pte bit

In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of PAGEUNUSED pte bit The PAGEUNUSED softbit should not really be lying around. Its sole purpose is to signal to trytounmapone and trytomigrateone that the page can be discarded instead of being moved /...

CVE-2026-72341 net/mlx5e: Fix publication race for priv->channel_stats[]

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-channelstats mlx5echannelstatsalloc publishes a new entry to priv-channelstats and then increments priv-statsnch as a publication token, but neither store carries any memory barrier:...

CVE-2026-72105 dm-log: fix a bitset_size overflow on 32bit machines

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72105

The CVE-2026-72105 entry concerns the Linux kernel dm-log component, where a bitset_size overflow on 32‑bit architectures could occur during region_count handling. The root cause is a miscalculation of bitset_size (size_t) when computing the bitmap memory based on region_count, which could wrap t...

CVE-2026-72047

Summary: CVE-2026-72047 affects the Linux kernel, specifically the ieee802154 ca8210 driver. A 64‑bit build flaw occurs when ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc’d buffer pointer through a struct kfifo and pass a literal 4 as the byte count to kfifo_in...

CVE-2026-72047 ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210testintdriverwrite and ca8210testintuserread exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to...

EUVD-2026-58983

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwrit...

CVE-2026-72011 s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()

In the Linux kernel, the following vulnerability has been resolved: s390/diag: Add missing arrayindexnospec call to memtopgetpagecount 'level' is user space controlled and used to read from an array. Add the missing arrayindexnospec call to prevent speculative execution...

CVE-2026-68479 Bluetooth: btrtl: validate firmware patch bounds

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

EUVD-2026-59101

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...