153808 matches found
EUVD-2026-76348
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...
CVE-2026-89442 platform/x86: ISST: Validate socket ID in clos_assoc ioctl
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...
CVE-2026-89442
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...
EUVD-2026-76344
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...
CVE-2026-89436 platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]
In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpipccretrievebiosdata rejects SINF packages only when pcc-numsifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...
EUVD-2026-76342
In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpipccretrievebiosdata rejects SINF packages only when pcc-numsifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...
CVE-2026-89436 platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]
In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpipccretrievebiosdata rejects SINF packages only when pcc-numsifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...
CVE-2026-89436
CVE-2026-89436 is an out-of-bounds write in the Linux kernel's panasonic-laptop driver (platform/x86). In acpi_pcc_retrieve_biosdata(), a trailing sentinel is written at pcc->sinf[hkey->package.count], but when a DSDT's SINF package count equals SQTY+1 (a known off-by-one hardware quirk han...
CVE-2026-81017 platform/chrome: sensorhub: Bound the EC-reported sensor number
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...
CVE-2026-81017 platform/chrome: sensorhub: Bound the EC-reported sensor number
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...
CVE-2026-81017
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...
CVE-2026-81017
CVE-2026-81017 affects the Linux kernel's platform/chrome/sensorhub driver. The root cause is a missing validation of the 8-bit EC-reported sensor number in cros_ec_sensorhub_ring_handler(); the unvalidated value is then used to index sensorhub->batch_state[], an array allocated with only sens...
EUVD-2026-76340
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...
EUVD-2026-76337
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in skstore and kekstore skstore and kekstore strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == '\n' length--;...
CVE-2026-81014
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in skstore and kekstore skstore and kekstore strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == '\n' length--;...
EUVD-2026-76336
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...
CVE-2026-81013
CVE-2026-81013 is a heap out-of-bounds read in the Linux kernel's hp-bioscfg platform driver. The root cause is in validate_password_input(), which computes length = strlen(buf) and then checks buf[length - 1] to strip a trailing newline without first verifying that length is nonzero. Writing a b...
EUVD-2026-76334
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...
CVE-2026-81011
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...
CVE-2026-81011 platform/x86: hp-bioscfg: pass validated element count to package parsers
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...