EUVD-2026-48785

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie and rtwgetwapiie iterate over a raw IE buffer without verifying that t...

CVE-2026-64441

The CVE-2026-64441 fix applies to the Linux kernel staging rtl8723bs code and addresses out-of-bounds reads in three IE/attribute parsers: rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr(). The patch adds cnt+2 bounds checks before loop bodies in rtw_get_sec_ie() and rtw_get_wapi_ie(), ...

CVE-2026-64441

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie and rtwgetwapiie iterate over a raw IE buffer without verifying that t...

CVE-2026-64441 staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie and rtwgetwapiie iterate over a raw IE buffer without verifying that t...

CVE-2026-64440 staging: rtl8723bs: fix OOB write in HT_caps_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof struct HTcapselement. Because pIE-length is a raw u8 from an...

EUVD-2026-48784

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof struct HTcapselement. Because pIE-length is a raw u8 from an...

CVE-2026-64440

CVE-2026-64440 (Linux kernel) : The vulnerability affects the rtl8723bs HT_capabilities handling in staging. HT_caps_handler() reads pIE->length bytes and writes into a fixed 26-byte HT_cap[]; since pIE->length is from an unvalidated 802.11 AssocResponse, an AP can set it to 255, causing up...

CVE-2026-64440

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof struct HTcapselement. Because pIE-length is a raw u8 from an...

CVE-2026-64432 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in logreplay copylcns In the analysis pass of $LogFile journal replay, logreplay copies LCNs from each action log record into an existing Dirty Page Table DPT entry without bounding th...

EUVD-2026-48776

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in logreplay copylcns In the analysis pass of $LogFile journal replay, logreplay copies LCNs from each action log record into an existing Dirty Page Table DPT entry without bounding th...

CVE-2026-64432

Summary: CVE-2026-64432 affects the Linux kernel, specifically the ntfs3 filesystem code path used during NTFS image replay. The issue stems from validating the Dirty Page Table (DPT) capacity in log_replay() when copying LCNs; if dp->lcns_follow (capacity) is smaller than lrh->lcns_follow,...

CVE-2026-64431 ntfs: avoid calling post_write_mst_fixup() for invalid index_block

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...

EUVD-2026-48966

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid net.ipv4.tcpreordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp-reordering field for new...

EUVD-2026-48955

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before findtablelock updatecounters and compatupdatecounters forward a user-supplied 32-byte table name to findtablelock without NUL-terminating it. On a lookup miss, findinlistlock calls...

CVE-2026-64407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

CVE-2026-64407 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

EUVD-2026-48951

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

CVE-2026-64407

CVE-2026-64407 concerns the Linux kernel Bluetooth driver btnxpuart. The vulnerability arises during the v3 firmware download: a controller can request firmware with a 32‑bit offset and 16‑bit length, and nxp_recv_fw_req_v3() only validates the lower bound. It computes an offset and uses it to re...

EUVD-2026-48946

In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smbsyncperfbuffer When the SMB sink is used as a perf AUX sink, smbupdatebuffer calls smbsyncperfbuffer to copy hardware trace data into the perf AUX ring buffer pages. It derives pgidx =...

CVE-2026-64402

CVE-2026-64402 concerns the Linux kernel coresight ultrasoc-smb path: an OOB write in smb_sync_perf_buffer() can occur when the SMB sink is used as a perf AUX sink because the initial page index is derived before applying modulo normalization to the buffer size. The issue is fixed by normalizing ...