CVE-2026-64014

The CVE-2026-64014 issue affects the Linux kernel USB touchscreen path for NEXIO devices (nexio_read_data). It describes a vulnerability where data_len and x_len are read from a 16-bit header and used to walk packet data without proper bounds, potentially enabling a ~64 KiB out-of-bounds read pas...

CVE-2026-64009

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

CVE-2026-64009

The CVE-2026-64009 family affects the Linux kernel xfrm subsystem, specifically an out-of-bounds write in ESP handling due to an underflow in xfrm_state_mtu(). The function computes using unsigned arithmetic: it subtracts attacker-influenced header_len + authsize + net_adj from a small mtu, allow...

CVE-2026-64000 net: hsr: fix potential OOB access in supervision frame handling

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeofstruct hsrsuptlv to the pskbmaypull calls. Without this, a truncated frame could cause an...

CVE-2026-64000 net: hsr: fix potential OOB access in supervision frame handling

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeofstruct hsrsuptlv to the pskbmaypull calls. Without this, a truncated frame could cause an...

EUVD-2026-45573

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeofstruct hsrsuptlv to the pskbmaypull calls. Without this, a truncated frame could cause an...

CVE-2026-63996 ethtool: cmis: require exact CDB reply length

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

EUVD-2026-45569

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

CVE-2026-63996

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

CVE-2026-63996 ethtool: cmis: require exact CDB reply length

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

CVE-2026-63996

CVE-2026-63996 concerns the Linux kernel ethtool cmis path. The issue arises when a malicious SFP module responds with a reply length longer than what cmis_cdb_process_reply() expects, potentially causing out-of-bounds writes. The fix involves strengthening the existing length checks to also guar...

CVE-2026-63995 ethtool: cmis: validate start_cmd_payload_size from module

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63995

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

EUVD-2026-45568

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63995 ethtool: cmis: validate start_cmd_payload_size from module

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63995

CVE-2026-63995 affects the Linux kernel ethtool CMIS firmware update path. The CMIS FW update code reads start_cmd_payload_size from the module FW Management Features CDB reply and uses it directly as the byte count for memcpy, writing into a destination buffer of 112 bytes (ETHTOOL_CMIS_CDB_LPL_...

CVE-2026-63992 tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnelpmtudcheckicmp In some cases, iptunnelpmtudcheckicmp can be called while skb transport header is not set. This triggers an out-of-bound access, because typeofskb-transportheader0...

EUVD-2026-45565

In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnelpmtudcheckicmp In some cases, iptunnelpmtudcheckicmp can be called while skb transport header is not set. This triggers an out-of-bound access, because typeofskb-transportheader0...

CVE-2026-63987 ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NETDIMPARAMSNUMPROFILES ethnlupdateprofile walks the ETHTOOLAPROFILEIRQMODERATION nest list with an index 'i' and writes newprofilei++ without bounding i. The destination is kmemdup'd at...

EUVD-2026-45758

In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM fallbacksetparams validates that offset totallen return -EINVAL; This could lead to surprises in both drivers and...