328614 matches found
EUVD-2026-59093
In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...
CVE-2026-68471 wifi: ieee80211: validate MLE common info length
In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...
CVE-2026-68470
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...
EUVD-2026-59092
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...
CVE-2026-68466
The CVE concerns the Linux kernel driver path mtd: rawnand: lpc32xx_slc. lpc32xx_xmit_dma() waits for a DMA completion callback but uses wait_for_completion_timeout() and can time out, causing a DMA transfer to be unmapped and reported as successful to the NAND read/write path. The fix is to retu...
CVE-2026-68466 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. A timed out DMA transfer is therefore unmapped and reported as successfu...
EUVD-2026-59088
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. A timed out DMA transfer is therefore unmapped and reported as successfu...
CVE-2026-68462 bpf: Reject negative const offsets for buffer pointers
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...
EUVD-2026-59084
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...
CVE-2026-68462
Summary of CVE-2026-68462 (Linux kernel, BPF): The issue arises in the verifier’s handling of buffer-pointer access (PTR_TO_TP_BUFFER and PTR_TO_BUF) where a constant negative offset could slip through after a pointer offset split (reg->var_off vs reg->off). Specifically, an access with reg...
CVE-2026-68462 bpf: Reject negative const offsets for buffer pointers
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...
CVE-2026-68458 binder: cache secctx size before release zeroes it
In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The...
CVE-2026-68458
CVE-2026-68458 concerns the Linux kernel Binder subsystem. A vulnerability arises in binder_transaction() where the end of the scatter-gather buffer area is computed using a value derived from lsmctx.len after security_release_secctx() zeroes that field. This causes sg_buf_end_offset to be inflat...
EUVD-2026-59080
In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The...
MINI-Q654-XJG5-2QGW
Bulletin has no description...
MINI-725M-GMXF-V5H7
Bulletin has no description...
MINI-8R57-X627-MGC2
Bulletin has no description...
MINI-WHW7-2JM4-X2FX
Bulletin has no description...
