CVE-2026-63909 ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smbcheckpermdacl ACE-walk loops Commit d07b26f39246 "ksmbd: require minimum ACE size in smbcheckpermdacl" introduced a transposed bounds check: if offsetofstruct smbace, sid + acessize size offset 2...

CVE-2026-63909 ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smbcheckpermdacl ACE-walk loops Commit d07b26f39246 "ksmbd: require minimum ACE size in smbcheckpermdacl" introduced a transposed bounds check: if offsetofstruct smbace, sid + acessize size offset 2...

EUVD-2026-45681

In the Linux kernel, the following vulnerability has been resolved: Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known mxtobjsizeobject, the driver intends to discard the extra bytes. The loop iterate...

CVE-2026-63908 Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

In the Linux kernel, the following vulnerability has been resolved: Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known mxtobjsizeobject, the driver intends to discard the extra bytes. The loop iterate...

CVE-2026-63908

In the Linux kernel, the following vulnerability has been resolved: Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known mxtobjsizeobject, the driver intends to discard the extra bytes. The loop iterate...

CVE-2026-63908

The CVE-2026-63908 entry concerns the Linux kernel driver for atmel_mxt_ts. A configuration file could supply an object size larger than the driver’s known mxt_obj_size(object); the code intended to discard extra bytes but used a faulty loop bound, checking for i > mxt_obj_size(object). Since ...

CVE-2026-63908 Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

In the Linux kernel, the following vulnerability has been resolved: Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known mxtobjsizeobject, the driver intends to discard the extra bytes. The loop iterate...

EUVD-2026-45677

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the...

CVE-2026-63904 usb: usbtmc: check URB actual_length for interrupt-IN notifications

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the...

EUVD-2026-45673

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...

CVE-2026-63900

CVE-2026-63900 concerns the Linux kernel USB serial driver for Keyspan devices (usa49wg). The vulnerability was a missing sanity check on the size of indat transfers, which could allow parsing of stale or uninitialised slab data. The issue has been addressed by adding the missing sanity check to ...

CVE-2026-63900

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...

CVE-2026-63900 USB: serial: keyspan: fix missing indat transfer sanity check

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...

CVE-2026-63900 USB: serial: keyspan: fix missing indat transfer sanity check

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...

CVE-2026-63897

The CVE-2026-63897 entry concerns the Linux kernel USB serial driver mct_u232. A missing sanity check on the size of interrupt-in transfers could allow parsing of stale or uninitialised slab data, potentially leaking kernel data to user space. The vulnerability is addressed by kernel fixes that a...

CVE-2026-63897 USB: serial: mct_u232: fix missing interrupt-in transfer sanity check

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data and leaking it to user space...

EUVD-2026-45670

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data and leaking it to user space...

CVE-2026-63897

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data and leaking it to user space...

CVE-2026-63893

The connected documents describe a Linux kernel vulnerability in thunderbolt property parsing: a wrap of the 32-bit sum (entry->value + entry->length) allows an attacker-controlled offset to read memory beyond the property block. The root cause is not validating the sum with overflow checks...

EUVD-2026-45666

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...