CVE-2026-89471 power: supply: cros_usbpd-charger: bound the EC-reported port count

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

EUVD-2026-76376

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd: Limit port counts to ECUSBPDMAXPORTS Currently the crosusbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB...

CVE-2026-89470 power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd: Limit port counts to ECUSBPDMAXPORTS Currently the crosusbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB...

CVE-2026-89471

CVE-2026-89471 affects the Linux kernel cros_usbpd-charger driver (power supply subsystem). The driver uses an EC-reported num_charger_ports value as a loop bound for an 8-entry fixed-size array (ports[EC_USB_PD_MAX_PORTS]) without validating it against the array size. A malicious or malfunctioni...

EUVD-2026-76377

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-89471 power: supply: cros_usbpd-charger: bound the EC-reported port count

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-89471

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-89453

CVE-2026-89453 is a PCI device reference count leak in the Linux kernel's iommu/amd subsystem. The function iommu_call_iopf_notifier() calls pci_get_domain_bus_and_slot() which increments the device's reference count, but neither the successful iommu_report_device_fault() path nor the abort path ...

CVE-2026-89453 iommu/amd: Put PCI device after handling PPR faults

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

CVE-2026-81011

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

EUVD-2026-76334

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

CVE-2026-81011 platform/x86: hp-bioscfg: pass validated element count to package parsers

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

CVE-2026-81011

CVE-2026-81011 affects the Linux kernel's hp-bioscfg platform driver (platform/x86). The per-type package parsers derive the element count from elements[0] (the ACPI NAME field, always a string) rather than the validated obj->package.count, causing them to bound against the name string length ...

CVE-2026-81011 platform/x86: hp-bioscfg: pass validated element count to package parsers

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

PT-2026-90411

In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4 decode posixacl reads a u32 entry count off the wire and passes it straight to posix acl alloc and sort pacl range. The latter is an On^2 bubble sort, so a client-chosen...

PT-2026-90309

In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, unmap hugepage range can adjust reservations. In the case of folio mapped in both a parent and a child, if the parent unmaps the range first,...

PT-2026-90423

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow down error nfsd cross mnt initializes a local struct path with mntget and dget before calling follow down. On a negative return the error arm jumps to out without releasing those references: err ...

CVE-2026-89471: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-89453: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

PT-2026-90141

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hp init bios package attribute validates obj-package.count and then calls one of the five ...