95761 matches found
EUVD-2026-45852
In the Linux kernel, the following vulnerability has been resolved: kho: skip KHO for crash kernel khofillkimage unconditionally populates the kimage with KHO metadata for every kexec image type. When the image is a crash kernel, this can be problematic as the crash kernel can run in a small...
CVE-2026-64166
In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Check for NULL FF-A ID table while driver registration The bus match callback assumes that every FF-A driver provides an idtable and dereferences it unconditionally. Enforce that contract at registration time so...
CVE-2026-64166
The CVE-2026-64166 issue affects the Linux kernel firmware for arm_ffa. The vulnerability stems from a bus match callback that assumed every FF-A driver provides an id_table and dereferenced it without a null check. The fix enforces the contract at driver registration time to ensure a buggy clien...
CVE-2026-64165
In the Linux kernel, the following vulnerability has been resolved: ARM: integrator: Fix early initialization Starting with commit bdb249fce9ad4 "ARM: integrator: read counter using syscon/regmap", intcpinitearly calls sysconregmaplookupbycompatible which in turn calls ofsysconregister. This...
CVE-2026-64165
The CVE-2026-64165 entry describes a Linux kernel ARM integrator issue where intcp_init_early calls syscon_regmap_lookup_by_compatible before memory management is initialized, causing -ENOMEM or a NULL dereference (crash) when accessing a regmap during early init. The root cause is dereferencing ...
CVE-2026-64148 pds_core: fix error handling in pdsc_devcmd_wait
In the Linux kernel, the following vulnerability has been resolved: pdscore: fix error handling in pdscdevcmdwait Fix two cases where pdscdevcmdwait returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with...
CVE-2026-64148
In the Linux kernel, the following vulnerability has been resolved: pdscore: fix error handling in pdscdevcmdwait Fix two cases where pdscdevcmdwait returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with...
EUVD-2026-45833
In the Linux kernel, the following vulnerability has been resolved: pdscore: fix error handling in pdscdevcmdwait Fix two cases where pdscdevcmdwait returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with...
CVE-2026-64128
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv guards against a missing ISOSTART by checking...
CVE-2026-64128
The CVE-2026-64128 flaw affects the Linux kernel Bluetooth ISO data path. ISO_END frames can crash the host if received first on a fresh ISO connection because iso_recv() does not mirror the ISO_CONT guard, dereferencing a NULL conn->rx_skb. BIS scenarios may be leveraged by a broadcaster to t...
CVE-2026-64128 Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv guards against a missing ISOSTART by checking...
CVE-2026-64049 drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...
CVE-2026-64049
In the Linux kernel, the drm/msm/adreno driver fixes a userspace-triggered crash on a2xx–a4xx by adding a guard in adreno_get_param() to check for UBWC configuration and return sane defaults when UBWC params are queried but not supported. Before this, older generations wouldn’t fetch UBWC params,...
EUVD-2026-45622
In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...
EUVD-2026-45621
In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ismdev slot On the SMC-D client, slot 0 of ini-ismdev/ini-ismchid is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt populates V2 entries starting at index 1, so when no ...
CVE-2026-64030 wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check linkid in ieee80211mlepcs IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata-link has IEEE80211MLDMAXNUMLINKS 15...
CVE-2026-64013 ACPI: button: Fix ACPI GPE handler leak during removal
In the Linux kernel, the following vulnerability has been resolved: ACPI: button: Fix ACPI GPE handler leak during removal Commit a7e23ec17fee "ACPI: button: Install notifier for system events as well" changed the ACPI notify handler type for ACPI buttons to ACPIALLNOTIFY, but it forgot to update...
EUVD-2026-45563
In the Linux kernel, the following vulnerability has been resolved: bonding: refuse to enslave CAN devices syzbot reported a kernel paging request crash in canrxunregister inside net/can/afcan.c. The crash occurs because a virtual CAN device vxcan is being enslaved to a bonding master. During the...
CVE-2026-63986 ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERRPTR to genlmsgcancel on prepare failure The goto err label leads to: genlmsgcancelskb, ehdr; return ret; If ethnltsinfopreparedump failed, it has not started a genlmsg. There's nothing to cancel, an...
CVE-2026-63975
CVE-2026-63975 affects the Linux kernel Bluetooth L2CAP path, where receiving a dcid for an already-assigned destination CID could cause a crash due to using l2cap_chan_del (which may invalidate a tmp cursor from list_for_each_entry_safe and is the wrong action since chan->dcid might be assign...