EUVD-2026-45600

In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking again Recent commit changed the semantics from NOTVALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing ...

CVE-2026-64027 net: shaper: rework the VALID marking (again)

In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking again Recent commit changed the semantics from NOTVALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing ...

CVE-2026-64027 net: shaper: rework the VALID marking (again)

In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking again Recent commit changed the semantics from NOTVALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing ...

EUVD-2026-45583

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64010 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64010 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64011 nfc: llcp: Fix use-after-free in llcp_sock_release()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcpsockrelease llcpsockrelease unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by...

CVE-2026-64011

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcpsockrelease llcpsockrelease unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by...

CVE-2026-64010

CVE-2026-64010 involves a use-after-free in the Linux NFC LLCP stack. The race occurs when nfc_llcp_recv_cc() moves a socket from the connecting_sockets list to the sockets list without holding the socket lock, risking linking a freed socket if llcp_sock_release() runs concurrently. The mitigatio...

EUVD-2026-45714

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which does not trap. KVM handles both in different way: - on ZCREL2 trap,...

CVE-2026-63941

CVE-2026-63941 documents a Linux kernel KVM arm64 issue where ZCR_EL2 updates from a guest hypervisor could bypass proper masking, allowing L2 guests to observe VL values they shouldn’t. The fix moves the VL capping into restore points so the HW is always programmed with a capped value, regardles...

CVE-2026-63941

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which does not trap. KVM handles both in different way: - on ZCREL2 trap,...

EUVD-2026-45689

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that the HIDDGINPUTMODE usage is always located in the first field field0 of the feature report. However, a device can specify...

CVE-2026-63916 HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that the HIDDGINPUTMODE usage is always located in the first field field0 of the feature report. However, a device can specify...

CVE-2026-63916

CVE-2026-63916 affects the Linux kernel HID subsystem for Wacom devices. The vulnerability arises because wacom_hid_set_device_mode() assumed HID_DG_INPUTMODE always resides in the first feature-report field (field[0]). If HID_DG_INPUTMODE is in another field and the first field’s report_count is...

CVE-2026-63916 HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that the HIDDGINPUTMODE usage is always located in the first field field0 of the feature report. However, a device can specify...

CVE-2026-63916

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that the HIDDGINPUTMODE usage is always located in the first field field0 of the feature report. However, a device can specify...

CVE-2026-63915 nfc: hci: fix out-of-bounds read in HCP header parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...

EUVD-2026-45688

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...

CVE-2026-63915

CVE-2026-63915 : In the Linux kernel, the NFC NFC HCI stack (nfc_hci_recv_from_llc and nci_hci_data_received_cb) is vulnerable to an out-of-bounds heap read from packet->header when a 0-byte HCP frame is received, because the code reads skb->data at entry without ensuring a byte is present....