CVE-2026-64407 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

CVE-2026-64407

CVE-2026-64407 concerns the Linux kernel Bluetooth driver btnxpuart. The vulnerability arises during the v3 firmware download: a controller can request firmware with a 32‑bit offset and 16‑bit length, and nxp_recv_fw_req_v3() only validates the lower bound. It computes an offset and uses it to re...

CVE-2026-64407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

EUVD-2026-48951

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

CVE-2026-64407 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

CVE-2026-64376

CVE-2026-64376 affects the Linux kernel firmware_loader: in firmware_upload_register(), after fw_create_instance() succeeds, a failure path frees fw_sysfs without balancing the embedded device reference, risking a refcount leak of the embedded struct device. The recommended fix is to use put_devi...

CVE-2026-64376 firmware_loader: fix device reference leak in firmware_upload_register()

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...

CVE-2026-64376 firmware_loader: fix device reference leak in firmware_upload_register()

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...

EUVD-2026-48920

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...

CVE-2026-64376

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...

CVE-2026-64310 crypto: ccp - Do not initialize SNP for SEV ioctls

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64309 crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCOMMIT Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

EUVD-2026-49022

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64310

The CVE-2026-64310 issue affects the Linux kernel crypto: ccp path for SEV ioctls. A patch ensures SNP is not initialized for SEV-related ioctls (e.g., SEV_PEK_GEN, SEV_PDH_GEN, SEV_PEK_CSR, SEV_PEK_CERT_IMPORT, SEV_PDH_CERT_EXPORT) by invoking __sev_platform_init_locked() that initializes only S...

CVE-2026-64310 crypto: ccp - Do not initialize SNP for SEV ioctls

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64285 KVM: SEV: Pin source page for write when adding CPUID data for SNP guest

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guestmemfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the...

CVE-2026-64285

CVE-2026-64285 affects the Linux kernel KVM SEV SNP path. When populating a guest’s initial CPUID data, KVM may pin a source page as writable and write back data if the userspace-provided CPUID data is rejected by trusted firmware, risking clobbering read-only memory due to kernel mappings. Multi...

CVE-2026-64285 KVM: SEV: Pin source page for write when adding CPUID data for SNP guest

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guestmemfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the...

EUVD-2026-48997

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guestmemfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the...

CVE-2026-64275

CVE-2026-64275 affects the Linux kernel elan_i2c driver. The fault is division by zero when x_traces/y_traces are zero and an unsigned underflow in width calculation; patch adds non-zero checks and clamps width to >=0, with safe defaults (1) to ensure probe/sysfs nodes work and recovery firmwa...