CVE-2026-63915 nfc: hci: fix out-of-bounds read in HCP header parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...

EUVD-2026-45688

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...

EUVD-2026-45686

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an...

CVE-2026-63912 xfrm: esp: restore combined single-frag length gate

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-63910

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

CVE-2026-63910 dma-buf: fix UAF in dma_buf_fd() tracepoint

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

EUVD-2026-45681

In the Linux kernel, the following vulnerability has been resolved: Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known mxtobjsizeobject, the driver intends to discard the extra bytes. The loop iterate...

CVE-2026-63908

The CVE-2026-63908 entry concerns the Linux kernel driver for atmel_mxt_ts. A configuration file could supply an object size larger than the driver’s known mxt_obj_size(object); the code intended to discard extra bytes but used a faulty loop bound, checking for i > mxt_obj_size(object). Since ...

EUVD-2026-45678

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The original thread stalled on Shuah Khan's request for runtime testing of...

CVE-2026-63903

The CVE-2026-63903 entry concerns the Linux kernel USB-serial Belkin sa driver. The vulnerability arises from belkin_sa_read_int_callback() treating the interrupt data as a four-byte status report and reading LSR/MSR fields from offsets 2 and 3, with the interrupt-in buffer length derived from en...

CVE-2026-63903 USB: serial: belkin_sa: validate interrupt status length

In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkinsa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from...

CVE-2026-63897

The CVE-2026-63897 entry concerns the Linux kernel USB serial driver mct_u232. A missing sanity check on the size of interrupt-in transfers could allow parsing of stale or uninitialised slab data, potentially leaking kernel data to user space. The vulnerability is addressed by kernel fixes that a...

CVE-2026-63894

Summary (CVE-2026-63894): A race in Linux kernel’s FunctionFS DMABUF handling allows a freed usb_request to be dequeued via an obsolete priv->req pointer when cancelling a DMABUF attachment. The root cause is that ffs_epfile_dmabuf_io_complete() frees the request but leaves priv->req pointi...

CVE-2026-63892 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...

CVE-2026-63889

The CVE-2026-63889 entry concerns the Linux kernel, specifically the SCSI FC transport (scsi_transport_fc) and a bug in the FPIN pname walker. The issue triggers when an adjacent Fibre Channel fabric actor can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator, potentially causing a ...

CVE-2026-63887

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput concatenates "key=value\0" records into login-rspbuf, an 8192-byte kzallocMAXKEYVALUEPAIRS buffer allocated in iscsitallocloginsetupbuffer...

EUVD-2026-45771

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAPR length before base64 decode chapservercomputehash allocates clientdigest as kzallocchap-digestsize and then, for BASE64-encoded responses, passes chapr directly to chapbase64decode without...

CVE-2026-63885

The CVE concerns a race in the Linux kernel DRM GEM path: drm_gem_change_handle_ioctl can leave the old handle live in the IDR during the window after spin_unlock(table_lock) and before the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle may decrement handle_coun...

CVE-2026-63884

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

EUVD-2026-45769

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...