CVE-2026-63969 ipv6: fix possible infinite loop in rt6_fill_node()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...

CVE-2026-63958

The CVE affects the Linux kernel USB Type-C UCSI implementation. In ucsi_connector_change(), the 7-bit connector number from a UCSI CCI notification is used to index ucsi->connector[] without validating it against the number of connectors reported at init time. A buggy/malicious PPM (EC firmwa...

CVE-2026-63951

The CVE-2026-63951 issue concerns the Linux kernel zram subsystem, specifically a use-after-free in zram_writeback_endio. The root cause is a race between the bio completion handler and the writeback task: wake_up is invoked after releasing wb_ctl->done_lock, creating a window where the writeb...

CVE-2026-63952 memfd: deny writeable mappings when implying SEAL_WRITE

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...

CVE-2026-63949 auxdisplay: line-display: fix OOB read on zero-length message_store()

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length messagestore linedispdisplay unconditionally reads msgcount - 1 before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg-1:...

CVE-2026-63948 Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

CVE-2026-63948

The CVE affects the Linux kernel Bluetooth L2CAP stack, where l2cap_chan_timeout() leaks a l2cap_chan reference when chan->conn is NULL because the early return skips l2cap_chan_put() after __set_chan_timer() holds the reference via l2cap_chan_hold(). The fix adds the missing l2cap_chan_put() ...

CVE-2026-63948 Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

CVE-2026-63944

The set of CVE records (CVE-2026-63944) describes a Linux kernel issue in Bluetooth hci_sync: hci_le_create_cis_sync that can cause a use-after-free by dereferencing conn->conn_timeout after releasing rcu_read_lock() and hci_dev_lock(hdev). The conn pointer originates from an RCU-protected ite...

CVE-2026-63934

The CVE-2026-63934 entry describes a Linux kernel vulnerability in iio: gyro: itg3200 where i2c_read writes into the wrong stack location. Specifically, itg3200_read_all_channels() takes __be16 *buf and uses (char *)&buf for i2c_transfer(), which points to a local stack slot rather than the calle...

CVE-2026-63929 iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iiobufferenqueuedmabuf iiobufferenqueuedmabuf allocates a struct iiodmafence 104 bytes, kmalloc-128 via kmallocobj+dmafenceinit, which sets the initial kref to 1. It then calls dmaresvaddfence...

CVE-2026-63924 ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6hopjumbo ipv6hopjumbo calls pskbtrimrcsum, which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up...

CVE-2026-63922

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6parsetlv caches skbnetworkheaderskb in nh while walking IPv6 TLVs. ipv6desthao may call pskbexpandhead for a cloned skb, which can move the skb head and invalidate the cached...

CVE-2026-63915 nfc: hci: fix out-of-bounds read in HCP header parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...

CVE-2026-63912 xfrm: esp: restore combined single-frag length gate

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-63910 dma-buf: fix UAF in dma_buf_fd() tracepoint

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

CVE-2026-63908

The CVE-2026-63908 entry concerns the Linux kernel driver for atmel_mxt_ts. A configuration file could supply an object size larger than the driver’s known mxt_obj_size(object); the code intended to discard extra bytes but used a faulty loop bound, checking for i > mxt_obj_size(object). Since ...

CVE-2026-63903

The CVE-2026-63903 entry concerns the Linux kernel USB-serial Belkin sa driver. The vulnerability arises from belkin_sa_read_int_callback() treating the interrupt data as a four-byte status report and reading LSR/MSR fields from offsets 2 and 3, with the interrupt-in buffer length derived from en...

CVE-2026-63903 USB: serial: belkin_sa: validate interrupt status length

In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkinsa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from...

CVE-2026-63892 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...