CVE-2026-64553 net: psample: fix info leak in PSAMPLE_ATTR_DATA

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr i...

EUVD-2026-49605

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in brip6fragment brip6fragment gets prevhdr, a pointer into the skb head, from ip6find1stfragopt, then calls skbchecksumhelp. For a cloned skb skbchecksumhelp reallocates the head via...

EUVD-2026-49604

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr i...

CVE-2026-64553

The CVE-2026-64553 entry concerns the Linux kernel net/psample, specifically PSAMPLE_ATTR_DATA. The vulnerability was an information leak caused by open coding in nla_put() that failed to clear padding for netlink attributes, with data_len not necessarily multiple of 4B. The issue affects the psa...

CVE-2026-64551 sctp: validate STALE_COOKIE cause length before reading staleness

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...

CVE-2026-64552

Summary (CVE-2026-64552) In the Linux kernel virtio-net, receive_big() does a length check against (big_packets_num_skbfrags + 1) * PAGE_SIZE, but a gap remains due to add_recvbuf_big() placing sg[1] after the padded vnet header. A malicious virtio backend can announce a length in that gap, causi...

CVE-2026-64551

CVE-2026-64551 concerns the Linux kernel SCTP stack. A vulnerability in the handling of an ERROR chunk with a STALE_COOKIE cause in the COOKIE_ECHOED state can cause an out-of-bounds read: the code reads the 4-byte Measure of Staleness from after the cause header, but the staleness field may not ...

EUVD-2026-49601

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnetmapingresshandler passes the skb straight to rmnetmapingresshandler, skipping the length validation that...

CVE-2026-64550

The CVE-2026-64550 entry concerns the Linux kernel Qualcomm rmnet component. The vulnerability arises when ingress deaggregation is disabled: rmnet_map_ingress_handler() forwards frames without length validation, causing the MAP header and checksum/trailer to be dereferenced based on on-wire pkt_...

CVE-2026-64550 net: qualcomm: rmnet: validate MAP frame length before ingress parsing

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnetmapingresshandler passes the skb straight to rmnetmapingresshandler, skipping the length validation that...

CVE-2026-64550 net: qualcomm: rmnet: validate MAP frame length before ingress parsing

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnetmapingresshandler passes the skb straight to rmnetmapingresshandler, skipping the length validation that...

EUVD-2026-49600

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10xsetup bpa10xsetup sends the vendor command 0xfc0e and passes the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-data + 1, without checking the...

CVE-2026-64548

The CVE-2026-64548 vulnerability affects the Linux kernel’s BPF/sockmap path. A truncation can occur in bpf_msg_push_data when the scatterlist ring is full or nearly full: len (from BPF ARG_ANYTHING) and copy size are both u32, and the code path uses copy + len to compute a page allocation. An at...

CVE-2026-64549 Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10xsetup bpa10xsetup sends the vendor command 0xfc0e and passes the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-data + 1, without checking the...

CVE-2026-64548 bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

EUVD-2026-49599

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

CVE-2026-64549

CVE-2026-64549 involves the Linux kernel Bluetooth BPA10x path (bpa10x_setup). The code reads a response from vendor command 0xfc0e as a string using a plain "%s" starting at skb->data + 1, which can read past the end if the device returns a short or unterminated payload. This leads to OOB rea...

CVE-2026-64547

CVE-2026-64547 affects the Linux kernel net1080 USB network driver. The issue arises when an even packet_len is processed by net1080_rx_fixup: it reads the pad byte at skb->data[packet_len] before verifying skb->len, with packet_len only bounded by NC_MAX_PACKET, enabling a malicious NetChi...

CVE-2026-64546

CVE-2026-64546 is a Linux kernel vulnerability in drm/edid that allows a heap out-of-bounds read in drm_parse_tiled_block() when parsing a crafted EDID tiled block. The root cause is casting a DisplayID block to a struct displayid_tiled_block and reading the fixed layout up to tile->topology_i...

CVE-2026-64547 net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packetlen before pad-byte access in rxfixup For an even packetlen, net1080rxfixup reads the pad byte at skb-datapacketlen before the skb-len != packetlen check further down, and packetlen is only bound...