CVE-2026-64270 Input: mms114 - reject an oversized device packet size

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114interrupt reads a packet of touch data from the device into a fixed-size on-stack buffer struct mms114touch touchMMS114MAXTOUCH; which holds MMS114MAXTOUCH 10 events of...

CVE-2026-64270 Input: mms114 - reject an oversized device packet size

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114interrupt reads a packet of touch data from the device into a fixed-size on-stack buffer struct mms114touch touchMMS114MAXTOUCH; which holds MMS114MAXTOUCH 10 events of...

CVE-2026-64269

The CVE-2026-64269 issue affects the Linux kernel’s RDMA path (RDMA/rtrs-srv) where rdma_write_sg() uses desc[0].len from the wire descriptor to determine the RDMA_WRITE length. The length could exceed the bound of the mapped chunk because it wasn’t checked against max_chunk_size, enabling a peer...

EUVD-2026-48980

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp places each inbound Read Response DDP segment at sge-laddr + wqe-processed and then accumulates wqe-processed, but i...

CVE-2026-64268

CVE-2026-64268 concerns a Linux kernel vulnerability in the SIW (RDMA) path where Read Response segments could overrun the sink buffer. The issue resides in siw_qp_rx.c (siw_proc_rresp) which places inbound Read Response DDP segments at sge->laddr + wqe->processed and accumulates processed ...

CVE-2026-64266 fuse: re-lock request before returning from fuse_ref_folio()

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fusereffolio fusereffolio unlocks the request but does not re-lock it before returning. fusechanabort can end the request and the async end callback eg fusewritepagefree can free the ar...

EUVD-2026-48978

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fusereffolio fusereffolio unlocks the request but does not re-lock it before returning. fusechanabort can end the request and the async end callback eg fusewritepagefree can free the ar...

CVE-2026-64267

Summary: CVE-2026-64267 affects the Linux kernel's FUSE prune notification handling. On 32-bit systems, FUSE_NOTIFY_PRUNE could misvalidate the payload length, allowing a daemon-controlled count to wrap and trigger a copy loop that may read nodeids not present in the userspace buffer (e.g., in QE...

CVE-2026-64266 fuse: re-lock request before returning from fuse_ref_folio()

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fusereffolio fusereffolio unlocks the request but does not re-lock it before returning. fusechanabort can end the request and the async end callback eg fusewritepagefree can free the ar...

CVE-2026-64266

CVE-2026-64266 affects the Linux kernel fuse subsystem. The vulnerability stems from fuse_ref_folio() unlocking the request but not re-locking before return, allowing fuse_chan_abort() to end the request and for the async end callback to free args while the copy chain later accesses them, causing...

EUVD-2026-48979

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

CVE-2026-64267 fuse: avoid 32-bit prune notification count wrap

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

EUVD-2026-48977

In the Linux kernel, the following vulnerability has been resolved: fuse: clear intrentry in fuseresend and fuseremovependingreq When fuseresend moves a request from fpq-processing back to fiq-pending, it sets FRPENDING and clears FRSENT but does not remove the requests intrentry from...

CVE-2026-64263

CVE-2026-64263 affects the Linux kernel fuse-uring subsystem. The issue arises when fuse_uring_cancel() moves entries that are still available (with no reqs) to the ent_in_userspace list and ent_list_request_expired() dereferences ent->fuse_req unconditionally, which can crash a cancelled entr...

CVE-2026-64264

In CVE-2026-64264, the Linux kernel fuse-uring path is affected: copy_from_user can leave a positive residual in err, then -EFAULT is overwritten by fuse_uring_req_end, causing an incorrect success path and potentially uninitialised req->out.args. The fix assigns err = -EFAULT in the failure b...

CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

EUVD-2026-48976

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

CVE-2026-64262

The CVE-2026-64262 entry concerns a Linux kernel issue in fuse-uring where, during io_uring task work with tw.cancel set, the cancel handling could leave a fuse_req reference in the userspace queue and fail to end the request, potentially delaying cleanup: the code path could set -ECANCELED, mark...

CVE-2026-64260 fuse-uring: Avoid queue->stopped races and set/read that value under lock

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue-stopped races and set/read that value under lock There are several readers of queue-stopped that check the value under lock, but fuseuringcommitfetch did not and actually the value was not set under the lo...