250310 matches found
CVE-2026-74687
This vulnerability affects the Linux kernel 's at91sam9_wdt watchdog driver. The root cause is a use-after-free : the at91_ping() callback rearms the watchdog timer, but timer_delete() neither waits for a running callback nor prevents rearm, so during probe failure or driver removal the timer can...
CVE-2026-74685 hwmon: (ltc4282) Clamp negative current limits
In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282writecurr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282writecurr / need to pass it in millivolt / u32 in =...
CVE-2026-74685 hwmon: (ltc4282) Clamp negative current limits
In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282writecurr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282writecurr / need to pass it in millivolt / u32 in =...
EUVD-2026-64372
In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282writecurr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282writecurr / need to pass it in millivolt / u32 in =...
CVE-2026-74685
CVE-2026-74685 affects the Linux kernel hardware monitoring driver for the LTC4282 (drivers/hwmon/ltc4282.c). The root cause is an integer sign-extension flaw in ltc4282_write_curr(): a negative long value is cast directly to u64, converting it into a large positive number. The subsequent arithme...
CVE-2026-74685
In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282writecurr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282writecurr / need to pass it in millivolt / u32 in =...
CVE-2026-74684
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...
CVE-2026-74684
This vulnerability is a NULL pointer dereference in the Linux kernel's net: tap module, specifically in tap_get_user_xdp(). When the vhost TX path passes an XDP buffer containing a GSO virtio-net header with the protocol field set to zero, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol...
CVE-2026-74683
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt and client evmasks array i...
EUVD-2026-64371
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...
CVE-2026-74684 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...
CVE-2026-74683 Input: evdev - sanitize event type index when fetching event masks
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt and client evmasks array i...
CVE-2026-74683
CVE-2026-74683 is a speculative execution vulnerability in the Linux kernel's evdev input subsystem . The user-supplied event type index passed to the EVIOCGMASK and EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and the client evmasks array in evdev_get_mask()...
EUVD-2026-64370
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt and client evmasks array i...
CVE-2026-74683 Input: evdev - sanitize event type index when fetching event masks
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt and client evmasks array i...
CVE-2026-74684 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...
EUVD-2026-64369
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...
CVE-2026-74682
CVE-2026-74682 is an out-of-bounds write in the Linux kernel ALSA usb-audio subsystem affecting Type II capture (inbound) URBs . In data_ep_set_params(), the URB transfer buffer size is computed before the Type II transfer delimiter packet is added to the packet count, leaving the buffer one pack...
CVE-2026-74682 ALSA: usb-audio: fix OOB write on Type II inbound URBs
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...
CVE-2026-74682
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...