339755 matches found
CVE-2026-98744
In the Linux kernel , a vulnerability exists within the ASoC: codecs: max98363 driver. The stream_config structure is not properly initialized before being passed to the sdw_stream_add_slave() function. This allows the type field to contain garbage data, which is subsequently copied to stream->...
CVE-2026-98744 ASoC: codecs: max98363: fix uninitialized stream_config->type
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...
EUVD-2026-103829
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...
CVE-2026-98743
The Linux kernel contains a vulnerability in the ASoC: codecs: rt1017-sdca-sdw component where the stream_config structure is not initialized before being passed to sdw_stream_add_slave(). This allows the type field to contain garbage data , which is subsequently copied to stream->type by sdw_...
CVE-2026-98743 ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...
EUVD-2026-103828
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...
CVE-2026-98742 ALSA: seq: Serialize compat port-info ioctls
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client-ioctlmutex, but the translated port-info compat path invokes the same handlers through sndseqkernelclientctl withou...
CVE-2026-98742
A vulnerability exists in the Linux kernel ALSA sequencer component due to a lack of proper synchronization in the port-info compat path . While the native sequencer ioctl path serializes handler calls using client->ioctl_mutex, the translated port-info path invokes handlers via snd_seq_kernel...
EUVD-2026-103827
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client-ioctlmutex, but the translated port-info compat path invokes the same handlers through sndseqkernelclientctl withou...
CVE-2026-98741 ALSA: ua101: reject mismatched capture/playback packet sizes
In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detectusbformat cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize...
CVE-2026-98741
The Linux kernel ALSA driver for ua101 is vulnerable to a slab-out-of-bounds write in start_usb_playback() located in sound/usb/misc/ua101.c. The root cause is that detect_usb_format() fails to validate the relationship between wMaxPacketSize and bNrChannels across capture and playback interfaces...
EUVD-2026-103826
In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detectusbformat cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize...
CVE-2026-98740
The Linux kernel contains a vulnerability where several a10 EDAC .setup callbacks (including sdmmc, ethernet, nand, dma, usb, and qspi) and their helpers were incorrectly marked with init . This allows for potential dereferencing of freed memory if a probe is deferred via -EPROBE_DEFER or trigge...
CVE-2026-98740 EDAC/altera: Drop __init from ECC setup paths for re-probe safety
In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed init memory? If altrsysmgrregmaplookupbyphandle returns -EPROBEDEFER, the pro...
EUVD-2026-103825
In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed init memory? If altrsysmgrregmaplookupbyphandle returns -EPROBEDEFER, the pro...
CVE-2026-98739 Bluetooth: RFCOMM: Fix initial port reference race
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...
CVE-2026-98739
A race condition exists in the Linux kernel Bluetooth RFCOMM stack, specifically affecting RFCOMM_RELEASE_ONHUP devices. The vulnerability occurs because rfcomm_tty_install() and __rfcomm_release_dev() independently check and set the RFCOMM_TTY_OWNED bit. This allows both paths to potentially dro...
EUVD-2026-103824
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...
CVE-2026-98738
The Linux kernel contains a vulnerability in the Bluetooth stack where build_pairing_cmd() accesses remote OOB (Out-of-Band) data without holding the hdev->lock. This lack of synchronization allows a concurrent management command to unlink and free the data before the SMP (Security Manager Pro...
CVE-2026-98738 Bluetooth: Serialize SMP remote OOB data access
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access buildpairingcmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...