CVE-2026-80829 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput sndusbmidinovationoutput lays out a two-byte header at transferbuffer0..1 and passes &transferbuffer2 together with a length of ep-maxtransfer - 2 to sndrawmiditransmit:...

CVE-2026-84270

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read()

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read()

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read()

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-84270

The affected software is gvfs (GNOME Virtual Filesystem), specifically its MTP backend . The flaw resides in do_read() within gvfsbackendmtp.c , which trusts the data length returned by a connected MTP device without capping it to the size originally requested by the client. When a malicious devi...

CVE-2026-84270

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

PT-2026-84310

Name of the Vulnerable Software and Affected Versions gvfs affected versions not specified Description A flaw exists in the MTP backend of gvfs. When reading a file from a mounted MTP device, the do read function in gvfsbackendmtp.c trusts the data length returned by the device without limiting i...

Linux Distros Unpatched Vulnerability : CVE-2026-84270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the...

SUSE CVE-2026-80594

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in imspcugetcdcuniondesc by iterating through the extra descriptor data. However, it does not verify that the...

CVE-2026-72158

A flaw was found in the Linux kernel's FPGA Dynamic Function Link DFL subsystem. A malicious FPGA device can provide specially crafted parameter headers, causing the system to miscalculate the size of a feature region. This incorrect size can lead to a memory corruption vulnerability when data is...

Linux Distros Unpatched Vulnerability : CVE-2026-72158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is...

CVE-2026-72079

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect imspcudisconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distinguish...

EUVD-2026-58916

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit is se...

CVE-2026-72158 fpga: dfl: add bounds check in dfh_get_param_size()

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit is se...

CVE-2026-72079 Input: ims-pcu - fix use-after-free and double-free in disconnect

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect imspcudisconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distinguish...

CVE-2026-64339

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...

CVE-2026-63961

A flaw was found in the Linux kernel's USB Type-C DisplayPort DP alternate mode. A malicious or improperly configured USB-C device can send a malformed status update Vendor Defined Object VDO, which is a data structure used for communication. This can cause the kernel to read uninitialized memory...

CVE-2026-63898

A flaw was found in the Linux kernel's mctu232 USB serial driver. A malicious USB device could exploit this vulnerability by reporting a smaller endpoint maximum packet size than the driver expects. This incorrect handling of transfer sizes can lead to memory corruption, potentially allowing an...

PYSEC-2026-2517 Home Assistant has stored XSS in Map-card through malicious device name

Summary An authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point The lines or the dots...