CVE-2026-80780

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...

CVE-2026-80829 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput sndusbmidinovationoutput lays out a two-byte header at transferbuffer0..1 and passes &transferbuffer2 together with a length of ep-maxtransfer - 2 to sndrawmiditransmit:...

PT-2026-85621

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hid pidff init with quirks derives its input dev from list entryhid-inputs.next, struct hid input, list without first checking that hid-inputs is non-empty. The list member of...

SUSE CVE-2026-84270

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-84270

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read()

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read()

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read()

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-84270

The affected software is gvfs (GNOME Virtual Filesystem), specifically its MTP backend . The flaw resides in do_read() within gvfsbackendmtp.c , which trusts the data length returned by a connected MTP device without capping it to the size originally requested by the client. When a malicious devi...

CVE-2026-84270

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

PT-2026-84310

Name of the Vulnerable Software and Affected Versions gvfs affected versions not specified Description A flaw exists in the MTP backend of gvfs. When reading a file from a mounted MTP device, the do read function in gvfsbackendmtp.c trusts the data length returned by the device without limiting i...

Linux Distros Unpatched Vulnerability : CVE-2026-84270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the...

SUSE CVE-2026-80594

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in imspcugetcdcuniondesc by iterating through the extra descriptor data. However, it does not verify that the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fixed a use-after-free in umptoendpoint The createmidi2ump function registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata. However, it never...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it expects before binding to it. If a malicious device does not have the...

CVE-2026-72158

A flaw was found in the Linux kernel's FPGA Dynamic Function Link DFL subsystem. A malicious FPGA device can provide specially crafted parameter headers, causing the system to miscalculate the size of a feature region. This incorrect size can lead to a memory corruption vulnerability when data is...

Linux Distros Unpatched Vulnerability : CVE-2026-72158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100306)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100306 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Check to ensure report responses match the request It is possible for a maliciou...

CVE-2026-72079

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect imspcudisconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distinguish...

CVE-2026-72158 fpga: dfl: add bounds check in dfh_get_param_size()

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit is se...