CVE-2026-78119

The Nuvoton NPCX eSPI driver parses Target-Attached-Flash TAF requests in espitafparse drivers/espi/espinpcx.c, taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO. For write and RPMC OP1 requests it copied DIVROUNDUPlen, 4 words into struct espitafpckt.src, a...

CVE-2026-78119 Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length

The Nuvoton NPCX eSPI driver parses Target-Attached-Flash TAF requests in espitafparse drivers/espi/espinpcx.c, taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO. For write and RPMC OP1 requests it copied DIVROUNDUPlen, 4 words into struct espitafpckt.src, a...

CVE-2026-78119 Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length

The Nuvoton NPCX eSPI driver parses Target-Attached-Flash TAF requests in espitafparse drivers/espi/espinpcx.c, taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO. For write and RPMC OP1 requests it copied DIVROUNDUPlen, 4 words into struct espitafpckt.src, a...

CVE-2026-78119

The Nuvoton NPCX eSPI driver contains an out-of-bounds write vulnerability in the espi_taf_parse() function located in drivers/espi/espi_npcx.c. The driver fails to validate a 12-bit length field from the FLASHRXBUF FIFO header, leading to a copy operation that can exceed the 64-byte espi_taf_pck...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: wpcm450: fix an out-of-bounds write issue. The write operation to ‘pctrl-gpiobank’ occurs before the check for the validity of the GPIO index, which may lead to an out-of-bounds write. This issue was detected by...

CVE-2026-80930

A flaw was found in the Linux kernel's TPM I2C Nuvoton driver. The i2cnuvotonwaitforstat function enables an interrupt IRQ but fails to disable it if the wait operation times out or is interrupted. This oversight can lead to an unbalanced IRQ state, potentially causing system instability or...

PT-2026-96485

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm i2c nuvoton: disable IRQ on wait timeout i2c nuvoton wait for stat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...

PT-2026-90060

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tpm i2c nuvoton driver where the i2c nuvoton wait for stat function enables the IRQ before waiting for the interrupt handler to report a status change. If the wait...

CVE-2026-68221

A flaw was found in the Linux kernel's Nuvoton NPCM video driver. The npcmvideoprobe function allocates memory that is not properly freed on error paths or during device removal, leading to memory leaks. Additionally, when npcmvideosetupvideo fails, associated reserved memory is not released. The...

CVE-2026-68221

In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcmvideoprobe allocates the npcmvideo structure with kzallocobj but never frees it on any probe error path or in npcmvideoremove, leaking the allocation on every...

CVE-2026-68221

The CVE-2026-68221 entry concerns the Linux kernel component media: nuvoton: npcm-video. The issue is memory leaks in npc m_video_probe() where the structure allocated with kzalloc_obj() is not freed on probe error paths or in npcm_video_remove(), leaking on failed probes and normal unbind. It al...

CVE-2026-68221 media: nuvoton: npcm-video: fix memory leaks in probe and remove

In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcmvideoprobe allocates the npcmvideo structure with kzallocobj but never frees it on any probe error path or in npcmvideoremove, leaking the allocation on every...

EUVD-2026-55322

In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcmvideoprobe allocates the npcmvideo structure with kzallocobj but never frees it on any probe error path or in npcmvideoremove, leaking the allocation on every...

CVE-2026-68221 media: nuvoton: npcm-video: fix memory leaks in probe and remove

In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcmvideoprobe allocates the npcmvideo structure with kzallocobj but never frees it on any probe error path or in npcmvideoremove, leaking the allocation on every...

PT-2026-69621

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Memory leaks occur in the nuvoton npcm-video driver. The npcm video probe function allocates the npcm video structure using kzalloc obj but fails to free it during probe error paths or...

CVE-2026-68221: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcmvideoprobe allocates the npcmvideo structure with kzallocobj but never frees it on any probe error path or in npcmvideoremove, leaking the allocation on every...

CVE-2026-10668 Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver

The Nuvoton NuMaker HSUSBD USB device-controller driver drivers/usb/udc/udcnumaker.c armed the control Data IN stage unconditionally base-CEPTXCNT = len in numakerhsusbdeptrigger. Because the HSUSBD hardware cannot disarm a control Data IN already armed for a previous transfer, a USB host that...

CVE-2026-10668 Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver

The Nuvoton NuMaker HSUSBD USB device-controller driver drivers/usb/udc/udcnumaker.c armed the control Data IN stage unconditionally base-CEPTXCNT = len in numakerhsusbdeptrigger. Because the HSUSBD hardware cannot disarm a control Data IN already armed for a previous transfer, a USB host that...

EUVD-2026-43245

The Nuvoton NuMaker HSUSBD USB device-controller driver drivers/usb/udc/udcnumaker.c armed the control Data IN stage unconditionally base-CEPTXCNT = len in numakerhsusbdeptrigger. Because the HSUSBD hardware cannot disarm a control Data IN already armed for a previous transfer, a USB host that...

CVE-2026-10668 Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver

The Nuvoton NuMaker HSUSBD USB device-controller driver drivers/usb/udc/udcnumaker.c armed the control Data IN stage unconditionally base-CEPTXCNT = len in numakerhsusbdeptrigger. Because the HSUSBD hardware cannot disarm a control Data IN already armed for a previous transfer, a USB host that...