EUVD-2026-71234

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlvarraylen is u16. When TLV data...

CVE-2026-80799 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlvarraylen is u16. When TLV data...

CVE-2026-80781 HID: core: fix OOB read of field->usage in hid_set_field()

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset: hiddumpinputfield-report-device, field-usage + offset, value; if offset =...

CVE-2026-80781 HID: core: fix OOB read of field->usage in hid_set_field()

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset: hiddumpinputfield-report-device, field-usage + offset, value; if offset =...

EUVD-2026-71415

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses it, guarding the cast only with a 12-byte length check: if size = 12 /...

PT-2026-85622

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hid set field hid set field hands field-usage + offset to hid dump input before the guard that bounds offset: hid dump inputfield-report-device, field-usage + offset, value; if offset =...

PT-2026-91311

In the Linux kernel, the following vulnerability has been resolved: rndis host: add overflow check in rndis rx fixup Add an overflow check to ensure that data offset + data len + 8 does not wrap, which would enable an OOB read of the USB data buffer...

PT-2026-91300

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hid set field hid set field hands field-usage + offset to hid dump input before the guard that bounds offset: hid dump inputfield-report-device, field-usage + offset, value; if offset =...

CVE-2026-80781: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset: hiddumpinputfield-report-device, field-usage + offset, value; if offset =...

CVE-2026-80814: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

CVE-2026-80799: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlvarraylen is u16. When TLV data...

PT-2026-91361

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfc llcp parse gb tlv and nfc llcp parse connection tlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlv array len is u16. When TL...

PT-2026-91805

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...

PT-2026-91348

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connect sn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfc llcp recv snl, and commit d8bd2dedbde5 "nfc: llcp: fi...

PT-2026-86165

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign pt and update map in pjmedia/src/pjmedia/sdp neg.c...

PT-2026-85705

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setup port interrupt in based on the endpoint's wMaxPacketSize: buffer size = usb endpoint maxpepd; port-interrupt in buffe...

Linux Distros Unpatched Vulnerability : CVE-2026-80827

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's...

Linux Distros Unpatched Vulnerability : CVE-2026-80796

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: nci: add datalen bound checks to activation parameter extractors nciextractactivationparamsisodep and nciextractactivationparamsnfcdep read an inner length...

Linux Distros Unpatched Vulnerability : CVE-2026-80814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the...

Linux Distros Unpatched Vulnerability : CVE-2026-80799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops:...