CVE-2026-80829 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput sndusbmidinovationoutput lays out a two-byte header at transferbuffer0..1 and passes &transferbuffer2 together with a length of ep-maxtransfer - 2 to sndrawmiditransmit:...

CVE-2026-80829

CVE-2026-80829 is an out-of-bounds write in the Linux kernel 's ALSA usb-audio subsystem, specifically in snd_usbmidi_novation_output(). A malformed or malicious USB device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1, causing the length passed to snd_rawmidi_transmit() to become ...

CVE-2026-80802 nfc: fdp: bound the device-reported read length and fix an skb leak

In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdpncii2cread takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2cmasterrecv count into a...

CVE-2026-80780 HID: pidff: fix OOB write when hid->inputs is empty

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...

CVE-2026-80780

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...

CVE-2026-80780

CVE-2026-80780 is an out-of-bounds write in the Linux kernel's HID: pidff driver, specifically in hid_pidff_init_with_quirks(). The function calls list_entry() on hid->inputs without verifying the list is non-empty. When hid->inputs is empty—possible with a USB device whose report descripto...

CVE-2026-80780 HID: pidff: fix OOB write when hid->inputs is empty

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...

Linux Distros Unpatched Vulnerability : CVE-2026-85050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a...

CVE-2026-80829: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput sndusbmidinovationoutput lays out a two-byte header at transferbuffer0..1 and passes &transferbuffer2 together with a length of ep-maxtransfer - 2 to sndrawmiditransmit:...

PT-2026-91353

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free rd atomic resources free rd atomic resources iterates using qp-attr.max dest rd atomic. Updating max dest rd atomic before freeing the old array can make the free path walk past the old allocation and...

PT-2026-85643

In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdp nci i2c read takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2c master recv count into a...

PT-2026-85707

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd usbmidi novation output snd usbmidi novation output lays out a two-byte header at transfer buffer0..1 and passes &transfer buffer2 together with a length of ep-max transfer - 2 to snd rawmidi...

PT-2026-91354

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd usbmidi novation output snd usbmidi novation output lays out a two-byte header at transfer buffer0..1 and passes &transfer buffer2 together with a length of ep-max transfer - 2 to snd rawmidi...

CVE-2026-80780: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106183)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106183 advisory. FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with...

PT-2026-85718

In the Linux kernel, the following vulnerability has been resolved: ipv6: seg6: clear IPv4 control block on IPIP decapsulation End.DX4 and End.DT4 decapsulate an IPv4 packet through decap and validate and send it directly to IPv4 routing. The inner packet therefore bypasses ip rcv core, which...

EUVD-2026-70707

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-74371

In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPFPROGQUERY OOB write and cgroup backward compat BPFPROGQUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpfattr' structure e.g. 40 bytes, which was the layout...

SUSE CVE-2026-72338

In the Linux kernel, the following vulnerability has been resolved: net/sched: actpedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and filling it. [email protected] reports: The clsflower...

TencentOS Server 4: libevent (TSSA-2026:0884)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0884 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...