CVE-2026-89726

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

CVE-2026-89726 lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

EUVD-2026-76633

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range maxregister The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. maxregister names 0x10000, one register past the end of...

CVE-2026-89596 forcedeth: fix off-by-one when saving/restoring non-PCI config space

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

CVE-2026-89596

CVE-2026-89596 affects the Linux kernel's forcedeth driver (NVIDIA). An off-by-one error in nv_suspend() and nv_resume() causes an out-of-bounds write one element past the saved_config_space array during system suspend and resume (S3). The bug is triggered by a loop using <= instead of <. W...

CVE-2026-89596 forcedeth: fix off-by-one when saving/restoring non-PCI config space

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

EUVD-2026-76508

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

CVE-2026-89525

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index. The val...

CVE-2026-89442

CVE-2026-89442 affects the Linux kernel 's platform/x86 ISST (Intelligent Speed and Frequency Tuning) module. The isst_if_clos_assoc() ioctl function improperly validates the user-supplied socket_id: it uses > instead of >= against topology_max_packages(), allowing an out-of-bounds array ac...

EUVD-2026-76348

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89442 platform/x86: ISST: Validate socket ID in clos_assoc ioctl

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89442

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89436

In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpipccretrievebiosdata rejects SINF packages only when pcc-numsifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...

CVE-2026-89436

CVE-2026-89436 is an out-of-bounds write in the Linux kernel's panasonic-laptop driver (platform/x86). In acpi_pcc_retrieve_biosdata(), a trailing sentinel is written at pcc->sinf[hkey->package.count], but when a DSDT's SINF package count equals SQTY+1 (a known off-by-one hardware quirk han...

CVE-2026-81012

CVE-2026-81012 is an off-by-one write in the Linux kernel's platform/x86: hp-bioscfg driver. The function hp_get_string_from_buffer() uses a strict greater-than (>) comparison when clamping the converted string length against the destination buffer size. When the converted length is exactly eq...

CVE-2026-81012 platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

CVE-2026-81012 platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

EUVD-2026-76335

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

CVE-2026-81012

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...