CVE-2026-64283

The CVE-2026-64283 issue affects the Linux kernel KVM guest_memfd binding: binding a memslot to a guest_memfd could overflow when computing offset+size due to signed interpretation. The bug arises because offset and size were not treated as unsigned values, risking a negative sum that could bypas...

CVE-2026-64283 KVM: guest_memfd: Treat memslot binding offset+size as unsigned values

In the Linux kernel, the following vulnerability has been resolved: KVM: guestmemfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guestmemfd file, treat the offset and size as unsigned values to fix a bug where the sum of the two can result in a false negative...

CVE-2026-64283

In the Linux kernel, the following vulnerability has been resolved: KVM: guestmemfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guestmemfd file, treat the offset and size as unsigned values to fix a bug where the sum of the two can result in a false negative...

CVE-2026-64272

Summary of CVE-2026-64272 : A bug in the Linux kernel MMS114 touch screen driver misreads touch data because it assumed 8-byte events, while MMS134S/MMS136 report 6-byte events. The driver loops over events using an 8-byte step (sizeof(struct mms114_touch)) but the actual packet size is 6 bytes p...

CVE-2026-64272 Input: mms114 - fix touch indexing for MMS134S and MMS136

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

SUSE CVE-2026-64231

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...

SUSE CVE-2026-64238

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 "gpio: shared: call gpiochip::ofxlate if set" used the mutex embedded in struct gpiosharedentry to protect the offset field which now can be modified...

PT-2026-64726

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndis rm hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

Linux Distros Unpatched Vulnerability : CVE-2026-64283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: guestmemfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guestmemfd file, treat the offset and size as unsigned values ...

PT-2026-64517

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat find dir entry In exfat find dir entry, each TYPE EXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order...

PT-2026-64504

In the Linux kernel, the following vulnerability has been resolved: KVM: guest memfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guest memfd file, treat the offset and size as unsigned values to fix a bug where the sum of the two can result in a false negativ...

CVE-2026-16280 GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in...

CVE-2026-16280

CVE-2026-16280 affects GPU DDK, specifically the PMRLogicalOffsetToPhysicalOffset function. An integer overflow for PMRs larger than 4 GB causes 32-bit truncation of address computations, leading to incorrect GPU MMU mappings. This can enable a non-privileged user to access unintended physical me...

DEBIAN-CVE-2026-64238

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 "gpio: shared: call gpiochip::ofxlate if set" used the mutex embedded in struct gpiosharedentry to protect the offset field which now can be modified...

CVE-2026-64238

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 "gpio: shared: call gpiochip::ofxlate if set" used the mutex embedded in struct gpiosharedentry to protect the offset field which now can be modified...

DEBIAN-CVE-2026-64231

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...

CVE-2026-64231

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...

CVE-2026-64254

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pciiounmap with offset when PEERSPAD and CONFIG share BAR When BARPEERSPAD and BARCONFIG share one PCI BAR, the module teardown path ends up calling pciiounmap on the same iomem with some offset, which is...

UBUNTU-CVE-2026-64254

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pciiounmap with offset when PEERSPAD and CONFIG share BAR When BARPEERSPAD and BARCONFIG share one PCI BAR, the module teardown path ends up calling pciiounmap on the same iomem with some offset, which is...

EUVD-2026-48663

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pciiounmap with offset when PEERSPAD and CONFIG share BAR When BARPEERSPAD and BARCONFIG share one PCI BAR, the module teardown path ends up calling pciiounmap on the same iomem with some offset, which is...