CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

DEBIAN-CVE-2026-89525

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index. The val...

CVE-2026-89442

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89436

In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpipccretrievebiosdata rejects SINF packages only when pcc-numsifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...

AZL-100590 CVE-2026-81012 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

CVE-2026-81012

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

DEBIAN-CVE-2026-81012

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

CVE-2026-81012

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

UBUNTU-CVE-2026-89436

In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpipccretrievebiosdata rejects SINF packages only when pcc-numsifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...

UBUNTU-CVE-2026-89679

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

UBUNTU-CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

UBUNTU-CVE-2026-81012

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

CVE-2026-89679

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

CVE-2026-89751

CVE-2026-89751 is an off-by-one error in the Linux kernel's x86 TDX (Trusted Domain Extensions) port I/O handling. The functions handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c compute a bitmask using GENMASK(BITS_PER_BYTE * size, 0). Since GENMASK(h, l) includes bit h , this produces a m...

EUVD-2026-76663

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89751 x86/tdx: Fix off-by-one in port I/O handling

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89751

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89751 x86/tdx: Fix off-by-one in port I/O handling

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89726

CVE-2026-89726 is an off-by-one out-of-bounds read in the Linux kernel's lib/ucs2_string.c, specifically in the ucs2_strnlen() function. The root cause is that ucs2_strnlen() checks the current character before verifying whether the caller-provided maximum length has been reached. If the input is...