CVE-2026-64081

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

CVE-2026-63995

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

EUVD-2026-45659

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 include PEC byte in pmbusblockxfer read buffer adm1266pmbusblockxfer sets up the read transaction with .buf = data-readbuf, .len = ADM1266PMBUSBLOCKMAX + 2, but readbuf in struct adm1266data is declared as u8...

CVE-2026-64081

The CVE-2026-64081 issue in the Linux kernel’s firmware arm_ffa path was resolved by enforcing strict validation of framework notification messages carried in the shared RX buffer. The fix validates reported offset and size before use, rejects zero-length payloads, and ensures that any non-header...

CVE-2026-64009 xfrm: Check for underflow in xfrm_state_mtu

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

CVE-2026-63995

The CVE-2026-63995 entry documents a Linux kernel ethtool CMIS vulnerability where the firmware update path reads start_cmd_payload_size from the module FW Management Features CDB reply and uses it as the memcpy byte count into a 112-byte buffer, enabling an out-of-bounds write in cmis_fw_update_...

CVE-2026-63995 ethtool: cmis: validate start_cmd_payload_size from module

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

EUVD-2026-45568

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63888

CVE-2026-63888 affects the Linux kernel’s SCSI target iSCSI Text PDU path. Two latent bugs in iscsit_handle_text_cmd() were fixed: (1) a CRC32C buffer overread when DataDigest is negotiated, caused by using the bumped rx_size for crc32c() instead of the actual padded payload length; the fix is to...

CVE-2026-63872

CVE-2026-63872 documents a page-frag reference leak in the Linux kernel ESP crypto path. When esp->inplace is false, the code replaces old skb page frags with a new page from the xfrm page_frag cache and builds a source scatterlist from the old frags. If the second skb_to_sgvec() (destination)...

CVE-2026-63825

In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentation can merge global branch counters with loop induction variables as an optimization. In inflatefast, the inner copy loops get transformed ...

CVE-2026-63823

In the Linux kernel, the following vulnerability has been resolved: keys: Pin requestkeyauth payload in instantiate paths A: requestkey B: KEYCTLINSTANTIATEIOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy...

CVE-2026-63823

In the Linux kernel, the following vulnerability has been resolved: keys: Pin requestkeyauth payload in instantiate paths A: requestkey B: KEYCTLINSTANTIATEIOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy...

CVE-2026-63823

The CVE-2026-63823 entry concerns the Linux kernel's request_key/auth payload handling. The issue is described as a USE-AFTER-FREE scenario in the instantiate paths when handling request_key_auth payloads, involving create/auth key flow, helper synchronization, and key revocation/destroy paths. T...

CVE-2026-63823 keys: Pin request_key_auth payload in instantiate paths

In the Linux kernel, the following vulnerability has been resolved: keys: Pin requestkeyauth payload in instantiate paths A: requestkey B: KEYCTLINSTANTIATEIOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy...

EUVD-2026-45489

In the Linux kernel, the following vulnerability has been resolved: keys: Pin requestkeyauth payload in instantiate paths A: requestkey B: KEYCTLINSTANTIATEIOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy...

PT-2026-61312

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start cmd payload size from module The CMIS firmware update code reads start cmd payload size from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The...

PT-2026-61229

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp output head before esp output tail allocates the destination page frag. The head-side gate currently checks skb-data le...

PT-2026-61205

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit handle text cmd Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c "iscsi-target: Add iSCSI fabric...

PT-2026-61232

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc hci recv from llc and nci hci data received cb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A...