CVE-2026-80796

CVE-2026-80796 affects the Linux kernel NFC NCI driver . The functions nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() read an inner length byte from the NCI RF_INTF_ACTIVATED_NTF payload and use it to memcpy() into fixed kernel buffers, but neither function re...

CVE-2026-80796 nfc: nci: add data_len bound checks to activation parameter extractors

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add datalen bound checks to activation parameter extractors nciextractactivationparamsisodep and nciextractactivationparamsnfcdep read an inner length byte from the NCI RFINTFACTIVATEDNTF payload and use it to memcpy in...

EUVD-2026-71439

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add datalen bound checks to activation parameter extractors nciextractactivationparamsisodep and nciextractactivationparamsnfcdep read an inner length byte from the NCI RFINTFACTIVATEDNTF payload and use it to memcpy in...

CVE-2026-80781

CVE-2026-80781 is an out-of-bounds read in the Linux kernel's HID core subsystem. The function hid_set_field() passes field->usage + offset to hid_dump_input() before validating that the offset is within field->report_count. When CONFIG_DEBUG_FS is enabled, hid_dump_input() dereferences the...

CVE-2026-80781 HID: core: fix OOB read of field->usage in hid_set_field()

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset: hiddumpinputfield-report-device, field-usage + offset, value; if offset =...

CVE-2026-80781

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset: hiddumpinputfield-report-device, field-usage + offset, value; if offset =...

EUVD-2026-71424

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset: hiddumpinputfield-report-device, field-usage + offset, value; if offset =...

CVE-2026-80779 net/ionic: avoid OOB TX partner lookup for hwstamp RXQ

In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...

EUVD-2026-71422

In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...

CVE-2026-80772 HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses it, guarding the cast only with a 12-byte length check: if size = 12 /...

EUVD-2026-71415

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses it, guarding the cast only with a 12-byte length check: if size = 12 /...

CVE-2026-80772

CVE-2026-80772 is an out-of-bounds read in the Linux kernel 's HID Nintendo driver, specifically in joycon_ctlr_read_handler(). The function guards a cast of incoming HID input reports to a 49-byte struct joycon_input_report with only a 12-byte length check. A 12-byte report with data[0] == JC_IN...

CVE-2026-80772

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses it, guarding the cast only with a 12-byte length check: if size = 12 /...

EUVD-2026-71411

In the Linux kernel, the following vulnerability has been resolved: HID: ft260: fix stack-use-after-return write in I2C read race ft260i2cread points dev-readbuf at a caller-supplied buffer often an on-stack variable, arms a completion and waits up to five seconds for the device to return the dat...

CVE-2026-80768

CVE-2026-80768 is a stack-use-after-return write in the Linux kernel's HID ft260 driver . The race occurs between ft260_i2c_read(), which points dev->read_buf at a caller-supplied (often on-stack) buffer and waits up to five seconds for an I2C response, and ft260_raw_event(), an input/IRQ-path...

CVE-2026-80768

In the Linux kernel, the following vulnerability has been resolved: HID: ft260: fix stack-use-after-return write in I2C read race ft260i2cread points dev-readbuf at a caller-supplied buffer often an on-stack variable, arms a completion and waits up to five seconds for the device to return the dat...

EUVD-2026-71408

In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTHHIDINITIALDEVICEINFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsconreceivedeviceinfo trusts...

CVE-2026-80765

CVE-2026-80765 affects the Linux kernel 's Hyper-V synthetic HID driver. The function mousevsc_on_receive_device_info() trusts the bLength and wDescriptorLength fields in SYNTH_HID_INITIAL_DEVICE_INFO messages without verifying that the received VMBus packet actually contains both the HID descrip...

CVE-2026-80765 HID: hyperv: validate initial device info bounds

In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTHHIDINITIALDEVICEINFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsconreceivedeviceinfo trusts...

EUVD-2026-71406

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...