CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

EUVD-2026-86195

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

CVE-2026-93807 wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers rsihalloadkey copies txmickey and rxmickey from data16 and data24 whenever key data is present. Those offsets are only part of the 32-byte TKIP key layout. Shorter keys...

CVE-2026-93807

The Linux kernel contains a vulnerability in the wifi: rsi component where the rsi_hal_load_key() function performs unconditional copies of tx_mic_key and rx_mic_key from specific offsets within the key data. Because these offsets are part of the 32-byte TKIP key layout, using shorter keys for ot...

CVE-2026-93807 wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers rsihalloadkey copies txmickey and rxmickey from data16 and data24 whenever key data is present. Those offsets are only part of the 32-byte TKIP key layout. Shorter keys...

EUVD-2026-86194

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers rsihalloadkey copies txmickey and rxmickey from data16 and data24 whenever key data is present. Those offsets are only part of the 32-byte TKIP key layout. Shorter keys...

CVE-2026-93806

The Linux kernel contains a vulnerability in the cfg80211 wifi component. The cfg80211_rx_assoc_resp() function incorrectly initializes the status and response-IE fields of cfg80211_connect_resp_params from a management frame before verifying that the frame is long enough to accommodate those off...

EUVD-2026-86193

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc response length before status and IE access cfg80211rxassocresp initialises the status and response-IE fields of cfg80211connectrespparams from the management frame before proving that the frame is...

CVE-2026-93805

The Linux kernel contains a vulnerability in the cfg80211 component where cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() fail to properly validate the lengths of MLME callback frames before accessing their contents. Specifically, the functions only verify that frames are at least 2 bytes lon...

CVE-2026-93805 wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

EUVD-2026-86192

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

CVE-2026-93805 wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

EUVD-2026-86190

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

CVE-2026-93803

The Linux kernel contains a vulnerability in the libipw component where libipw_rx() fails to perform adequate bound checks when extracting the WEP key index . The function reads skb->data[hdrlen + 3], but the existing guard only ensures skb->len >= hdrlen + 3, which does not guarantee th...

CVE-2026-93803 wifi: libipw: fix key index receive bound checks

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

EUVD-2026-86174

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

CVE-2026-93787

The Linux kernel contains a vulnerability in the SMB1 client where cifs_filldir() fails to verify if the entry name length provided by a server stays within the bounds of the allocated SMB response buffer. A hostile SMB1 server can return an oversized FileNameLength , causing memchr() to perform ...

CVE-2026-93787 smb: client: bound dirent name against end of SMB response in cifs_filldir

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

CVE-2026-93787 smb: client: bound dirent name against end of SMB response in cifs_filldir

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...