EUVD-2026-45460

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sevdbgcrypt for ENCRYPT path In sevdbgcrypt, the per-iteration transfer length is bounded by the source page offset PAGESIZE - soff but not by the destination page offset PAGESIZE - doff. When doff...

CVE-2026-53401

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfbmmap omapfbmmap has a race condition with OMAPFBSETUPPLANE ioctl that can lead to use-after-free: The fbmmap entry point holds mmlock but not lock fbinfo-lock, while ioctl handlers like...

CVE-2026-53396

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak and ignored error in nfsd4createfile nfsd4createfile has two bugs in its ACL handling: The return value of nfsd4acltoattr is silently discarded. When the NFSv4-to-POSIX ACL conversion fails e.g., -EINVAL f...

CVE-2026-53385 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

In the Linux kernel, the following vulnerability has been resolved: vcscreen: fix null-ptr-deref in vcsnotifier during concurrent vcswrite A KASAN null-ptr-deref was observed in vcsnotifier: BUG: KASAN: null-ptr-deref in vcsnotifier+0x98/0x130 Read of size 2 at addr qmpcmdname: qmpcapabilities,...

OESA-2026-3047 gnome-tour security update

A guided tour and greeter for GNOME.Tour uses by default the logo of the distribution based on the info from /etc/os-release. The application comes with a feature to replace the logo with a welcome video shipped by the distribution. Security Fixes: slab is a pre-allocated storage for a uniform da...

CVE-2026-53375 drm/amdgpu/vce: Prevent partial address patches

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW...

CVE-2026-53375 drm/amdgpu/vce: Prevent partial address patches

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW...

CVE-2026-53371

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound nodedesc sysfs read with %.64s nodedesc64 in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason drivers/infiniband/core/sysfs.c:1307, since...

CVE-2026-53371 RDMA/ionic: bound node_desc sysfs read with %.64s

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound nodedesc sysfs read with %.64s nodedesc64 in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason drivers/infiniband/core/sysfs.c:1307, since...

PT-2026-61125

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1-rc5 Description Memory corruption can occur in the BPF sysctl handler. The proc sys call handler function allocates a temporary sysctl buffer using kvzalloc, which may use vmalloc for large allocations...

PT-2026-61282

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack leak exists in the bmp580 trigger handler function. The function declares a scan buffer on the stack without an initializer and uses memcpy to copy 3 bytes of 24-bit sensor data...

PT-2026-61213

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow exists in the WebUSB GET URL handler within the composite setup function. When the host-supplied wLength is smaller than the WEBUSB URL DESCRIPTOR HEADER LENGTH, an...

PT-2026-61300

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A packet loop occurs in the netem Network Emulator module when the duplicate feature is enabled. When netem duplicates a packet, it re-enqueues the copy at the root qdisc Queueing...

PT-2026-61411

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL-pointer dereference occurs in the batman-adv module when a hard interface is retrieved as the primary interface of a mesh interface but becomes decoupled from it before the rtnl...

PT-2026-61275

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the UCSI USB Type-C Connector System Software Interface component where the ucsi connector change function fails to validate the connector number received in a UCSI CC...

PT-2026-61450

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds OOB array access occurs in the asihpi component of the ALSA Advanced Linux Sound Architecture subsystem. The find control function retrieves cached information by...

PT-2026-61459

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Two race conditions exist in the ksmbd durable scavenger function when interacting with walkers that iterate f ci-m fp list, such as ksmbd lookup fd inode used by ksmbd vfs rename and...

PT-2026-61085

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rzv2h-ivc media component where the buffer list rzv2h ivc::buffers.queue is accessed concurrently. While the list is intended to be protected by the rzv2h...

PT-2026-61438

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1-rc2 Description An issue exists in the Intermediate Functional Block IFB driver where ethtool statistics are reported incorrectly. The ifb dev init function allocates memory for dp-tx private based on dev-num...

PT-2026-61232

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds heap read occurs during HCP header parsing. The functions nfc hci recv from llc and nci hci data received cb access packet-header from skb-data without verifying that th...