2563 matches found
CVE-2026-63928
A flaw was found in the Linux kernel's USB serial omninet driver. A malicious Universal Serial Bus USB device could exploit this by reporting a smaller maximum packet size than anticipated. This action would cause the system to allocate undersized data buffers, leading to memory corruption. Such...
Linux Distros Unpatched Vulnerability : CVE-2026-63904
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These...
SUSE CVE-2026-63821
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...
CVE-2026-63957
In the Linux kernel, the following vulnerability has been resolved: USB: serial: safeserial: fix memory corruption with small endpoint Make sure that the bulk-out buffer size is at least eight bytes to avoid user-controlled slab corruption in "safe" mode should a malicious device report a smaller...
CVE-2026-63928
In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...
CVE-2026-63903
In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkinsa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from...
CVE-2026-63906
In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430probe In omap2430probe, ofnodeputnp is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the ofnodepu...
CVE-2026-63901
In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device report smaller buffers...
CVE-2026-64144 Bluetooth: btmtk: fix urb->setup_packet leak in error paths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix urb-setuppacket leak in error paths The setuppacket of control urb is not freed if usbsubmiturb fails or the submitted urb is killed. Add free in these two paths...
EUVD-2026-45829
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix urb-setuppacket leak in error paths The setuppacket of control urb is not freed if usbsubmiturb fails or the submitted urb is killed. Add free in these two paths...
CVE-2026-64144
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix urb-setuppacket leak in error paths The setuppacket of control urb is not freed if usbsubmiturb fails or the submitted urb is killed. Add free in these two paths...
CVE-2026-64014 Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO datalen/xlen to URB buffer size nexioreaddata pulls datalen and xlen from a packed be16 header in the device's interrupt packet and then walks packet-data0..xlen and packet-dataxlen..datalen...
CVE-2026-63964
The CVE-2026-63964 entry describes a Linux kernel vulnerability in usb: typec: ucsi: ccg where do_flash() searches firmware records for a ':' header. If a firmware image lacks ':' bytes, strnchr() returns NULL, and the loop uses p+1 and a large length, causing a crash. A root user could place a c...
CVE-2026-63964 usb: typec: ucsi: ccg: reject firmware images without a ':' record header
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...
CVE-2026-63963 usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdmconsumeidentity or svdmconsumeidentitysopprime as the device-controlled value could index of...
EUVD-2026-45736
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdmconsumeidentity or svdmconsumeidentitysopprime as the device-controlled value could index of...
CVE-2026-63961 usb: typec: altmodes/displayport: validate count before reading Status Update VDO
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...
CVE-2026-63961 usb: typec: altmodes/displayport: validate count before reading Status Update VDO
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...
CVE-2026-63961
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...
CVE-2026-63961
CVE-2026-63961 affects the Linux kernel’s USB Type-C altmodes/displayport code. A broken/malicious device could send an incorrect status-update VDO count, causing the kernel to read uninitialized stack data and potentially forward it elsewhere. The issue is resolved by correctly validating the up...