CVE-2026-63899

A flaw was found in the Linux kernel's USB serial mxuport driver. A malicious Universal Serial Bus USB device could exploit this vulnerability by reporting a bulk-out endpoint maximum packet size smaller than eight bytes. This can lead to user-controlled slab corruption, potentially allowing an...

CVE-2026-63883

A flaw was found in the Linux kernel's qcomgeni serial driver. A race condition can occur when the uartflushbuffer function executes before the Direct Memory Access DMA completion interrupt is processed. This timing issue can lead to a kernel First-In, First-Out kfifo buffer underflow...

CVE-2026-63876

A flaw was found in the Linux kernel's zs serial driver. During the initialization of the first serial port, a null pointer dereference occurs when a pointer derived from a null parent device pointer is accessed. This vulnerability can lead to a system crash, resulting in a Denial of Service DoS...

CVE-2026-63901

A flaw was found in the Linux kernel's digiacceleport USB serial driver. A malicious Universal Serial Bus USB device could report smaller bulk-out buffers than expected. This lack of proper size validation could lead to out-of-bounds memory accesses or slab corruption, potentially causing system...

CVE-2026-63964

A flaw was found in the Linux kernel's USB Type-C UCSI CCG driver. A local attacker with root privileges can provide a specially crafted firmware image without a required record header. This malformed image can cause a null pointer dereference within the doflash function, leading to a kernel cras...

CVE-2026-63877

A flaw was found in the Linux kernel's serial DZ driver. During the initialization of the first serial port, a null pointer dereference occurs because a pointer to the port's parent device is incorrectly derived from a null value. This vulnerability can lead to a system crash, resulting in a Deni...

CVE-2026-63905

A flaw was found in the Linux kernel's USB/IP Virtual USB Device Controller vudc component. A race condition exists in the vudcremove function, which can lead to a use-after-free vulnerability. This occurs when the system attempts to free a data structure while a timer within it is still active o...

SUSE CVE-2026-63876

In the Linux kernel, the following vulnerability has been resolved: serial: zs: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to mono frame buffer device 160x64 fb0: PMAG-AA frame buffer device at tc0 DECstation Z85C30...

SUSE CVE-2026-63877

In the Linux kernel, the following vulnerability has been resolved: serial: dz: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to colour frame buffer device 160x64 tgafb: SFB+ detected, rev=0x02 fb0: Digital ZLX-E1 frame...

SUSE CVE-2026-63883

In the Linux kernel, the following vulnerability has been resolved: serial: qcomgeni: fix kfifo underflow when flush precedes DMA completion IRQ When uartflushbuffer runs before the DMA completion IRQ is delivered, the following race can occur all steps serialized by uartportlock: 1. DMA starts:...

SUSE CVE-2026-63897

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data and leaking it to user space...

SUSE CVE-2026-63898

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increas...

SUSE CVE-2026-63899

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size...

SUSE CVE-2026-63900

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...

SUSE CVE-2026-63901

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device report smaller buffers...

SUSE CVE-2026-63902

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

SUSE CVE-2026-63903

In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkinsa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from...

SUSE CVE-2026-63932

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

SUSE CVE-2026-63956

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...

SUSE CVE-2026-63957

In the Linux kernel, the following vulnerability has been resolved: USB: serial: safeserial: fix memory corruption with small endpoint Make sure that the bulk-out buffer size is at least eight bytes to avoid user-controlled slab corruption in "safe" mode should a malicious device report a smaller...