CVE-2026-89691 nfsd: clear opcnt on compound arg release to prevent OOB read

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

CVE-2026-89691

CVE-2026-89691 affects the Linux kernel's nfsd (NFS server) component. The root cause is that nfsd4_release_compoundargs() resets args->ops to the inline 8-element iops[] array after freeing the dynamically allocated ops buffer, but fails to clear args->opcnt, which can be up to 200 for NFS...

CVE-2026-89524

This vulnerability affects the ath6kl WiFi driver in the Linux kernel . In ath6kl_cfg80211_connect_event(), fixed IE offsets (4 bytes for the association request, 6 bytes for the response) are subtracted from unsigned 8-bit length fields with no lower bound. When a malicious or malformed associat...

PT-2026-90407

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4 release compoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value...

kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. The rmif3amapgpios function incorrectly allocates memory for the gpiokeymap, making it smaller than required. This allows a device reporting a specific gpiocount value to trigger an out-of-bounds read, leading to information...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100527)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100527 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO...

CVE-2026-64339

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...