CVE-2026-64329

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccgirqhandler calls ucsinotifycommon, which on a connector-change event calls ucsiconnectorchange and schedules connector work. In ucsiccgremove...

CVE-2026-64330 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdmconsumemodes In svdmconsumemodes, the SVID value is read from pmdata-svids using pmdata-svidindex as an array index without bounds validation: paltmode-svid =...

CVE-2026-64318

In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the ppcount scan to the ppe array aixpartition reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16tocpupvd-ppcount; ... fo...

CVE-2026-64312

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcryptaeaddone on the child AEAD request before trying to submit it through padata. If padatadoparallel returns -EBUSY, pcrypt falls back to calling the...

CVE-2026-64298

CVE-2026-64298: Linux kernel NFSv4: when O_TRUNC is used, the open permission mask must include MAY_WRITE so the local check aligns with server behavior. Current nfs_open_permission_mask() derives the mask from O_ACCMODE, which can let an open(O_RDONLY|O_TRUNC) pass local checks while the server ...

CVE-2026-64298 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAYWRITE in open permission mask for OTRUNC POSIX requires write permission to truncate a file, so an open that specifies OTRUNC must be authorized for write access regardless of the OACCMODE access mode...

CVE-2026-64298

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAYWRITE in open permission mask for OTRUNC POSIX requires write permission to truncate a file, so an open that specifies OTRUNC must be authorized for write access regardless of the OACCMODE access mode...

EUVD-2026-49008

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-64284

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...

CVE-2026-64285

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guestmemfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the...

CVE-2026-64278 i2c: imx-lpi2c: mark I2C adapter when hardware is powered down

In the Linux kernel, the following vulnerability has been resolved: i2c: imx-lpi2c: mark I2C adapter when hardware is powered down On some i.MX platforms, certain I2C client drivers keep a periodic workqueue which continues to trigger I2C transfers. During system suspend/resume, there exists a ti...

CVE-2026-64273

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the device-reported force-feedback effect index iforceprocesspacket handles a status report packet id 0x02 by taking a force-feedback effect index straight from the device wire and using it to address the...

kernel: Fix of 43 CVEs

Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times CVE-2022-50419 - firewire: net: fix use after free in fwnetfinishincomingpacket CVE-2023-53432 - wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit CVE-2022-50408 - wifi: brcmfmac: slab-out-of-bounds read in...

CVE-2026-66374

Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ DNS-over-QUIC receive path...

SUSE CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

SUSE CVE-2026-64213

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Add lock protection to lm90alert Sashiko reports: lm90alert executes in the smbus alert context and calls lm90updateconfreg to disable the hardware alert line, without acquiring hwmonlock. Concurrently, sysfs write...

PT-2026-64552

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep dequeue vep alloc request wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vep dequeue without a valid UDC reference. Since vrequest-udc is never...

Linux Distros Unpatched Vulnerability : CVE-2026-46582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based...

Linux Distros Unpatched Vulnerability : CVE-2026-64520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition...

Linux Distros Unpatched Vulnerability : CVE-2026-50248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still...