CVE-2026-80827

CVE-2026-80827 affects the Linux kernel's USB serial option driver (usb-serial-option). The interrupt URB buffer is allocated in setup_port_interrupt_in() using the endpoint's wMaxPacketSize via kmalloc(). When a USB device declares wMaxPacketSize = 8, the buffer is exactly 8 bytes. If the device...

EUVD-2026-71277

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

EUVD-2026-71276

In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00addisourb When TD creation fails for the last packet of an isochronous URB, c67x00addisourb gives the URB back before updating the endpoint scheduling state. c67x00givebackurb frees the UR...

CVE-2026-80826

CVE-2026-80826 is a use-after-free in the Linux kernel's c67x00 USB driver , specifically in c67x00_add_iso_urb(). When TD creation fails for the last packet of an isochronous URB, the driver gives the URB back before updating the endpoint scheduling state. Since c67x00_giveback_urb() frees the U...

CVE-2026-80816

This Linux kernel vulnerability affects the ALSA FCP (Firmware Configuration Protocol) module. The root cause is that fcp_init_notify() shared a URB (mixer->urb ) with the optional UAC2 status interrupt endpoint . On devices exposing that endpoint, the early-return path fired prematurely, leav...

EUVD-2026-71251

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcpinitnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device...

CVE-2026-80815

CVE-2026-80815 affects the ALSA scarlett2 driver in the Linux kernel, used for Focusrite Scarlett 2nd-generation USB audio interfaces. The root cause is that scarlett2_init_notify() shared mixer->urb with the UAC2 status interrupt endpoint managed by mixer.c. On devices with that endpoint, the...

EUVD-2026-71250

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2initnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that...

uboatdemo

uboatdemo CVE-2016-3955UBOAT용 데모 서버 USB/IP 클라이언트가 제어 URB 전송을 시작할 때 Linux 힙 버퍼 오버플로를 수행합니다. 빌드 이 서버는 표준 단순 Go 프로그램입니다. Go가 공식 지침에 따라 설정 및 구성되어 있다고 가정하면 일반적인 방식으로 빌드할 수 있습니다: root@kitploit: go get github.com/pqsec/uboatdemo/cmd/uboatsrv 컴파일된 바이너리는 구성된 $GOPATH의 bin 디렉터리에 있어야 합니다. 추가 정보...

SUSE CVE-2026-80573

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

UBUNTU-CVE-2026-80573

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

CVE-2026-74680

A flaw was found in the Linux kernel's cxacru USB ATM driver. When the cxacrucm function encounters an error, it fails to properly terminate an already submitted receive USB Request Block URB. This oversight can lead to the driver attempting to resubmit an active URB, which triggers a warning in...

CVE-2026-74639

A flaw was found in the Linux kernel, specifically within the ALSA us144mkii driver. The captureurbcomplete function resubmits capture Urban Request Blocks URBs without properly re-anchoring them. This oversight allows URBs to remain queued on the host controller even after their associated memor...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: fix use after free in debug printk The line “devdbg&urb-dev-dev, …” occurs after the function usbfreeurburb. This is a use after free of the “urb” pointer. To avoid this issue, store the “dev” pointer at...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fixed race conditions related to access to midibuf. There can be concurrent accesses to line6’s midibuf from both the URB completion callback and the rawmidi API. This could trigger a KMSAN warning triggered by...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9khtc: Use skbsetlength to reset urb before resubmitting it. Syzbot points out that skbtrim has a sanity check on the existing length of the skb; this length might not be initialized in some error-prone situations. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: enable basic endpoint checking Syzkaller reports that he encountered a common issue during the URB submission phase, where a wrong USB endpoint type was used. This triggered a warning as follows: For now,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fixed the CPU lockup caused by excessive log messages. The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver took too long. The driver’s immediate resubmission of interrupts...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: media: zr364xx: fixed a memory leak in zr364xxstartreadpipe syzbot reported a memory leak in the zr364xx driver. The issue occurred when non-free urb occurred in case of a failure in usbsubmiturb. Backtrace: kmalloc...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usbnet: Fixed an issue in usbnetstartxmit/usbsubmiturb. The syzbot fuzzer identified a problem with the usbnet driver: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504;...