CVE-2026-72076 Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

PT-2026-72265

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the debug logging of the ims pcu irq function. The issue occurs because the function unconditionally prints data from pcu-urb in buf, even when the...

PT-2026-72908

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free issue exists in the peak usb start function. When an RX URB transfer buffer is allocated using kmalloc and flagged with URB FREE BUFFER, the usb free urb function is design...

PT-2026-72267

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The ims-pcu driver fails to verify that the first endpoint of the control interface is an interrupt IN endpoint. A malicious device could provide an incorrect endpoint type, which is the...

PT-2026-72957

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ALSA 6fire driver. The driver fails to handle a pending USB Request Block URB—a data structure used to manage USB communication—during the error...

PT-2026-72911

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the es58x read bulk callback function when resubmitting the RX URB USB Request Block after processing a received packet. If the usb submit urb function fails, the...

PT-2026-72737

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Bluetooth btmtk component within the alloc mtk intr urb error path. When the btmtk isopkt pad function fails, the previously allocated URB USB Request Block,...

CVE-2026-74301: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix URB leak in allocmtkintrurb error path When btmtkisopktpad fails, the previously allocated URB is not freed, leaking the urb structure. Add usbfreeurb before returning the error...

PT-2026-72631

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the ALSA USB audio component. During the execution of snd usb midi v2 create, MIDI 2.0 input URBs USB Request Blocks are started. If a subsequent...

CVE-2026-68217

A flaw was found in the Linux kernel's pwc media driver. When initiating a streaming operation, if an error occurs during the submission of isochronous USB Request Blocks URBs, a buffer may not be correctly deallocated. This oversight can lead to a resource leak, potentially causing system...

CVE-2026-68217 media: pwc: Drain fill_buf on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Drain fillbuf on startstreaming failure pwcisocinit submits its isochronous URBs with usbsubmiturb.., GFPKERNEL in a loop. After the first URB is submitted, its completion handler pwcisochandler can run on another CPU...

CVE-2026-68087 HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFPATOMIC in wacomwacqueueflush wacomwacqueueflush is called via the .rawevent callback wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush. For USB HID devices, this callback is invoked from hidirqin,...

CVE-2026-68087 HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFPATOMIC in wacomwacqueueflush wacomwacqueueflush is called via the .rawevent callback wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush. For USB HID devices, this callback is invoked from hidirqin,...

can: esd_usb: kill anchored URBs before freeing netdevs

...

CVE-2026-64601

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: captureurbcomplete: redundant usbanchorurb corrupts anchor list on each resubmission In captureurbcomplete, usbanchorurb is called on every completion callback, but the URB is already anchored from the initial...

CVE-2026-64601

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: captureurbcomplete: redundant usbanchorurb corrupts anchor list on each resubmission In captureurbcomplete, usbanchorurb is called on every completion callback, but the URB is already anchored from the initial...

CVE-2026-64601 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: captureurbcomplete: redundant usbanchorurb corrupts anchor list on each resubmission In captureurbcomplete, usbanchorurb is called on every completion callback, but the URB is already anchored from the initial...

CVE-2026-64585

In the Linux kernel, the following vulnerability has been resolved: can: esdusb: kill anchored URBs before freeing netdevs esdusbdisconnect frees each CAN netdev with freecandev inside its per-netdev loop and only calls unlinkallurbsdev afterwards. The per-netdev private data struct esdusbnetpriv...

CVE-2026-64585

In the Linux kernel, the following vulnerability has been resolved: can: esdusb: kill anchored URBs before freeing netdevs esdusbdisconnect frees each CAN netdev with freecandev inside its per-netdev loop and only calls unlinkallurbsdev afterwards. The per-netdev private data struct esdusbnetpriv...

PT-2026-68433

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA us144mkii driver where the capture urb complete function calls usb anchor urb on every completion callback. Since the URB USB Request Block is already anchore...