CVE-2026-90015

A flaw was found in the Linux kernel's xHCI eXtensible Host Controller Interface driver. This vulnerability occurs when the driver processes large, fragmented USB data transfers, leading to incorrect handling of memory buffers. An attacker with local access or a malicious USB device could exploit...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rndishost: An overflow check was added in rndisrxfixup. An overflow check is added to ensure that dataOffset + dataLen + 8 does not exceed the maximum value, thereby preventing an OOB Out-of-Buffer read of the USB data buffer...

SUSE CVE-2026-80814

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

AZL-99452 CVE-2026-80814 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

CVE-2026-80814

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

CVE-2026-80814 rndis_host: add overflow check in rndis_rx_fixup()

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

EUVD-2026-71249

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

CVE-2026-80814 rndis_host: add overflow check in rndis_rx_fixup()

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

PT-2026-85655

In the Linux kernel, the following vulnerability has been resolved: rndis host: add overflow check in rndis rx fixup Add an overflow check to ensure that data offset + data len + 8 does not wrap, which would enable an OOB read of the USB data buffer...

CVE-2026-80596 Input: ims-pcu - only expose sysfs attributes on control interface

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to use the driver core to instantiate device attributes via .devgroups in the usbdriver structure, the attributes started appearing ...

CVE-2026-60073 AutomationDirect Productivity Suite Out-of-bounds Read

An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory...

CVE-2026-60073 AutomationDirect Productivity Suite Out-of-bounds Read

An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory...

CVE-2026-60073

The CVE-2026-60073 entry concerns the AutomationDirect Productivity Suite. Affected component: Productivity Suite; vulnerability type: out-of-bounds read. Root cause: an out-of-bounds read allows a physical attacker to influence the length of data sent to a USB device, enabling potential system i...

AZL-77712 CVE-2026-23208 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Prevent excessive number of frames In this case, the user constructed the parameters with maxpacksize 40 for rate 22050 / pps 1000, and packsize0 22 packsize1 23. The buffer size for each data URB is maxpacksize...

EUVD-2025-201801

In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48625

CVE-2025-48625 is a local privilege-escalation issue affecting Android (noted in the Android 16 QPR2 bulletin). The vulnerability arises from race conditions in UsbDataAdvancedProtectionHook.java, allowing access to USB data when the screen is off, with no user interaction required. Impact is des...

CVE-2025-48625

In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48625

In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48625: Concurrent Execution using Shared Resource with Improper Synchronization

In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmfgetassocies Fix a slab-out-of-bounds read that occurs in kmemdup called from brcmfgetassocies. The bug could occur when associnfo-reqlen, data from a URB provided by a USB device, i...