CVE-2026-68372

A flaw was found in the Linux kernel's USB Type-C port handling. A local user, by unplugging a Thunderbolt dock, can trigger a race condition during the device teardown process. This can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been...

CVE-2026-68373

A flaw was found in the Linux kernel's at76c50x-usb Wi-Fi driver. A remote attacker could exploit a length underflow vulnerability in the at76guessfreq function by sending a specially crafted Wi-Fi frame. This can cause an out-of-bounds read during the scanning process, potentially leading to a...

CVE-2026-68194

A flaw was found in the Linux kernel's mt76 WiFi driver. When the driver processes a TXRXNOTIFY event on non-Memory-Mapped I/O MMIO buses, such as USB or SDIO, it attempts to call a null function pointer. This can lead to a kernel NULL pointer dereference, causing a system crash and resulting in ...

Windows USB Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-68370

A flaw was found in the Linux kernel's USB gadget dummy Host Controller Driver HCD. A race condition can occur when a shared USB request object fiforeq is prematurely reused before its completion callback has finished. This can lead to the overwriting of the callback pointer, causing a general...

CVE-2026-68374

A flaw was found in the Linux kernel's USB core subsystem. A missing synchronization mechanism in the bosdescriptorsread function allows for a use-after-free vulnerability. This occurs when the udev-bos object is accessed while it is simultaneously being freed, potentially leading to a system cra...

CVE-2026-68227

A flaw was found in the cx231xx media driver within the Linux kernel. This vulnerability arises from incorrect management of device-managed resources, where their lifetime is tied to the parent Universal Serial Bus USB device instead of the USB interface. This can lead to memory leaks when driver...

CVE-2026-68344

A flaw was found in the Linux kernel's USB ATM Asynchronous Transfer Mode driver, specifically in the ueagle-atm module. A local attacker with physical access to a crafted USB device could exploit this vulnerability. By presenting inconsistent USB descriptors that confuse the driver's probe and...

Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and execute privileged installation components that researchers chained to SYSTEM access on a fully updated Windows 11 machine. The same PnP path can be triggered over Remote Desktop without physical...

usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback

...

wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

...

Bluetooth: btusb: validate Realtek vendor event length

...

usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

...

usb: gadget: printer: fix infinite loop in printer_read()

...

usb: gadget: function: rndis: add length check to response query

...

usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer

...

USB: serial: io_edgeport: cap received transmit credits

...

CVE-2026-12051

The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...

CVE-2026-12052

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

CVE-2026-12052 Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...