EUVD-2026-45670

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data and leaking it to user space...

CVE-2026-63895 usb: gadget: f_fs: copy only received bytes on short ep0 read

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63895

Summary: CVE-2026-63895 affects the Linux kernel's FunctionFS (f_fs) gadget driver. The bug occurs in ffs_ep0_read(), where a control-OUT request’s data buffer is allocated with kmalloc(len) and then fully copied to userspace via copy_to_user(buf, data, len) even when only ret bytes were actually...

CVE-2026-63895 usb: gadget: f_fs: copy only received bytes on short ep0 read

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

PT-2026-61217

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB serial keyspan driver where a sanity check is missing for the size of usa49wg indat transfers. This omission could lead to the parsing of stale or uninitialize...

PT-2026-61278

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB Type-C DisplayPort alternate mode implementation where the kernel fails to validate the count before reading a Status Update VDO Vendor Defined Object. A...

PT-2026-61223

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the omap2430 probe function. The of node putnp function is called prematurely before the final access to the np variable, which can lead to a...

PT-2026-61274

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Memory corruption occurs in the USB serial safe mode when a malicious device reports a bulk-out buffer size smaller than eight bytes. This can lead to user-controlled slab corruption,...

PT-2026-61215

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the mct u232 USB serial driver. The driver overrides the maximum transfer size for a specific device that accepts 16 byte packets for its 32 byte...

PT-2026-61276

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb typec tcpm/tcpci maxim component where the system fails to validate the header NDO against RX BYTE CNT. A malicious or malfunctioning port can send a CRC-valid...

PT-2026-61245

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Memory corruption occurs in the USB serial omninet driver when a malicious device reports a smaller endpoint max packet size than expected. This can lead to user-controlled slab...

PT-2026-61218

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Memory corruption occurs in the digi acceleport USB serial driver due to missing sanity checks for bulk-out buffer sizes. A malicious device reporting smaller buffers than expected can...

PT-2026-61216

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the mxuport serial USB driver. A malicious device can trigger user-controlled slab corruption—a type of memory error affecting the slab allocator, whi...

PT-2026-61137

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the rtw88 USB driver when the rtw usb write port function fails to submit a USB Request Block URB, which can happen during device disconnects or memory pressure...

PT-2026-61244

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use after free issue exists in the debug code of the dwc2 USB driver. The problem occurs because the urb object is dereferenced after the usb hcd giveback urb function is called, which...

kernel: usbip: validate number_of_packets in usbip_pack_ret_submit()

A flaw was found in the Linux kernel's USB/IP subsystem. A malicious USB/IP server could exploit a vulnerability in the usbippackretsubmit function by sending a specially crafted RETSUBMIT response. This response, containing an oversized numberofpackets value, could cause a heap out-of-bounds...

SUSE-SU-2026:22914-1 Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-34.1 fixes various security issues: The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...

CVE-2026-60073

An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory...

EUVD-2026-45036

An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory...

SUSE-SU-2026:22867-1 Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...