CVE-2026-74456

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...

CVE-2026-74455

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74455

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74458

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...

CVE-2026-74500

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status sndrmedigifacereadstatus reads a four-word status block from the device into an uninitialised on-stack le32 buf4 and, whenever the vendor control-IN transfer does not...

CVE-2026-74505

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fix UAF at error handling during probe Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot a pending URB before freeing the resources, which may lead to a...

UBUNTU-CVE-2026-74498

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fillmax is set When a USB audio endpoint requests full packet transfers via the fillmax descriptor flag, dataepsetparams promotes ep-curpacksize to ep-maxpacksize. However,...

UBUNTU-CVE-2026-74500

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status sndrmedigifacereadstatus reads a four-word status block from the device into an uninitialised on-stack le32 buf4 and, whenever the vendor control-IN transfer does not...

UBUNTU-CVE-2026-74501

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata, but it never installs an...

CVE-2026-74501

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata, but it never installs an...

UBUNTU-CVE-2026-74458

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...

UBUNTU-CVE-2026-74460

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

UBUNTU-CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

UBUNTU-CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

UBUNTU-CVE-2026-74455

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74498

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fillmax is set When a USB audio endpoint requests full packet transfers via the fillmax descriptor flag, dataepsetparams promotes ep-curpacksize to ep-maxpacksize. However,...

CVE-2026-74499

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

CVE-2026-74459

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: es58xreadbulkcallback: fix RX buffer leak on URB resubmit failure es58xreadbulkcallback resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handl...

CVE-2026-74460

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...