kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

A flaw was found in the Kernel-based Virtual Machine KVM for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 L1 intercepts during the completion of userspace I/O emulation for a Level 2 L2 instruction. If the L1 or host userspace modifies I/O interception settings during thi...

USN-8604-1 linux-azure-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

ALSA-2026:45115 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O CVE-2025-40026 kernel: xfrm single-frag length not properly limited kernel: dm log: fix out-of-bounds write due to...

CVE-2026-10679

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-63934

A flaw was found in the Linux kernel's iioitg3200 gyroscope driver. An incorrect I2C Inter-Integrated Circuit read operation in the itg3200readallchannels function causes uninitialized stack memory to be exposed to userspace. This information leak could allow a local attacker to gain access to...

CVE-2026-10679

The CVE-2026-10679 issue affects Zephyr’s DesignWare SPI driver (drivers/spi/spi_dw.c). The root cause is that the BAUDR clock divider was computed as info->clock_frequency / config->frequency without validating frequency, allowing a userspace thread with SPI access to pass frequency = 0, t...

CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

EUVD-2026-46448

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-10677 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool

The CONFIGUSERSPACE syscall verifier zvrfykpoll in kernel/poll.c allocates a kernel-side copy of the user-supplied kpollevent via zthreadmalloc and then validates each event's object handle. Before this fix, validation used KOOPSKSYSCALLOBJ... inline inside the loop, which kills the calling threa...

SUSE CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

CVE-2026-53403

A flaw was found in the Linux kernel's framebuffer device fbdev subsystem. When a new modelist is set from userspace, the fbnewmodelist function fails to ensure that the current framebuffer mode remains valid within the updated list. This can lead to a null-pointer dereference if a console attemp...

PT-2026-62126

The DesignWare SPI driver drivers/spi/spi dw.c computed the SPI BAUDR clock divider as info-clock frequency / config-frequency without validating config-frequency. spi transceive is a Zephyr syscall and its verify handler drivers/spi/spi handlers.c copies the caller-supplied spi config from...

PT-2026-62122

The NXP LPUART serial driver drivers/serial/uart mcux lpuart.c, when CONFIG UART USE RUNTIME CONFIGURE is enabled, called LPUART Deinit at the start of mcux lpuart configure, which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards in mcux lpuart...

CVE-2026-10679: Divide By Zero

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

block: Avoid mounting the bdev pseudo-filesystem in userspace

...

SUSE CVE-2026-63810

In the Linux kernel, the following vulnerability has been resolved: block: Avoid mounting the bdev pseudo-filesystem in userspace The bdev pseudo-filesystem is an internal kernel filesystem with which userspace should not interfere. Unregister it so that userspace cannot even attempt to mount it...

CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

CVE-2026-64083

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject short block-read responses in the GPIO accessors adm1266gpioget and adm1266gpiogetmultiple both compose the pin-status word as pinsstatus = readbuf0 + readbuf1 8; right after i2csmbusreadblockdata,...