PT-2026-64764

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.4.1 Description In the userspace dynamic-objects subsystem, the thread idx alloc function in kernel/userspace/userspace.c allocates a new thread permission index from the global thread idx map bitmap without holding...

PT-2026-64505

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM x86 module where fastpath userspace exits may occur before the vendor's exit handler runs. This prevents KVM from executing vendor-specific operations required...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

EUVD-2026-48642

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

USN-8604-1 linux-azure-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

ALSA-2026:45115 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O CVE-2025-40026 kernel: xfrm single-frag length not properly limited kernel: dm log: fix out-of-bounds write due to...

CVE-2026-10679

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-63934

A flaw was found in the Linux kernel's iioitg3200 gyroscope driver. An incorrect I2C Inter-Integrated Circuit read operation in the itg3200readallchannels function causes uninitialized stack memory to be exposed to userspace. This information leak could allow a local attacker to gain access to...

CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

EUVD-2026-46448

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-10679

The CVE-2026-10679 issue affects Zephyr’s DesignWare SPI driver (drivers/spi/spi_dw.c). The root cause is that the BAUDR clock divider was computed as info->clock_frequency / config->frequency without validating frequency, allowing a userspace thread with SPI access to pass frequency = 0, t...

SUSE CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

CVE-2026-53403

A flaw was found in the Linux kernel's framebuffer device fbdev subsystem. When a new modelist is set from userspace, the fbnewmodelist function fails to ensure that the current framebuffer mode remains valid within the updated list. This can lead to a null-pointer dereference if a console attemp...

PT-2026-62126

The DesignWare SPI driver drivers/spi/spi dw.c computed the SPI BAUDR clock divider as info-clock frequency / config-frequency without validating config-frequency. spi transceive is a Zephyr syscall and its verify handler drivers/spi/spi handlers.c copies the caller-supplied spi config from...

PT-2026-62122

The NXP LPUART serial driver drivers/serial/uart mcux lpuart.c, when CONFIG UART USE RUNTIME CONFIGURE is enabled, called LPUART Deinit at the start of mcux lpuart configure, which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards in mcux lpuart...

SUSE CVE-2026-63810

In the Linux kernel, the following vulnerability has been resolved: block: Avoid mounting the bdev pseudo-filesystem in userspace The bdev pseudo-filesystem is an internal kernel filesystem with which userspace should not interfere. Unregister it so that userspace cannot even attempt to mount it...

CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...