CVE-2026-68090 debugobjects: Plug race against a concurrent OOM disable

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stubtimer+0xa/0x20 stubtimer is installed as timer callback function in hrtimerfixupassertinit, whic...

CVE-2026-68090 debugobjects: Plug race against a concurrent OOM disable

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stubtimer+0xa/0x20 stubtimer is installed as timer callback function in hrtimerfixupassertinit, whic...

EUVD-2026-55271

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stubtimer+0xa/0x20 stubtimer is installed as timer callback function in hrtimerfixupassertinit, whic...

CVE-2026-68090

The CVE-2026-68090 issue affects the Linux kernel debugobjects in the debug_object_assert_init() and debug_object_activate() paths, where a concurrent out-of-memory (OOM) scenario disables debug objects and frees shadow objects. As a result, a timer callback (stub_timer) may be invoked for an obj...

CVE-2026-68090

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stubtimer+0xa/0x20 stubtimer is installed as timer callback function in hrtimerfixupassertinit, whic...

EUVD-2026-55270

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If ppos is non-zero then simplewritetobuffer will not initialize the start of buf. Non zero values for ppos aren't going to work anyway. Test for them at the start of the function and...

CVE-2026-68089

The CVE-2026-68089 entry concerns the Linux kernel iio core debugfs handling. It documents a vulnerability where uninitialized data could be exposed when *ppos is non-zero, because simple_write_to_buffer() would not initialize buf[]. The fix adds a test for non-zero *ppos at the start of the affe...

CVE-2026-68089

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If ppos is non-zero then simplewritetobuffer will not initialize the start of buf. Non zero values for ppos aren't going to work anyway. Test for them at the start of the function and...

CVE-2026-68089 iio: core: fix uninitialized data in debugfs

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If ppos is non-zero then simplewritetobuffer will not initialize the start of buf. Non zero values for ppos aren't going to work anyway. Test for them at the start of the function and...

CVE-2026-68089 iio: core: fix uninitialized data in debugfs

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If ppos is non-zero then simplewritetobuffer will not initialize the start of buf. Non zero values for ppos aren't going to work anyway. Test for them at the start of the function and...

EUVD-2026-55269

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088 usb: gadget: function: rndis: add length check to response query

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088 usb: gadget: function: rndis: add length check to response query

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088

The CVE describes a Linux kernel usb gadget rndis vulnerability where the rndis_query_response() path now validates BufLength and BufOffset (introducing a length check) to match the handling in rndis_set_response(). The vulnerability affects the rndis function of the USB gadget subsystem in the L...

CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-72582

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...

DEBIAN-CVE-2026-71392

GNU Emacs for Android is vulnerable to an integer overflow in the sfntreadcmapformat12 function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can...

CVE-2026-71392

GNU Emacs for Android is vulnerable to an integer overflow in the sfntreadcmapformat12 function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can...

CVE-2026-71393

GNU Emacs for Android is vulnerable to an integer overflow in sfntreadnametable in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in a...

DEBIAN-CVE-2026-71393

GNU Emacs for Android is vulnerable to an integer overflow in sfntreadnametable in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in a...