DEBIAN-CVE-2026-89602

In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing zerofsgbufnrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers...

CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

AZL-100199 CVE-2026-89471 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-89471

CVE-2026-89471 affects the Linux kernel cros_usbpd-charger driver (power supply subsystem). The driver uses an EC-reported num_charger_ports value as a loop bound for an 8-entry fixed-size array (ports[EC_USB_PD_MAX_PORTS]) without validating it against the array size. A malicious or malfunctioni...

CVE-2026-89436

In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpipccretrievebiosdata rejects SINF packages only when pcc-numsifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...

cve-2022-49186-research

CVE-2022-49186: Linux Kernel Privilege Escalation Research Overview Security research and proof-of-concept exploit for CVE-2022-49186, a Linux kernel vulnerability in the Visconti clock driver that enables local privilege escalation through array overflow. Vulnerability Details Type : Array...

AZL-99483 CVE-2026-80795 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...

CVE-2026-80723

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

CVE-2026-80627

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maarreswalk maarreswalk uses wi-numcfg as the index into the fixed-size wi-cfg array, but checks whether the array is full only after it has filled the selected entry. If walksystemramrange...

CVE-2026-80627

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maarreswalk maarreswalk uses wi-numcfg as the index into the fixed-size wi-cfg array, but checks whether the array is full only after it has filled the selected entry. If walksystemramrange...

CVE-2026-80723 of: reserved_mem: prevent OOB when too many dynamic regions are defined

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

EUVD-2026-67458

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

EUVD-2026-67503

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maarreswalk maarreswalk uses wi-numcfg as the index into the fixed-size wi-cfg array, but checks whether the array is full only after it has filled the selected entry. If walksystemramrange...

CVE-2026-80526

A flaw was found in the Linux kernel's ASoC Audio System on Chip tas2562 driver. The tas2562volumecontrolput function lacks proper validation of control values provided by userspace. A local attacker could exploit this by supplying a specially crafted value, leading to an array overflow and an...

EUVD-2026-66592

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

CVE-2026-80526

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

UBUNTU-CVE-2026-80526

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

CVE-2026-80526 ASoC: tas2562: Validate values for volume writes

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

CVE-2026-80526

CVE-2026-80526 affects the Linux kernel's ASoC tas2562 driver . The function tas2562_volume_control_put() fails to validate the control value written by userspace before using it as an index into a fixed-size array , allowing an array overflow . The out-of-bounds value is then written directly to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: A potential array overflow has been fixed in bpftrampolinegetprogs. The cnt value in the cnt = BPFMAXTRAMPPROGS check does not include BPFTRAMPMODIFYRETURN bpf programs. As a result, the number of BPFTRAMPMODIFYRETURN bpf...