CVE-2026-64267

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

CVE-2026-64267

Summary: CVE-2026-64267 affects the Linux kernel's FUSE prune notification handling. On 32-bit systems, FUSE_NOTIFY_PRUNE could misvalidate the payload length, allowing a daemon-controlled count to wrap and trigger a copy loop that may read nodeids not present in the userspace buffer (e.g., in QE...

CVE-2026-63881 drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...

PT-2026-61198

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the kfd debugger within the drm/amdkfd component. The get queue ids function calculates array size by multiplying num queues by sizeofuint32 t, which can le...

CVE-2024-38587

In the Linux kernel, the following vulnerability has been resolved: speakup: Fix sizeof vs ARRAYSIZE bug The "buf" pointer is an array of u16 values. This code should be using ARRAYSIZE which is 256 instead of sizeof which is 512, otherwise it can the still got out of bounds. Mitigation Mitigatio...

CVE-2024-38587 speakup: Fix sizeof() vs ARRAY_SIZE() bug

In the Linux kernel, the following vulnerability has been resolved: speakup: Fix sizeof vs ARRAYSIZE bug The "buf" pointer is an array of u16 values. This code should be using ARRAYSIZE which is 256 instead of sizeof which is 512, otherwise it can the still got out of bounds...