1930865 matches found
CVE-2026-80796 nfc: nci: add data_len bound checks to activation parameter extractors
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add datalen bound checks to activation parameter extractors nciextractactivationparamsisodep and nciextractactivationparamsnfcdep read an inner length byte from the NCI RFINTFACTIVATEDNTF payload and use it to memcpy in...
CVE-2026-80796
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add datalen bound checks to activation parameter extractors nciextractactivationparamsisodep and nciextractactivationparamsnfcdep read an inner length byte from the NCI RFINTFACTIVATEDNTF payload and use it to memcpy in...
EUVD-2026-71439
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add datalen bound checks to activation parameter extractors nciextractactivationparamsisodep and nciextractactivationparamsnfcdep read an inner length byte from the NCI RFINTFACTIVATEDNTF payload and use it to memcpy in...
CVE-2026-80795 nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...
CVE-2026-80795
CVE-2026-80795 is an out-of-bounds write in the Linux kernel's NFC NCI driver . The function nci_target_auto_activated() appends entries to the fixed-size array ndev->targets[NCI_MAX_DISCOVERED_TARGETS] without first checking whether the array is full. Because n_targets is only reset by nci_cl...
CVE-2026-80795
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...
CVE-2026-80795 nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...
EUVD-2026-71438
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...
EUVD-2026-71437
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers ncirfdiscoverntfpacket and ncirfintfactivatedntfpacket each parse a notification into an on-stack struct ncirfdiscoverntf / ncirfintfactivatedntf that is not...
CVE-2026-80794 nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers ncirfdiscoverntfpacket and ncirfintfactivatedntfpacket each parse a notification into an on-stack struct ncirfdiscoverntf / ncirfintfactivatedntf that is not...
CVE-2026-80794
This Linux kernel vulnerability affects the NFC NCI subsystem, specifically the nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet() handlers. The root cause is that on-stack notification structs are not zero-initialised before parsing. When a notification reports a zero rf_tech_sp...
CVE-2026-80794 nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers ncirfdiscoverntfpacket and ncirfintfactivatedntfpacket each parse a notification into an on-stack struct ncirfdiscoverntf / ncirfintfactivatedntf that is not...
CVE-2026-80794
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers ncirfdiscoverntfpacket and ncirfintfactivatedntfpacket each parse a notification into an on-stack struct ncirfdiscoverntf / ncirfintfactivatedntf that is not...
CVE-2026-80787
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: fix use-after-free in nvmetpciepfexeciodwork nvmetpciepfexeciodwork submits an I/O command with req-execute and then waits for the command to complete and transfers the data back to the host. This wait is not need...
CVE-2026-80787 nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: fix use-after-free in nvmetpciepfexeciodwork nvmetpciepfexeciodwork submits an I/O command with req-execute and then waits for the command to complete and transfers the data back to the host. This wait is not need...
EUVD-2026-71430
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: fix use-after-free in nvmetpciepfexeciodwork nvmetpciepfexeciodwork submits an I/O command with req-execute and then waits for the command to complete and transfers the data back to the host. This wait is not need...
CVE-2026-80787
CVE-2026-80787 is a use-after-free in the Linux kernel's nvmet_pci_epf module (NVMe Target over PCI Endpoint Function). After submitting an I/O command via req->execute(), the function nvmet_pci_epf_exec_iod_work() reads iod->data_len and iod->dma_dir to decide whether to wait for comple...
CVE-2026-80787 nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: fix use-after-free in nvmetpciepfexeciodwork nvmetpciepfexeciodwork submits an I/O command with req-execute and then waits for the command to complete and transfers the data back to the host. This wait is not need...
CVE-2026-80782
CVE-2026-80782 is a use-after-free vulnerability in the Linux kernel's HID magicmouse driver (used by Apple USB Magic Mouse 2 / Magic Trackpad 2). The root cause is that magicmouse_input_mapping() caches the input_dev pointer in msc->input during report descriptor parsing. On the hidinput_conn...
CVE-2026-80782 HID: magicmouse: do not keep a stale msc->input if no input is claimed
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc-input if no input is claimed magicmouseinputmapping caches the first hidinput's inputdev in msc-input while the report descriptor is parsed, and the rest of the driver treats a non-NULL...