EUVD-2026-48769

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...

CVE-2026-64425

CVE-2026-64425 affects the Linux kernel io_uring/io-wq component. The vulnerability arises from where io_worker_handle_work() snapshots IO_WQ_BIT_EXIT and only later re-checks it inside the outer work loop, allowing linked work items to run after exit has begun if IO_WQ_BIT_EXIT is set post-start...

EUVD-2026-48966

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid net.ipv4.tcpreordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp-reordering field for new...

CVE-2026-64364

The CVE-2026-64364 entry describes a Linux kernel multitouch flaw where mt_io_flags is treated as a per-slot bitmap indexed by slot number, but the slot index can be as large as td->maxcontacts (up to 255) and not bounded by BITS_PER_LONG. This can cause set_bit/clear_bit to access beyond mt_i...

CVE-2026-64364 HID: multitouch: fix out-of-bounds bit access on mt_io_flags

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mtioflags mtioflags is a single unsigned long, but mtprocessslot, mtreleasependingpalms and mtreleasecontacts use it as a per-slot bitmap indexed by the slot number. That slot numb...

CVE-2026-64364

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mtioflags mtioflags is a single unsigned long, but mtprocessslot, mtreleasependingpalms and mtreleasecontacts use it as a per-slot bitmap indexed by the slot number. That slot numb...

CVE-2026-64361 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in checkandcorrectrequestedlength checkandcorrectrequestedlength compares off + len against nodesize using u32 arithmetic. When the caller passes a large len value e.g. from an underflowed subtractio...

EUVD-2026-49025

In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when r01.mhigh is saturated 0xFFFFFFFFFFFFFFFF and addition of lower bits overflows. The condition r01.mhigh product.mhigh doesn't handle the...

CVE-2026-64313 crypto: ecc - Fix carry overflow in vli multiplication

In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when r01.mhigh is saturated 0xFFFFFFFFFFFFFFFF and addition of lower bits overflows. The condition r01.mhigh product.mhigh doesn't handle the...

CVE-2026-64306

In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTRDRBG drbgctrgenerate sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it...

CVE-2026-64293 iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

CVE-2026-64293

CVE-2026-64293 affects the Linux kernel iommufd component. A 32-bit bound-check in iommufd_veventq_fops_read() uses sizeof(hdr) (size of the pointer) instead of sizeof(*hdr), causing under-count of the vEVENT header and potentially writing past the user buffer during header+data payload copy. Mul...

CVE-2026-64267 fuse: avoid 32-bit prune notification count wrap

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

CVE-2026-64267

CVE-2026-64267 affects the Linux kernel’s FUSE (Filesystem in Userspace) path. The issue is an integer overflow in handling FUSE_NOTIFY_PRUNE messages on 32-bit architectures, where the product of outarg.count and sizeof(u64) can wrap during payload length validation, potentially causing the kern...

CVE-2026-64267

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

CVE-2026-64256 xfs: don't wrap around quota ids in dqiterate

In the Linux kernel, the following vulnerability has been resolved: xfs: don't wrap around quota ids in dqiterate LOLLM noticed that qid is an unsigned 32-bit variable. If it happens to be set to XFSDQIDMAX due to a filesystem that actually has a dquot for IDMAX, then this addition will truncate ...

JLSEC-2026-787 Integer overflow in gawk's `do_sub()` can cause buffer overflow and denial of service

Integer overflow vulnerability has been found in "builtin.c" program file of gawk dosub routine. This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below...

PT-2026-64527

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CTR DRBG component where the drbg ctr generate function may incorrectly return a success status despite failing, which results in the output buffer remaining...

Linux Distros Unpatched Vulnerability : CVE-2026-64467

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, bu...

Linux Distros Unpatched Vulnerability : CVE-2026-64283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: guestmemfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guestmemfd file, treat the offset and size as unsigned values ...