CVE-2026-64017

In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blkmqfreeplugrqs, freeing the cachedrqs. This...

CVE-2026-64017 blk-mq: pop cached request if it is usable

In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blkmqfreeplugrqs, freeing the cachedrqs. This...

CVE-2026-64017

The CVE-2026-64017 issue affects the Linux kernel’s blk-mq path. A use-after-free could occur when submitting a bio to blk-mq if a cached request is peeked and then the code path decides to sleep before popping it; a plug flush would free cached_rqs via blk_mq_free_plug_rqs. The fix pops the cach...

CVE-2026-64014

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO datalen/xlen to URB buffer size nexioreaddata pulls datalen and xlen from a packed be16 header in the device's interrupt packet and then walks packet-data0..xlen and packet-dataxlen..datalen...

CVE-2026-64014 Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO datalen/xlen to URB buffer size nexioreaddata pulls datalen and xlen from a packed be16 header in the device's interrupt packet and then walks packet-data0..xlen and packet-dataxlen..datalen...

CVE-2026-63996 ethtool: cmis: require exact CDB reply length

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

EUVD-2026-45712

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible si...

CVE-2026-63939

CVE-2026-63939 (Linux kernel, KVM SEV): The issue concerns computation of the maximum length for the in-GHCB scratch area in the GHCB shared buffer. Previously, KVM assumed the input length (@len) always represented the maximum required size for MMIO emulation; for PSC requests, @len is only the ...

CVE-2026-63938

The vulnerability CVE-2026-63938 affects the Linux kernel KVM SEV path, specifically PSC processing. The issue arises when validating PSC requests: the PSC buffer must be checked against the effective size of the scratch area, which may be smaller than the maximum if a guest supplies a pointer no...

CVE-2026-63939 KVM: SEV: Compute the correct max length of the in-GHCB scratch area

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible si...

EUVD-2026-45700

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usbhcdgivebackurb so save the urb-status ahead of time...

CVE-2026-63927 usb: dwc2: Fix use after free in debug code

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usbhcdgivebackurb so save the urb-status ahead of time...

CVE-2026-63909

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smbcheckpermdacl ACE-walk loops Commit d07b26f39246 "ksmbd: require minimum ACE size in smbcheckpermdacl" introduced a transposed bounds check: if offsetofstruct smbace, sid + acessize size offset 2...

CVE-2026-63904 usb: usbtmc: check URB actual_length for interrupt-IN notifications

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the...

CVE-2026-63904

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the...

CVE-2026-63902

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

CVE-2026-63813

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptodate folio from the page cache in movedatablock" This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. The kernel panics are keeping to be reported especially when the f2fs partition get almos...

CVE-2026-63802

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in blkcgrstatflush When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's blkcgrstatflush removes another blkg's iostat entries via...

CVE-2026-63820

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing read bio submission on large folio error f2fsreaddatalargefolio can keep a read bio across multiple readahead folios. If a later folio hits an error before any of its blocks are added to the bio, folioinbio is...

EUVD-2026-45487

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...