CVE-2026-64296

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-64296 exfat: bound uniname advance in exfat_find_dir_entry()

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-64293 iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

CVE-2026-64293

CVE-2026-64293 affects the Linux kernel iommufd component. A 32-bit bound-check in iommufd_veventq_fops_read() uses sizeof(hdr) (size of the pointer) instead of sizeof(*hdr), causing under-count of the vEVENT header and potentially writing past the user buffer during header+data payload copy. Mul...

CVE-2026-64293 iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

CVE-2026-64291

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventqdepth upper bound iommufdveventqalloc accepts any !0 veventqdepth from userspace, with an upper bound at U32MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust...

CVE-2026-64291 iommufd: Set veventq_depth upper bound

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventqdepth upper bound iommufdveventqalloc accepts any !0 veventqdepth from userspace, with an upper bound at U32MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust...

CVE-2026-64289

CVE-2026-64289 affects the Linux kernel in the iommufd path, where iommufd_hwpt_invalidate() accepts user-controlled entry_num and entry_len. The description and connected details specify that entry_len can exceed the kernel struct size and trigger zero-check scans over excess bytes, while large ...

EUVD-2026-49001

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entrynum and entrylen iommufdhwptinvalidate takes a user-controlled entrynum and entrylen, each bounded only by U32MAX. An entrylen beyond the kernel's struct size makes the copy...

CVE-2026-64289 iommufd: Set upper bounds on cache invalidation entry_num and entry_len

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entrynum and entrylen iommufdhwptinvalidate takes a user-controlled entrynum and entrylen, each bounded only by U32MAX. An entrylen beyond the kernel's struct size makes the copy...

CVE-2026-64289

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entrynum and entrylen iommufdhwptinvalidate takes a user-controlled entrynum and entrylen, each bounded only by U32MAX. An entrylen beyond the kernel's struct size makes the copy...

CVE-2026-64287 KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound usedlrs when flushing the pKVM hyp vCPU flushhypvcpu copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use usedlrs as their loop bound and expect it to...

EUVD-2026-48980

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp places each inbound Read Response DDP segment at sge-laddr + wqe-processed and then accumulates wqe-processed, but i...

CVE-2026-64269 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

CVE-2026-64269 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

CVE-2026-64268 RDMA/siw: bound Read Response placement to the RREAD length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp places each inbound Read Response DDP segment at sge-laddr + wqe-processed and then accumulates wqe-processed, but i...

PT-2026-64489

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA siw driver where the siw proc rresp function fails to check the running total of inbound Read Response DDP segments against the sink buffer length on...

PT-2026-64704

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA firewire isight component where the isight packet function fails to properly validate the frame count from a device iso packet. The function checks the count...

PT-2026-64490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/rtrs-srv component where the rdma write sg function fails to validate the length of the RDMA-Write operation against the maximum chunk size. When responding t...

PT-2026-64755

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/hyperv component where a SYNTHVID RESOLUTION RESPONSE containing a resolution count greater than 64 causes the parse loop to read beyond the boundaries of the...