EUVD-2026-48864

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

CVE-2026-64520 firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

EUVD-2026-48861

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

CVE-2026-64517 drm/xe/gsc: Fix double-free of managed BO in error path

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

CVE-2026-64516

The CVE-2026-64516 issue affects the Linux kernel’s DRM/AMDGPU VCE1 path. Root cause: the VCPU BO size did not account for the actual firmware offset, risking out-of-bounds access; fixes include subtracting the firmware offset from the firmware size, aligning stack and data offsets to the 32K TLB...

CVE-2026-64517

The CVE-2026-64517 entry describes a Linux kernel issue in the DRM/xe/gsc path where the error handling in xe_gsc_init_post_hwconfig() explicitly frees a managed BO with xe_bo_unpin_map_no_vm(), causing a double-free because a devm cleanup action is already registered. The fix is to remove the ex...

CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

CVE-2026-64504

Summary: CVE-2026-64504 affects the Linux kernel IIO driver for the BMC150 accelerometer. The flush path in __bmc150_accel_fifo_flush() could transfer up to count samples from the device FIFO, with count derived from FIFO_STATUS masked to 7 bits (0–127). The on-stack buffer can overflow if a devi...

CVE-2026-64499

CVE-2026-64499 affects the Linux kernel driver for the TI ADS1119 ADC under the IIO subsystem. The root cause is a PM runtime reference leak in iio: adc: ti-ads1119 during buffer preenable: ads1119_triggered_buffer_preenable() resumes the device via pm_runtime_resume_and_get() before the conversi...

EUVD-2026-48843

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119triggeredbufferpreenable resumes the device with pmruntimeresumeandget before starting a conversion. If i2csmbuswritebyte fails, the function returns the erro...

CVE-2026-64499

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119triggeredbufferpreenable resumes the device with pmruntimeresumeandget before starting a conversion. If i2csmbuswritebyte fails, the function returns the erro...

CVE-2026-64499 iio: adc: ti-ads1119: fix PM reference leak in buffer preenable

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119triggeredbufferpreenable resumes the device with pmruntimeresumeandget before starting a conversion. If i2csmbuswritebyte fails, the function returns the erro...

CVE-2026-64498 iio: buffer: hw-consumer: free scan_mask on buffer release

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scanmask on buffer release The scanmask lifetime changed in commit 9a2e1233d38c "iio: buffer: hw-consumer: remove redundant scanmask flexible array". Before that change, the scan mask storage was...

EUVD-2026-48842

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scanmask on buffer release The scanmask lifetime changed in commit 9a2e1233d38c "iio: buffer: hw-consumer: remove redundant scanmask flexible array". Before that change, the scan mask storage was...

CVE-2026-64498

The CVE-2026-64498 issue affects the Linux kernel IIO subsystem (iio: buffer: hw-consumer). The root cause was a lifetime change for scan_mask: it moved to a separate bitmap allocation (buffer.scan_mask) but iio_hw_buf_release() remained unchanged, risking improper cleanup. The fix ensures the sc...

CVE-2026-64498

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scanmask on buffer release The scanmask lifetime changed in commit 9a2e1233d38c "iio: buffer: hw-consumer: remove redundant scanmask flexible array". Before that change, the scan mask storage was...

CVE-2026-64495

CVE-2026-64495 affects the Linux kernel iio:gyro/bmg160 driver. The bug occurs in bmg160_get_filter()/bmg160_set_filter() when a bandwidth/filter value read from the chip or provided by userspace does not have a matching entry in the bmg160_samp_freq_table[]. If no match is found, the code reads ...

CVE-2026-64464

Consolidated details show CVE-2026-64464 affects the Linux kernel xhci sideband path: xhci_ring_to_sgtable() allocates a temporary pages array used to build an sg_table via sg_alloc_table_from_pages(). On success, the temporary array isn’t freed, causing a leak each time a sideband client uses an...

CVE-2026-64450 tipc: fix out-of-bounds read in broadcast Gap ACK blocks

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...

CVE-2026-64449

CVE-2026-64449 relates to the Linux kernel staging/vme_user code. The vulnerability arises because the SLAVE-path helpers buffer_to_user() and buffer_from_user() copy count bytes using an unsafe offset (*ppos) into a fixed-size kern_buf (128 KiB), without bounding *ppos + count against size_buf. ...