EUVD-2026-45614

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possible buffer overflow In fs210xeffectsceneinfo, a string was copied like this: strscpyDST, SRC, strlenSRC + 1; A buffer overflow would happen if strlenSRC = sizeofDST. Actually, strscpy must be used...

CVE-2026-64041

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possible buffer overflow In fs210xeffectsceneinfo, a string was copied like this: strscpyDST, SRC, strlenSRC + 1; A buffer overflow would happen if strlenSRC = sizeofDST. Actually, strscpy must be used...

CVE-2026-64041 ASoC: codecs: fs210x: fix possible buffer overflow

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possible buffer overflow In fs210xeffectsceneinfo, a string was copied like this: strscpyDST, SRC, strlenSRC + 1; A buffer overflow would happen if strlenSRC = sizeofDST. Actually, strscpy must be used...

CVE-2026-64041 ASoC: codecs: fs210x: fix possible buffer overflow

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possible buffer overflow In fs210xeffectsceneinfo, a string was copied like this: strscpyDST, SRC, strlenSRC + 1; A buffer overflow would happen if strlenSRC = sizeofDST. Actually, strscpy must be used...

CVE-2026-64041

The issue CVE-2026-64041 affects the Linux kernel ASoC fs210x codec driver. In fs210x_effect_scene_info(), a string is copied with strscpy using strlen(SRC) + 1 (DST) instead of a bound-limited size, enabling a potential buffer overflow when strlen(SRC) >= sizeof(DST). The fix uses correct bou...

CVE-2026-64035

The CVE-2026-64035 entry concerns the Linux kernel igc driver: igc_fpe_init_smd_frame() failed to set the tx buffer type for SMD frames, causing igc_tx_buffer entries to retain a stale XDP/XSK type. This can lead TX completion to follow an incorrect cleanup path. The fix is to set the buffer type...

EUVD-2026-45608

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...

CVE-2026-64035 igc: set tx buffer type for SMD frames

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...

CVE-2026-64035

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...

CVE-2026-64035 igc: set tx buffer type for SMD frames

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...

CVE-2026-64034

The CVE concerns the Linux kernel net: mana TOCTOU in hwc_msg_id handling. In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arit...

CVE-2026-64034 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...

CVE-2026-64034

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...

CVE-2026-64034 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...

CVE-2026-64026

CVE-2026-64026 affects the Linux kernel’s rxrpc path. The issue was addressed by removing in-place decryption in splice()-transmitted DATA packets and instead unconditionally copying the packet content into a dedicated bounce buffer, which is decrypted there and then copied to the final destinati...

CVE-2026-64026

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

CVE-2026-64026 rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

EUVD-2026-45599

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

CVE-2026-64026 rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

CVE-2026-64024

CVE-2026-64024 concerns a Linux kernel issue where a per-CPU tcp_tw_isn leak could enable ISN prediction. The root cause was that TIME_WAIT-derived ISNs were stored in a per-CPU variable and could be consumed by a subsequent SYN if a packet was dropped along several paths (e.g., min_ttl/min_hop, ...