CVE-2026-64403

CVE-2026-64403 covers a Linux kernel Bluetooth L2CAP bug. l2cap_get_conf_opt() derives the option length from opt->len and dereferences opt->val before ensuring the buffer contains opt->len bytes, allowing an out-of-bounds read (up to 4 bytes) before a check. Callers detect malformed opt...

CVE-2026-64378 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the following BUGON is occasionally triggered: ================================================================== VFS: Busy inodes after...

EUVD-2026-48910

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacomwacqueueinsert wacomwacqueueinsert calls kfifoskip in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifoskip reads stale data lef...

EUVD-2026-48875

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64330

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdmconsumemodes In svdmconsumemodes, the SVID value is read from pmdata-svids using pmdata-svidindex as an array index without bounds validation: paltmode-svid =...

CVE-2026-64306 crypto: drbg - Fix returning success on failure in CTR_DRBG

In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTRDRBG drbgctrgenerate sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it...

CVE-2026-64293 iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

EUVD-2026-49005

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

CVE-2026-64293

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

CVE-2026-64271

In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet twinterrupt accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received and t...

Chromium: CVE-2026-16804 Use after free in Input

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

SUSE-SU-2026:3248-1 Security update for the Linux Kernel RT (Live Patch 15 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.54 fixes various security issues: The following security issues were fixed: - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. - CVE-2026-53366: ipv4: account for fraggap on the paged...

Linux Distros Unpatched Vulnerability : CVE-2026-64483

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against t...

Linux Distros Unpatched Vulnerability : CVE-2026-64470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe...

PT-2026-64584

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending key up timer in remove appleir remove runs hid hw stop before timer delete sync. hid hw stop synchronously unregisters the HID input device via hid disconnect - hidinput disconnect - input...

Linux Distros Unpatched Vulnerability : CVE-2026-64366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: wacom: fix slab-out-of-bounds write in wacomwacqueueinsert wacomwacqueueinsert calls kfifoskip in a loop when the kfifo doesn't have enough space for the...

Linux Distros Unpatched Vulnerability : CVE-2026-64270

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: mms114 - reject an oversized device packet size mms114interrupt reads a packet of touch data from the device into a fixed-size on-stack buffer struct...

Linux Distros Unpatched Vulnerability : CVE-2026-64266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse: re-lock request before returning from fusereffolio fusereffolio unlocks the request but does not re-lock it before returning. fusechanabort can end the...

Linux Distros Unpatched Vulnerability : CVE-2026-26199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the si...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21433-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21433-1 advisory. Changes in hauler: - update embedded dependency x/net to 0.57 to fix CVE-2026-39821 bsc1266602 Tenable has extracted the preceding description block...