CVE-2026-63956

A flaw was found in the Linux kernel's cypressm8 USB serial driver. A malicious Universal Serial Bus USB device could report a packet size smaller than eight bytes for the interrupt-out endpoint. This can lead to memory corruption, specifically user-controlled slab corruption or a NULL-pointer...

CVE-2026-46983

Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications component: RIB Kernal. The supported version that is affected is 16.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Integration...

CVE-2026-46982

Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications component: RIB Kernal. The supported version that is affected is 14.1.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Integration...

CVE-2026-63903

A flaw was found in the Linux kernel's belkinsa USB serial driver. The driver's interrupt handling routine fails to validate the length of incoming status reports. This oversight allows a local attacker, by connecting a specially crafted USB device, to trigger an out-of-bounds read. The primary...

CVE-2026-63898

A flaw was found in the Linux kernel's mctu232 USB serial driver. A malicious USB device could exploit this vulnerability by reporting a smaller endpoint maximum packet size than the driver expects. This incorrect handling of transfer sizes can lead to memory corruption, potentially allowing an...

CVE-2026-63901

A flaw was found in the Linux kernel's digiacceleport USB serial driver. A malicious Universal Serial Bus USB device could report smaller bulk-out buffers than expected. This lack of proper size validation could lead to out-of-bounds memory accesses or slab corruption, potentially causing system...

CVE-2026-63964

A flaw was found in the Linux kernel's USB Type-C UCSI CCG driver. A local attacker with root privileges can provide a specially crafted firmware image without a required record header. This malformed image can cause a null pointer dereference within the doflash function, leading to a kernel cras...

CVE-2026-63905

A flaw was found in the Linux kernel's USB/IP Virtual USB Device Controller vudc component. A race condition exists in the vudcremove function, which can lead to a use-after-free vulnerability. This occurs when the system attempts to free a data structure while a timer within it is still active o...

SUSE CVE-2026-63899

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size...

SUSE CVE-2026-63900

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...

SUSE CVE-2026-63902

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

SUSE CVE-2026-63936

In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358readimp In mt6358readimp, the variable valv is passed to regmapread but the return value is not checked. If the read fails, valv remains uninitialized and its random stack...

SUSE CVE-2026-63956

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...

SUSE CVE-2026-63961

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...

SUSE CVE-2026-64166

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Check for NULL FF-A ID table while driver registration The bus match callback assumes that every FF-A driver provides an idtable and dereferences it unconditionally. Enforce that contract at registration time so...

SUSE CVE-2026-64191

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...

CVE-2026-63904

A flaw was found in the Linux kernel's USB Test and Measurement Class USBTMC driver. This vulnerability occurs because the driver does not properly verify the size of incoming notification messages, specifically failing to ensure that required two-byte headers are present. An attacker could explo...

CVE-2026-63896

A flaw was found in the Linux kernel's USB gadget composite driver. A remote attacker, acting as a malicious USB host, could send a specially crafted GETURL request. This request, with a small wLength value, triggers an integer underflow when calculating the buffer length for a memory copy...

CVE-2026-63928

A flaw was found in the Linux kernel's USB serial omninet driver. A malicious Universal Serial Bus USB device could exploit this by reporting a smaller maximum packet size than anticipated. This action would cause the system to allocate undersized data buffers, leading to memory corruption. Such...

Oracle Linux 10 : glib2 (ELSA-2026-42063)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-42063 advisory. - Fix CVE-2026-58016: D-Bus introspection XML node nesting validation Tenable has extracted the preceding description block directly from the Oracle Linux...