CVE-2026-63895 usb: gadget: f_fs: copy only received bytes on short ep0 read

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63895 usb: gadget: f_fs: copy only received bytes on short ep0 read

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63895

Summary: CVE-2026-63895 affects the Linux kernel's FunctionFS (f_fs) gadget driver. The bug occurs in ffs_ep0_read(), where a control-OUT request’s data buffer is allocated with kmalloc(len) and then fully copied to userspace via copy_to_user(buf, data, len) even when only ret bytes were actually...

EUVD-2026-45546

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtkpciesetupirq, the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without...

CVE-2026-63862 PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtkpciesetupirq, the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without...

CVE-2026-53400

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2cgetadapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...

CVE-2026-53387

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075itms index veml6075itms has 5 elements but VEML6075CONFIT can yield values 0-7. If it returns a value = 5, this causes an out-of-bounds array access. Add a bounds check and return...

CVE-2026-53400

CVE-2026-53400 pertains to the Linux kernel: i2c core adapter registration race. The issue arises when looking up adapters by id via i2c_get_adapter(), which uses a reference to an embedded struct device. The advisory states that the adapter (including its struct device) must be initialised befor...

CVE-2026-53387

In the Linux kernel, the vulnerability CVE-2026-53387 affects the IIO light driver for veml6075. The issue arises in veml6075_it_ms indexing: veml6075_it_ms has 5 elements, but VEML6075_CONF_IT can yield 0–7, which can lead to an out-of-bounds access when the index is >= 5. The fix adds a boun...

PT-2026-61278

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB Type-C DisplayPort alternate mode implementation where the kernel fails to validate the count before reading a Status Update VDO Vendor Defined Object. A...

PT-2026-61217

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB serial keyspan driver where a sanity check is missing for the size of usa49wg indat transfers. This omission could lead to the parsing of stale or uninitialize...

PT-2026-61223

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the omap2430 probe function. The of node putnp function is called prematurely before the final access to the np variable, which can lead to a...

PT-2026-61105

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists during the registration of I2C adapters. The i2c get adapter function allows looking up adapters by ID and takes a reference to the embedded struct device. If an...

PT-2026-61462

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the wilc wlan firmware download function when a bus acquire failure happens. The function allocates a dma buffer using kmalloc, but an early error path uses a...

PT-2026-61274

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Memory corruption occurs in the USB serial safe mode when a malicious device reports a bulk-out buffer size smaller than eight bytes. This can lead to user-controlled slab corruption,...

PT-2026-61483

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm ffa firmware component where the bus match callback unconditionally dereferences the id table of FF-A drivers. Because the system assumes every driver provides...

PT-2026-61452

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack buffer overflow exists in the adm1266 nvmem read blackbox function within the hwmon module. The function uses a 5-byte stack buffer when calling i2c smbus read block data to...

PT-2026-61216

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the mxuport serial USB driver. A malicious device can trigger user-controlled slab corruption—a type of memory error affecting the slab allocator, whi...

PT-2026-61245

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Memory corruption occurs in the USB serial omninet driver when a malicious device reports a smaller endpoint max packet size than expected. This can lead to user-controlled slab...

PT-2026-61215

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the mct u232 USB serial driver. The driver overrides the maximum transfer size for a specific device that accepts 16 byte packets for its 32 byte...