8530 matches found
CVE-2026-63900
CVE-2026-63900 concerns the Linux kernel USB serial driver for Keyspan devices (usa49wg). The vulnerability was a missing sanity check on the size of indat transfers, which could allow parsing of stale or uninitialised slab data. The issue has been addressed by adding the missing sanity check to ...
EUVD-2026-45672
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size...
EUVD-2026-45673
In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...
CVE-2026-63897
The CVE-2026-63897 entry concerns the Linux kernel USB serial driver mct_u232. A missing sanity check on the size of interrupt-in transfers could allow parsing of stale or uninitialised slab data, potentially leaking kernel data to user space. The vulnerability is addressed by kernel fixes that a...
EUVD-2026-45670
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data and leaking it to user space...
CVE-2026-63895
Summary: CVE-2026-63895 affects the Linux kernel's FunctionFS (f_fs) gadget driver. The bug occurs in ffs_ep0_read(), where a control-OUT request’s data buffer is allocated with kmalloc(len) and then fully copied to userspace via copy_to_user(buf, data, len) even when only ret bytes were actually...
CVE-2026-63895 usb: gadget: f_fs: copy only received bytes on short ep0 read
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...
CVE-2026-63862 PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtkpciesetupirq, the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without...
EUVD-2026-45546
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtkpciesetupirq, the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without...
CVE-2026-53400
In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2cgetadapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...
CVE-2026-53387
In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075itms index veml6075itms has 5 elements but VEML6075CONFIT can yield values 0-7. If it returns a value = 5, this causes an out-of-bounds array access. Add a bounds check and return...
CVE-2026-53400
CVE-2026-53400 pertains to the Linux kernel: i2c core adapter registration race. The issue arises when looking up adapters by id via i2c_get_adapter(), which uses a reference to an embedded struct device. The advisory states that the adapter (including its struct device) must be initialised befor...
CVE-2026-53387
In the Linux kernel, the vulnerability CVE-2026-53387 affects the IIO light driver for veml6075. The issue arises in veml6075_it_ms indexing: veml6075_it_ms has 5 elements, but VEML6075_CONF_IT can yield 0–7, which can lead to an out-of-bounds access when the index is >= 5. The fix adds a boun...
PT-2026-61483
In the Linux kernel, the following vulnerability has been resolved: firmware: arm ffa: Check for NULL FF-A ID table while driver registration The bus match callback assumes that every FF-A driver provides an id table and dereferences it unconditionally. Enforce that contract at registration time ...
PT-2026-61253
In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358 read imp In mt6358 read imp, the variable val v is passed to regmap read but the return value is not checked. If the read fails, val v remains uninitialized and its random...
PT-2026-61245
In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...
PT-2026-61105
In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2c get adapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...
PT-2026-61276
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpci maxim: validate header NDO against RX BYTE CNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this,...
PT-2026-61462
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix dma buffer leak on bus acquire failure wilc wlan firmware download allocates dma buffer with kmalloc at the top of the function and uses a 'fail:' label to free it via kfreedma buffer on error. All later error...
PT-2026-61274
In the Linux kernel, the following vulnerability has been resolved: USB: serial: safe serial: fix memory corruption with small endpoint Make sure that the bulk-out buffer size is at least eight bytes to avoid user-controlled slab corruption in "safe" mode should a malicious device report a smalle...