CVE-2026-63862 PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtkpciesetupirq, the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without...

EUVD-2026-45546

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtkpciesetupirq, the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without...

CVE-2026-53400

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2cgetadapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...

CVE-2026-53387

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075itms index veml6075itms has 5 elements but VEML6075CONFIT can yield values 0-7. If it returns a value = 5, this causes an out-of-bounds array access. Add a bounds check and return...

CVE-2026-53400

CVE-2026-53400 pertains to the Linux kernel: i2c core adapter registration race. The issue arises when looking up adapters by id via i2c_get_adapter(), which uses a reference to an embedded struct device. The advisory states that the adapter (including its struct device) must be initialised befor...

CVE-2026-53387

In the Linux kernel, the vulnerability CVE-2026-53387 affects the IIO light driver for veml6075. The issue arises in veml6075_it_ms indexing: veml6075_it_ms has 5 elements, but VEML6075_CONF_IT can yield 0–7, which can lead to an out-of-bounds access when the index is >= 5. The fix adds a boun...

PT-2026-61244

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usb hcd giveback urb so save the urb-status ahead of time...

PT-2026-61223

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430 probe In omap2430 probe, of node putnp is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the of...

PT-2026-61245

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...

PT-2026-61215

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mct u232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increa...

PT-2026-61253

In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358 read imp In mt6358 read imp, the variable val v is passed to regmap read but the return value is not checked. If the read fails, val v remains uninitialized and its random...

PT-2026-61483

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm ffa firmware component where the bus match callback unconditionally dereferences the id table of FF-A drivers. Because the system assumes every driver provides...

PT-2026-61462

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix dma buffer leak on bus acquire failure wilc wlan firmware download allocates dma buffer with kmalloc at the top of the function and uses a 'fail:' label to free it via kfreedma buffer on error. All later error...

PT-2026-61276

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpci maxim: validate header NDO against RX BYTE CNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this,...

PT-2026-61216

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size...

PT-2026-61452

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack buffer overflow exists in the adm1266 nvmem read blackbox function within the hwmon module. The function uses a 5-byte stack buffer when calling i2c smbus read block data to...

PT-2026-61105

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2c get adapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...

PT-2026-61137

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtw usb write port fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

PT-2026-61278

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...

PT-2026-61218

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi acceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device report smaller buffer...