PT-2026-64726

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndis rm hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

PT-2026-64710

In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd ctl new1 return value snd ctl new1 can return NULL when memory allocation fails. snd ymfpci create spdif controls does not check the return value before dereferencing kctl-id.device, which can lead to a NU...

PT-2026-64615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the ksmbd module contains a permission bypass. The smb2 set info sec function calls set info sec without performing a per-handle access check. This allows a client t...

PT-2026-64490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/rtrs-srv component where the rdma write sg function fails to validate the length of the RDMA-Write operation against the maximum chunk size. When responding t...

Linux Distros Unpatched Vulnerability : CVE-2026-64273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: iforce - bound the device-reported force-feedback effect index iforceprocesspacket handles a status report packet id 0x02 by taking a force-feedback effe...

Linux Distros Unpatched Vulnerability : CVE-2026-64219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a...

Linux Distros Unpatched Vulnerability : CVE-2026-64391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS...

PT-2026-64529

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto ccp component where the system improperly initializes SNP for the ioctlSNP VLEK LOAD function. A userspace process could potentially trigger this code path...

PT-2026-64601

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client regarding the parsing of POSIX SID lengths. The function posix info sid size reads sid1 to determine the subauthority count, but the boundary check...

PT-2026-64633

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length, else we may pass non-null terminated string to request module...

PT-2026-64560

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbio bulk msg copies bpkt len = le16 to cpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuf len into the caller's...

PT-2026-64698

In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpu mask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty...

PT-2026-64670

In the Linux kernel, the following vulnerability has been resolved: staging: vme user: bound slave read/write to the kern buf size The SLAVE-path helpers buffer to user and buffer from user copy 'count' bytes into/out of the fixed-size kern buf size buf == PCI BUF SIZE == 0x20000, 128 KiB using...

PT-2026-64582

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check and correct requested length check and correct requested length compares off + len against node size using u32 arithmetic. When the caller passes a large len value e.g. from an underflowed...

Linux Distros Unpatched Vulnerability : CVE-2026-64441

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie a...

Linux Distros Unpatched Vulnerability : CVE-2026-64324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops th...

PT-2026-64619

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1-rc7 Description An authenticated SMB client can bypass permission checks in the ksmbd module. The smb2 ioctl function fails to perform a per-handle access check when processing FSCTL SET ZERO DATA, relying on...

PT-2026-64514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd veventq fops read function where a bound-check for the normal vEVENT path incorrectly uses sizeofhdr instead of sizeofhdr. Because hdr is a pointer,...

PT-2026-64538

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the isofs component when handling Rock Ridge symbolic link SL records. The functions get symlink chunk and parse rock ridge inode internal process...

PT-2026-64504

In the Linux kernel, the following vulnerability has been resolved: KVM: guest memfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guest memfd file, treat the offset and size as unsigned values to fix a bug where the sum of the two can result in a false negativ...