CVE-2026-90030

A flaw was found in the Linux kernel's DWC3 USB controller driver. When the forceRM bit is incorrectly set during an EndTransfer command, a transfer may remain active even after completion. A subsequent StartTransfer on the same endpoint can then trigger writes to an unmapped memory buffer, leadi...

CVE-2026-99035

A flaw was found in the MediaTek SD/MMC host controller driver within the Linux kernel. When the driver is removed or unbound, it fails to wait for active request timeout tasks to complete before releasing host memory resources. A local user could exploit this timing issue during device removal t...

CVE-2026-98721

A flaw was found in the Linux kernel's Cadence NAND controller driver. The driver registers its interrupt handler before initializing the internal synchronization lock and completion objects. A pending interrupt during initialization can trigger the handler to access this uninitialized state,...

CVE-2026-92479

A flaw was found in the Linux kernel's Universal Flash Storage UFS host controller driver. When an invalid completion queue entry CQE tag is reported, the driver attempts to dereference a NULL pointer, which can lead to a system crash. This vulnerability could allow a local attacker to cause a...

Ubuntu 24.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8911-1)

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8911-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

CVE-2026-90328

A flaw was found in the Human Interface Device HID subsystem of the Linux kernel, specifically within the Steam Controller driver. This vulnerability arises because the driver trusts the message size encoded within Steam Controller FEATURE reports without verifying that the reported size matches...

MFD controller driver Heap Buffer Overflow DoS

The vulnerability of the applesmcprobe function in the drivers/mfd/macsmc.c file of the MFD controller driver for the Linux operating system is related to access to an uninitialized pointer. Exploiting this vulnerability could allow a attacker to cause a system failure...

CVE-2026-93822

A flaw was found in the Linux kernel's Broadcom iProc PCIe controller driver. The driver fails to acquire the appropriate lock when stopping and removing a root bus. A local user with administrative privileges could exploit this race condition by initiating simultaneous PCI rescan or hotplug...

CVE-2026-93821

A flaw was found in the Linux kernel's Altera PCI Express PCIe controller driver. A local user could exploit a race condition during root bus removal by triggering concurrent device rescan or hotplug operations through the sysfs interface. This lack of proper synchronization can lead to a...

CVE-2026-93820

A flaw was found in the Linux kernel's Rockchip PCIe host controller driver. Stopping and removing a PCIe root bus without proper synchronization creates a race condition with concurrent device rescanning or hotplug operations. A local attacker could exploit this flaw to cause a use-after-free...

CVE-2026-93818

A flaw was found in the Linux kernel's PLDA PCIe host controller driver. This vulnerability can result in a Denial of Service DoS caused by a race condition when removing a root bus without holding the required lock. A local user with administrative privileges can exploit this issue by triggering...

CVE-2026-16148

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16148: Operation on Resource in Wrong Phase of Lifetime

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16147: Use After Free

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-10656

The MAX32xxx USB device controller driver drivers/usb/udc/udcmax32.c, compatible adimax32usbhs dereferenced an endpoint buffer in its OUT and IN transfer-completion handlers without checking it for NULL. udceventxferoutdone called netbufaddbuf, eprequest-actlen immediately after buf =...

CVE-2026-10656: NULL Pointer Dereference

The MAX32xxx USB device controller driver drivers/usb/udc/udcmax32.c, compatible adimax32usbhs dereferenced an endpoint buffer in its OUT and IN transfer-completion handlers without checking it for NULL. udceventxferoutdone called netbufaddbuf, eprequest-actlen immediately after buf =...

CVE-2026-45911 usb: cdns3: fix role switching during resume

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix role switching during resume If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference. T...

mpfs_reset_unregister_adev Heap Buffer Overflow DoS

The vulnerability of the mpfsresetunregisteradev function in the drivers/clk/microchip/clk-mpfs.c file of the frequency controller driver for Samsung Exynos Linux operating systems is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to...

Linux memory controller driver Heap Buffer Overflow DoS

The vulnerability of the pl353smcprobe function in the drivers/memory/pl353-smc.c file of the Linux kernel’s memory controller driver is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to cause a system failure...

Linux DesignWare USB3 controller driver Heap Buffer Overflow DoS

The vulnerability of the dwc3probe function in the drivers/usb/dwc3/core.c file of the DesignWare USB3 driver for the Controler-based Linux operating system is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...