CVE-2026-64524

The CVE affects the Linux kernel DRM Hyper-V path. A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 could bypass the supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] bound, due to a parse loop that didn’t enforce the size. The bug propagated when the WIN10 resolution probe failed, ...

CVE-2026-64483

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32tocpupayload-samplecount; if...

EUVD-2026-48827

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32tocpupayload-samplecount; if...

PT-2026-64704

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isight packet takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32 to cpupayload-sample count...

CVE-2026-53182

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211parsernrelems stores the parsed element count in a u8-backed cfg80211rnrelems::cnt field and uses that count to size the flexible array allocation. Reject nested...

CVE-2026-53182

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211parsernrelems stores the parsed element count in a u8-backed cfg80211rnrelems::cnt field and uses that count to size the flexible array allocation. Reject nested...

SUSE CVE-2026-43075

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2writeendinline KASAN reports a use-after-free write of 4086 bytes in ocfs2writeendinline, called from ocfs2writeendnolock during a copyfilerange splice fallback on a corrupted ocfs2 filesyst...