CVE-2026-64318

In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the ppcount scan to the ppe array aixpartition reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16tocpupvd-ppcount; ... fo...

CVE-2026-64295

In the Linux kernel, the following vulnerability has been resolved: mm: pageext: add count limit to pageextiternext to prevent invalid PFN access The pageext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dynamically adding memory in...

CVE-2026-64276

CVE-2026-64276 affects the Linux kernel synaptics-rmi4 input driver. The F30/GP I/O mapping code incorrectly allocated gpioled_key_map for at most 6 entries but later iterated up to gpioled_count (0..31) and advanced input->keycodemax to the full count, risking out-of-bounds reads in the atten...

CVE-2026-64276 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmif30mapgpios allocates gpioledkeymap with mingpioledcount, TRACKSTICKRANGEEND == at most 6 entries, but rmif30attention iterates the full f30-gpioledcount devic...

CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

EUVD-2026-48989

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

EUVD-2026-48988

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmif30mapgpios allocates gpioledkeymap with mingpioledcount, TRACKSTICKRANGEEND == at most 6 entries, but rmif30attention iterates the full f30-gpioledcount devic...

CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64276 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmif30mapgpios allocates gpioledkeymap with mingpioledcount, TRACKSTICKRANGEEND == at most 6 entries, but rmif30attention iterates the full f30-gpioledcount devic...

CVE-2026-64277

The CVE-2026-64277 issue affects the Linux kernel synaptics-rmi4 input driver. The rmi_f3a_map_gpios() path allocates gpio_key_map using min(gpio_count, TRACKSTICK_RANGE_END) (at most 6 entries), but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], while input-&g...

CVE-2026-64274 Input: goodix - clamp the device-reported contact count

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodixtsreadinputreport copies the number of touch points reported by the device into an on-stack buffer u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS; which is siz...

PT-2026-64566

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f printer: take kref only for successful open printer open returns -EBUSY when the character device is already open, but it increments dev-kref regardless of the return value. VFS does not call -release for a failed...

PT-2026-64725

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count bmc150 accel fifo flush copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 bufferBMC150 ACCEL FIFO LENGTH 3; which is...

PT-2026-64539

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the aix partition function where the system reads a physical volume descriptor into a fixed-size struct pvd and scans its physical-partition-extent array. The loop...

PT-2026-64495

In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodix ts read input report copies the number of touch points reported by the device into an on-stack buffer u8 point data2 + GOODIX MAX CONTACT SIZE GOODIX MAX CONTACTS;...

Linux Distros Unpatched Vulnerability : CVE-2026-64277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf &...

PT-2026-64498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the synaptics-rmi4 driver where the rmi f3a initialize function retrieves a GPIO count from the device query register. While rmi f3a map gpios allocates the gpio key m...

PT-2026-64543

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the UDF file system implementation where the udf load sparable map function incorrectly treats the reallocationTableLen variable as a byte count instead of an entry...