CVE-2026-53379

A flaw was found in the Linux kernel's ov8856 media driver. This vulnerability occurs due to improper error handling where a control handler is not correctly released if an error occurs during its initialization. This oversight could potentially lead to resource exhaustion, which may result in a...

CVE-2026-53374

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. When allocating a Graphics Address Remapping Table GART, the memory was not properly initialized. This could allow a local attacker to potentially access uninitialized memory, leading to information disclosure or unexpected system...

CVE-2026-64055

A flaw was found in the Linux kernel's Cortina ethernet driver. When the network interface processes incoming packets, a counter used for reassembling fragmented packets can be prematurely reset. This can lead to incomplete packet reassembly, potentially causing network communication issues or...

CVE-2026-64056

A flaw was found in the Linux kernel's Cortina ethernet driver for Gemini devices. The driver used a single, shared buffer SKB, or Socket Kernel Buffer for assembling incoming network packets across multiple ethernet ports. This shared resource could lead to race conditions, where simultaneous...

CVE-2026-64205

A flaw was found in the Linux kernel's i2c-i801 driver. This vulnerability allows a local attacker to trigger a hardware state machine corruption during error handling. This can lead to a denial of service DoS, where the system becomes unresponsive due to a continuous stream of error messages and...

The vulnerability of the mlx5_irq_alloc() function in the drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c file of the Mellanox Ethernet network adapter driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mlx5irqalloc function in the drivers/net/ethernet/mellanox/mlx5/core/pciirq.c file of the Mellanox Ethernet network adapter driver for the Linux operating system is related to the distribution of resources without any restrictions or regulation. Exploiting this...

kernel security, bug fix, and enhancement update

4.18.0-553.146.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

PT-2026-62126

The DesignWare SPI driver drivers/spi/spi dw.c computed the SPI BAUDR clock divider as info-clock frequency / config-frequency without validating config-frequency. spi transceive is a Zephyr syscall and its verify handler drivers/spi/spi handlers.c copies the caller-supplied spi config from...

PT-2026-62122

The NXP LPUART serial driver drivers/serial/uart mcux lpuart.c, when CONFIG UART USE RUNTIME CONFIGURE is enabled, called LPUART Deinit at the start of mcux lpuart configure, which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards in mcux lpuart...

The vulnerability of the `nvme_dbbuf_set()` function in the driver/nvme/host/pci.c module of the Linux NVME driver allows a attacker to escalate their privileges or execute arbitrary code.

The vulnerability of the nvmedbbufset function in the drivers/nvme/host/pci.c file of the NVME kernel driver in Linux is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability can allow an attacker to increase their privileges or execute arbitrary code...

ALSA-2026:42919 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: Linux kernel: Denial of Service due to memory leak in tpm2loadcmd CVE-2025-71147 kernel:...

CVE-2026-63842

A flaw was found in the Linux kernel's AMD GPU JPEG driver. This vulnerability arises from the driver's inability to properly handle 64-bit user fence writes to its JPEG rings. A local user could exploit this by submitting specially crafted commands, potentially leading to system instability or a...

CVE-2026-63837

A flaw was found in the Linux kernel's Elastic Network Adapter ENA driver. The driver's Precision Time Protocol PTP Hardware Clock PHC support, specifically the enaphcgettimex64 function, fails to check the return code of an internal timestamp retrieval function. This oversight can lead to...

CVE-2026-63832

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability occurs due to improper handling of Wi-Fi station additions, where the driver fails to adequately verify existing client connections. A remote attacker could exploit this by manipulating Wi-Fi authentication processes,...

CVE-2026-63822

A flaw was found in the Linux kernel's ath11k Wi-Fi driver. This vulnerability, a double free, occurs when memory buffers are incorrectly released twice during the device unbinding process after an initial firmware initialization error. This can lead to system instability or a kernel crash,...

CVE-2026-64099

A flaw was found in the Linux kernel's drm/v3d graphics driver. This vulnerability, a use-after-free error, occurs in the CPU job input/output control ioctl error path. When an error is encountered, the system attempts to access memory that has already been freed, which can lead to system...

CVE-2026-39879

CVE-2026-39879 affects syslog-ng before version 4.12, where a missing sanitization in afsql_dd_run_query can allow SQL injection from an untrusted source when using the SQL destination driver (not enabled by default). The issue lies in the afsql.c component (afsql_dd_run_query) and is exploitable...

CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

CVE-2026-64191 i2c: stub: Reject I2C block transfers with invalid length

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...