CVE-2026-64527

A flaw was found in the drm/hyperv component of the Linux kernel. The hypervreceivesub function, responsible for processing VMBus packets, does not adequately validate the size of incoming data. This oversight allows a malicious or compromised host to send specially crafted packets, potentially...

CVE-2026-64524

A flaw was found in the Linux kernel's drm/hyperv component. A malicious Hyper-V guest could exploit an out-of-bounds memory access vulnerability by sending a crafted resolution response. This could potentially lead to information disclosure or a denial of service. Additionally, an issue with the...

Linux Distros Unpatched Vulnerability : CVE-2026-64527

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without...

CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64524

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

Linux Distros Unpatched Vulnerability : CVE-2026-64524

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the...

UBUNTU-CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

SUSE CVE-2026-64524

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64527

The CVE-2026-64527 entry describes a Linux kernel issue in drm/hyperv where VMBus packet size is not validated in the receive callback. hyperv_receive_sub() dispatches on msg->vid_hdr.type without knowing the host-written length, leading to a potential read of stale data when copying from hv-&...

EUVD-2026-49039

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64524

The CVE-2026-64524 issue affects the Linux kernel's DRM Hyper-V driver. A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 could bypass the bound check on the supported_resolution array, potentially leading to out-of-bounds behavior during parsing. The fix binds resolution_count to the ...

CVE-2026-64524: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

PT-2026-64755

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/hyperv component where a SYNTHVID RESOLUTION RESPONSE containing a resolution count greater than 64 causes the parse loop to read beyond the boundaries of the...

CVE-2026-64527: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

UBUNTU-CVE-2025-21978

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: Fix address space leak when Hyper-V DRM device is removed When a Hyper-V DRM device is probed, the driver allocates MMIO space for the vram, and maps it cacheable. If the device removed, or in the error path for devic...

CVE-2025-21978: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: Fix address space leak when Hyper-V DRM device is removed When a Hyper-V DRM device is probed, the driver allocates MMIO space for the vram, and maps it cacheable. If the device removed, or in the error path for devic...

Unbreakable Enterprise kernel security update

5.15.0-102.110.5 - RISC-V: Fix up a cherry-pick warning in setupvmfinal Alexandre Ghiti - Revert 'Bluetooth: btsdio: fix use after free bug in btsdioremove due to unfinished work' Liu Jian - riscv: mm: remove redundant parameter of createfdtearlypagetable Song Shuai - kernfs: change...