EUVD-2026-49009

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

CVE-2026-64297

CVE-2026-64297 concerns a Linux kernel module path in which module_extend_max_pages() calls kvrealloc() and returns -ENOMEM on failure, but the return value is never checked. If the initial allocation fails, info->pages is NULL and info->max_pages is 0; later calls to module_get_next_page()...

CVE-2026-64297 module: decompress: check return value of module_extend_max_pages()

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

EUVD-2026-49004

In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can allocate large queu...

CVE-2026-64292 iommufd: Move vevent memory allocation outside spinlock

In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can allocate large queu...

CVE-2026-64264

In CVE-2026-64264, the Linux kernel fuse-uring path is affected: copy_from_user can leave a positive residual in err, then -EFAULT is overwritten by fuse_uring_req_end, causing an incorrect success path and potentially uninitialised req->out.args. The fix assigns err = -EFAULT in the failure b...

EUVD-2026-48976

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

SUSE CVE-2026-64226

In the Linux kernel, the following vulnerability has been resolved: schedext: Avoid UAF in scxrootenableworkfn init failure path In scxrootenableworkfn, puttaskstructp is called before scxerror dereferences p-comm and p-pid. If the iterator's reference is the last drop, the task is freed...

SUSE CVE-2026-64242

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

PT-2026-64641

In the Linux kernel, the following vulnerability has been resolved: mfd: cros ec: Delay dev set drvdata until probe success If ec device probe fails, cros ec class release releases memory for the cros ec dev structure. However, because the drvdata was already set, sub-drivers like cros ec typec c...

PT-2026-64491

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114 interrupt reads a packet of touch data from the device into a fixed-size on-stack buffer struct mms114 touch touchMMS114 MAX TOUCH; which holds MMS114 MAX TOUCH 10...

PT-2026-64485

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuse uring commit copy from user returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuse out header. fuse uring commit stores that residual in ssize t err,...

PT-2026-64621

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A path traversal bypass exists in the ksmbd component. The ksmbd vfs path lookup function uses LOOKUP BENEATH to restrict path resolution to the share root. While vfs path parent lookup...

PT-2026-64566

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f printer: take kref only for successful open printer open returns -EBUSY when the character device is already open, but it increments dev-kref regardless of the return value. VFS does not call -release for a failed...

Linux Distros Unpatched Vulnerability : CVE-2026-64461

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtkpcieenableport fails, mtkpcieportfree removes the port from pcie-ports and frees the port...

Linux Distros Unpatched Vulnerability : CVE-2026-64400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: prevent path traversal bypass by restricting caseless retry ksmbdvfspathlookup enforces LOOKUPBENEATH to restrict path resolution within the share root...

Linux Distros Unpatched Vulnerability : CVE-2026-64255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checki...

Linux Distros Unpatched Vulnerability : CVE-2026-64470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe...

Linux Distros Unpatched Vulnerability : CVE-2026-64494

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002readraw calls pmruntimegetsync before reading the lux value, but if gp2ap002getlux fails, it...

Linux Distros Unpatched Vulnerability : CVE-2026-64227

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ACPI: driver: Check ACPICOMPANION against NULL during probe Since every platform driver can be forced to match a device that doesn't match its list of device ID...