CVE-2026-68339

A flaw was found in the Linux kernel's Bluetooth subsystem btusb driver. An attacker could craft a two-byte vendor event that, due to improper validation of the Realtek vendor event length in the btusbrecveventrealtek function, could lead to the system attempting to read a non-existent third byte...

CVE-2026-68326

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiexprocessuapevent handles EVENTUAPSTAASSOC by exposing the reassociation request IEs that the firmware copies into the event: sinfo-assocreqies =...

CVE-2026-68352 wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx are not validated against the buffer length. Their sum up t...

CVE-2026-68339 Bluetooth: btusb: validate Realtek vendor event length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Tracing: Ring-buffer: A fix was made to check the length of events before using them. Check the length of events before adding them for accessing the next index in rbreaddatabuffer. Since this function is used to validate possibl...

CVE-2026-10664 Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)

The nRF70 Wi-Fi driver's power-save event handler nrfwifieventprocgetpowersaveinfo in drivers/wifi/nrfwifi/src/wifimgmt.c copied TWT Target Wake Time flow entries from an nrfwifiumaceventpowersaveinfo event into the fixed-size twtflowsWIFIMAXTWTFLOWS 8-element array of a caller-supplied struct...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from an issue with the WMT event length verification in the btmtk module. This vulnerability may lead ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Ring-buffer: Do not attempt to read beyond the “commit” boundary. When iterating over the ring buffer while the ring buffer is active, the writer can corrupt the reader’s data. There are mechanisms to detect and handle this issue...

SUSE CVE-2026-43210

In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing next index in rbreaddatabuffer. Since this function is used for validating possibly broken ring buffers, the lengt...

EUVD-2026-27769

In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing next index in rbreaddatabuffer. Since this function is used for validating possibly broken ring buffers, the lengt...

CVE-2026-43210

In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing next index in rbreaddatabuffer. Since this function is used for validating possibly broken ring buffers, the lengt...

CVE-2026-43210 tracing: ring-buffer: Fix to check event length before using

In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing next index in rbreaddatabuffer. Since this function is used for validating possibly broken ring buffers, the lengt...

CVE-2026-43210 tracing: ring-buffer: Fix to check event length before using

In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing next index in rbreaddatabuffer. Since this function is used for validating possibly broken ring buffers, the lengt...

CVE-2026-43210

In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing next index in rbreaddatabuffer. Since this function is used for validating possibly broken ring buffers, the lengt...

CVE-2026-43210

The CVE-2026-43210 entry concerns the Linux kernel tracing ring-buffer subsystem. The root cause is inadequate validation of event length in rb_read_data_buffer(), which can cause an invalid memory access if an event’s length is corrupted, potentially at boot time. The published fix is to check t...

Linux kernel 安全漏洞

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the ring-buffer not checking the length of events, potentially leading to out-of-bound access...

PT-2026-37550

In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing next index in rb read data buffer. Since this function is used for validating possibly broken ring buffers, the...

EUVD-2026-26584

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: move wake reason storage into validated event handlers hcistorewakereason is called from hcieventpacket immediately after stripping the HCI event header but before hcieventfunc enforces the per-event minimum...

CVE-2026-31771 Bluetooth: hci_event: move wake reason storage into validated event handlers

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: move wake reason storage into validated event handlers hcistorewakereason is called from hcieventpacket immediately after stripping the HCI event header but before hcieventfunc enforces the per-event minimum...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Tracing: Consider the NULL character when validating the event length. strlen returns the length of a string excluding the null byte. If the string length equals the maximum buffer length, there will be no space left in the buffe...