CVE-2026-68326

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiexprocessuapevent handles EVENTUAPSTAASSOC by exposing the reassociation request IEs that the firmware copies into the event: sinfo-assocreqies =...

CVE-2026-68339 Bluetooth: btusb: validate Realtek vendor event length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

CVE-2026-43210

The CVE-2026-43210 entry concerns the Linux kernel tracing ring-buffer subsystem. The root cause is inadequate validation of event length in rb_read_data_buffer(), which can cause an invalid memory access if an event’s length is corrupted, potentially at boot time. The published fix is to check t...

CVE-2026-31771 Bluetooth: hci_event: move wake reason storage into validated event handlers

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: move wake reason storage into validated event handlers hcistorewakereason is called from hcieventpacket immediately after stripping the HCI event header but before hcieventfunc enforces the per-event minimum...

CVE-2024-50131 tracing: Consider the NULL character when validating the event length

In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character when validating the event length strlen returns a string length excluding the null byte. If the string length equals to the maximum buffer length, the buffer will have no space for the NULL...