EUVD-2026-48858

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate mustwait writability check on ptepresent userfaultfdmustwait and userfaultfdhugemustwait read the PTE without taking the page table lock and then apply ptewrite / hugeptewrite to it. Those accessors decode bits...

CVE-2026-64510

CVE-2026-64510 affects the Linux kernel and concerns the ACPI NFIT core. The vulnerability arises when acpi_nfit_init() fails after adding an acpi_desc to the acpi_descs list or when certain probe/update paths do not register a proper shutdown/remove path. This can lead to a use-after-free in nfi...

CVE-2026-64504

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count bmc150accelfifoflush copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 bufferBMC150ACCELFIFOLENGTH 3; which is sized fo...

CVE-2026-64290

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

CVE-2026-64290 iommufd: Break the loop on failure in iommufd_fault_fops_read()

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

CVE-2026-64290 iommufd: Break the loop on failure in iommufd_fault_fops_read()

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

CVE-2026-64290

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

CVE-2026-64290

CVE-2026-64290 affects the Linux kernel via iommufd_fault_fops_read(): on a copy_to_user() failure inside the inner loop, only the inner loop breaks, causing the outer loop to retry indefinitely and spin the reader with fault->mutex held. The public fixes implement breaking the outer while by ...

EUVD-2026-49002

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

EUVD-2026-48994

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't leak PFN when kvmtranslatevncr races MMU notifier In the case that kvmtranslatevncr races with an MMU notifier the early return does not release a reference on the faulted in PFN. Add the necessary call to...

CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

CVE-2026-64264

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

PT-2026-64637

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.58 Description A NULL pointer dereference occurs in the lookup swap cgroup id function on hosts without swap enabled. The function passes swap cgroup ctrltype.map to swap cgroup id lookup without verifying if the type...

Linux Distros Unpatched Vulnerability : CVE-2026-64264

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes...

PT-2026-64511

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd fault fops read function where a failure in copy to user within an inner list for each entry loop only breaks the inner loop. This causes the outer while...

Linux Distros Unpatched Vulnerability : CVE-2026-64290

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside th...

CVE-2026-15614

CVE-2026-15614 affects Logto: IdP-initiated SAML sessions are not handled atomically, as session lookup may complete before deletion. This can allow the same session identifier to pass validation twice, enabling replay/dual sign-ins within the session’s window. The description and connected refer...

CVE-2026-10679

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

EUVD-2026-46448

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...