UBUNTU-CVE-2026-53195

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioti: fix heap overflow in buildi2cfwhdr buildi2cfwhdr allocates a fixed-size buffer of 161024 - 512 + sizeofstruct tii2cfirmwarerec bytes, then copies le16tocpuimgheader-Length bytes into it without validating that...

kernel: Bluetooth: qca: add missing firmware sanity checks

A flaw was found in the Linux kernel's Bluetooth QCA driver. This vulnerability is caused by missing sanity checks when parsing firmware files before downloading them. A local attacker with low privileges could exploit this to corrupt memory beyond a vmalloced buffer, potentially leading to a...

UBUNTU-CVE-2024-36880

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: add missing firmware sanity checks Add the missing sanity checks when parsing the firmware files before downloading them to avoid accessing and corrupting memory beyond the vmalloced buffer...