CVE-2026-74452

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74451

The CVE-2026-74451 entry concerns the Linux kernel driver drm/panthor. The vulnerability arises because iface_fw_to_cpu_addr() only validates that the firmware MCU address lies within the shared section, while the returned pointer is used as a full firmware interface structure, allowing out-of-bo...

CVE-2026-72261

In the Linux kernel ASoC SOF component, the ipc3-control path in snd_sof_update_control lacks a bounds check: firmware-provided cdata->num_elems is checked against local_cdata->data->size but not against the actual allocation size. If the local size was previously inconsistent, memcpy co...

CVE-2026-68353

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. The ath6klwmitxcompleteeventrx function, responsible for handling Wi-Fi messages, does not properly validate the nummsg field provided by the firmware against the buffer length. A malicious or compromised firmware could send an inflated...

CVE-2026-68326 wifi: mwifiex: bound uAP association event IEs to the event buffer

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiexprocessuapevent handles EVENTUAPSTAASSOC by exposing the reassociation request IEs that the firmware copies into the event: sinfo-assocreqies =...

CVE-2026-44103

The CVE-2026-44103 entry details an unauthenticated remote code/integrity issue where the JupiCore firmware update mechanism transmits updates without integrity or verification checks, allowing an attacker to inject malicious firmware into the internal charging module. This could compromise devic...

CVE-2026-64237

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - validate firmware size before use Ensure that the firmware file is large enough to contain the expected number of pages and the signature which resides at the end of the firmware blob before accessing them to...

CVE-2026-22097 Missing firmware validation allows remote code execution

The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution...

CVE-2026-22097

The CVE-2026-22097 entry describes a vulnerability where the firmware update mechanism does not perform cryptographic signature validation, allowing an attacker with access to the firmware update capability to upload arbitrary files that can lead to arbitrary code execution. The issue is document...

CVE-2026-45203

The CVE-2026-45203 entry concerns a TOCTOU issue in GPU DDK software used inside a Host VM. CVE records attribute a vulnerability in the rgxfw_hwperf_ufo() path where the command size is re-read after initial validation, enabling improper commands to reach GPU firmware and potentially trigger a m...

EUVD-2026-41455

WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image.This vulnerability affects Fireware OS 11.0 up to and including...

CVE-2026-13722

WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image...

CVE-2026-13722

WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image...

PT-2026-55336

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 11.0 through 11.12.4 Update1 WatchGuard Fireware OS versions 12.0 through 12.12 WatchGuard Fireware OS versions 2025.1 through 2025.6.2 Description An issue exists in the backup/restore feature where firmware...

SUSE CVE-2026-53205

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds datasize before using them. If out-of-bounds indices are encountered from...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: spi: hisi-kunpeng: Added verification for the maxfrequency value provided by the firmware. If the value of maxspeedhz is 0, it may cause a division by zero error in hisicalceffectivespeed. The value of maxspeedhz is provided by t...

PT-2026-37420

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description In the brcmfmac component of the Linux kernel, the brcmf fweh handle if event function fails to perform a range check on the bsscfgidx field provided by the firmware. This allows the raw...

CVE-2025-14858

The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware validation functionality. When a host issues a firmware validity check command via the SPI interface, the device decrypts the provided encrypted firmware packag...

CVE-2025-14858 Semtech LR11xx Encrypted Firmware Disclosure

The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware validation functionality. When a host issues a firmware validity check command via the SPI interface, the device decrypts the provided encrypted firmware packag...

CVE-2025-14858

The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware validation functionality. When a host issues a firmware validity check command via the SPI interface, the device decrypts the provided encrypted firmware packag...