CVE-2026-64081

CVE-2026-64081 concerns the Linux kernel firmware path (arm_ffa) and fixes how framework notifications in the shared RX buffer are validated. The issue arose from indirect messages where an incorrect offset/size could enable misinterpretation of payloads. The fix validates the reported offset and...

CVE-2026-64081

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

EUVD-2026-45654

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

EUVD-2026-45653

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notifylock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister...

CVE-2026-64080 firmware: arm_ffa: Snapshot notifier callbacks under lock

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notifylock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister...

CVE-2026-64080 firmware: arm_ffa: Snapshot notifier callbacks under lock

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notifylock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister...

CVE-2026-64080

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notifylock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister...

CVE-2026-64080

Summary: CVE-2026-64080 affects Linux kernel firmware: arm_ffa snapshot notifier callbacks under lock. The issue arises when notification handlers look up a notifier entry under notify_lock, then drop the lock and dereference the entry, allowing a concurrent unregister to free the entry and cause...

CVE-2026-63995 ethtool: cmis: validate start_cmd_payload_size from module

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63995 ethtool: cmis: validate start_cmd_payload_size from module

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63995

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63995

CVE-2026-63995 affects the Linux kernel ethtool CMIS firmware update path. The CMIS FW update code reads start_cmd_payload_size from the module FW Management Features CDB reply and uses it directly as the byte count for memcpy, writing into a destination buffer of 112 bytes (ETHTOOL_CMIS_CDB_LPL_...

EUVD-2026-45568

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63964

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

CVE-2026-63964

The CVE-2026-63964 entry describes a Linux kernel vulnerability in usb: typec: ucsi: ccg where do_flash() searches firmware records for a ':' header. If a firmware image lacks ':' bytes, strnchr() returns NULL, and the loop uses p+1 and a large length, causing a crash. A root user could place a c...

EUVD-2026-45737

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

CVE-2026-63964 usb: typec: ucsi: ccg: reject firmware images without a ':' record header

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

CVE-2026-63964 usb: typec: ucsi: ccg: reject firmware images without a ':' record header

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

CVE-2026-63964

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

CVE-2026-63822

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp-txringi.txstatus are released. However this is released again when the device is unbinded ath11kpci, and...