UBUNTU-CVE-2026-68456

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous requestfirmwarenowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...

Exploit for Out-of-bounds Write in Samsung Exynos_1080_Firmware

SM-G985F / Exynos9830 Bootrom exploit !CAUTION The curr...

CVE-2026-74410 wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtwpcirxnapi, newlen is computed as the sum of pktlen 14-bit descriptor field, max 16383 and pktoffset drvinfosz + shift, both firmware-controlled. The...

CVE-2026-74410

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtwpcirxnapi, newlen is computed as the sum of pktlen 14-bit descriptor field, max 16383 and pktoffset drvinfosz + shift, both firmware-controlled. The...

CVE-2026-74409

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

CVE-2026-74409 wifi: rtw89: add bounds check on firmware mac_id in link lookup

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

EUVD-2026-59556

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

CVE-2026-74409

Summary : The CVE-2026-74409 issue resides in the Linux kernel wifi driver for RTW89. An 8‑bit mac_id in RX descriptors (0–255) can index into assoc_link_on_macid[] which has only 128 entries (RTW89_MAX_MAC_ID_NUM). Firmware-supplied mac_id values are not validated before use as an array index, a...

CVE-2026-74409 wifi: rtw89: add bounds check on firmware mac_id in link lookup

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware macid in link lookup The macid field in RX descriptors is 8 bits wide 0-255, but assoclinkonmacid has only RTW89MAXMACIDNUM 128 entries. While the driver currently assigns macid values...

CVE-2026-74408 wifi: ath9k: fix OOB access from firmware tx status queue ID

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-74408

The Linux kernel WiFi driver ath9k has a vulnerability (CVE-2026-74408) where ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] with ts.qid being a 4-bit field (0-15) while the txq array supports only ATH9K_NUM_TX_QUEUES (10). A qid of 10 or higher causes an out-of-bounds access. The documente...

EUVD-2026-59488

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte halbuf without validating the response length. A response exceeding...

CVE-2026-74341 wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte halbuf without validating the response length. A response exceeding...

CVE-2026-74341

CVE-2026-74341 relates to a Linux kernel issue in the wifi wcn36xx driver where the firmware response dispatcher copies HAL responses into a 4096-byte hal_buf without validating length. Oversized responses can trigger a heap overflow with firmware-controlled content. The root cause is lack of bou...

CVE-2026-74341 wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte halbuf without validating the response length. A response exceeding...

CVE-2026-74340 wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

CVE-2026-74340 wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

CVE-2026-74340

CVE-2026-74340 describes a vulnerability in the Linux kernel’s wifi: wcn36xx path where the firmware-provided rsp->count field is used as the loop bound to index into the flexible rsp->regs[] array without validating against the received message length. If count exceeds the actual data, thi...

EUVD-2026-59487

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

CVE-2026-74324

Summary: CVE-2026-74324 affects Linux kernel wireless stack, specifically mt76/mt7925 testmode query handling. In mt7925_tm_query(), the response skb is copied with memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN) without validating length. MT7925_EVT_RSP_LEN is 512, so a firmware response ...