254 matches found
EUVD-2026-49591
In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by...
CVE-2026-64540
In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by...
CVE-2026-64540
The CVE-2026-64540 issue affects the Linux kernel usbnet driver for GeneLink GL620A. A vulnerability in genelink_rx_fixup() could allow an out-of-bounds read by splitting an aggregated RX frame and using per-packet lengths that aren’t checked against the received data, enabling a malicious GL620A...
CVE-2026-64351
A flaw was found in the Linux kernel's USB Kalmia driver. An attacker with a specially crafted USB device could exploit an out-of-bounds read vulnerability in the kalmiarxfixup function. This occurs due to an incorrect calculation of the USB packet length when processing short bulk-IN frames,...
CVE-2026-64233
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...
UBUNTU-CVE-2026-64233
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...
PT-2026-65215
In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink rx fixup genelink rx fixup splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL...
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
...
UBUNTU-CVE-2026-64431
In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...
EUVD-2026-48775
In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...
CVE-2026-64431
Summary of CVE-2026-64431 (Linux kernel NTFS driver): A memory corruption vulnerability arises when post_write_mst_fixup() is called for an invalid index_block after ntfs_ib_write() returns an error. The root cause is that ntfs_icx_ib_sync_write() treated any error as a write failure and invoked ...
CVE-2026-64431
In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...
CVE-2026-64351
In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmiarxfixup kalmiarxfixup computes usbpacketlength = skb-len - 2 KALMIAHEADERLENGTH as a u16, guarded only by a pre-loop check that skb-len is at least KALMIAHEADERLENGTH, which is 6. ...
CVE-2026-64351
CVE-2026-64351 affects the Linux kernel USB Kalmia driver (kalmia_rx_fixup). The bug computes usb_packet_length as skb->len - (2 * KALMIA_HEADER_LENGTH) without ensuring both framing headers are present on every loop iteration. This can allow a short bulk-IN frame to underflow usb_packet_lengt...
EUVD-2026-48895
In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmiarxfixup kalmiarxfixup computes usbpacketlength = skb-len - 2 KALMIAHEADERLENGTH as a u16, guarded only by a pre-loop check that skb-len is at least KALMIAHEADERLENGTH, which is 6. ...
Linux Distros Unpatched Vulnerability : CVE-2026-64431
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls...
DEBIAN-CVE-2026-64233
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...
CVE-2026-64233
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-;extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four...
SUSE CVE-2026-63799
In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Fix OOB clearbit when CID is MMCIDUNSET in fixup path In mmcidfixupcpustotasks, when rq-curr has the target mm and mmcid.active is set, the CID is checked with cidintransit before setting the transition bit. In per-C...
CVE-2026-63799
In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Fix OOB clearbit when CID is MMCIDUNSET in fixup path In mmcidfixupcpustotasks, when rq-curr has the target mm and mmcid.active is set, the CID is checked with cidintransit before setting the transition bit. In per-C...