CVE-2026-64348

The CVE-2026-64348 issue in the Linux kernel affects EHCI/FOTG210 isochronous submits, where a staged usb_schedule (ehci_iso_sched) attached to urb->hcpriv could leak if usb_hcd_link_urb_to_ep() fails or the controller becomes inaccessible. The published fixes free the staged schedule from don...

EUVD-2026-48892

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehciisosched before linking the URB to the endpoint queue, and keep the staged schedule in urb-hcpriv until isostreamschedule and the link...

CVE-2026-64348 usb: free iso schedules on failed submit

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehciisosched before linking the URB to the endpoint queue, and keep the staged schedule in urb-hcpriv until isostreamschedule and the link...

CVE-2026-64348 usb: free iso schedules on failed submit

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehciisosched before linking the URB to the endpoint queue, and keep the staged schedule in urb-hcpriv until isostreamschedule and the link...

CVE-2026-64327 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

CVE-2026-64327

The CVE-2026-64327 in the Linux kernel affects usb: gadget: f_fs. The vulnerability occurred because epfile->in was initialized only in ffs_func_eps_enable(), which runs after USB host connection. Early userspace IOCTLs could observe epfile->in as 0, causing incorrect DMA directions. The fi...

CVE-2026-64307 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

CVE-2026-64286

CVE-2026-64286 affects the Linux kernel’s KVM on arm64. The vulnerability arises in flush_hyp_vcpu(): it copies the host vCPU context into the hyp private vCPU on every run. The guest-context resolver (ctxt_to_vcpu()) expects a NULL __hyp_running_vcpu (only set on the host); since the host’s valu...

EUVD-2026-48998

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear hyprunningvcpu when flushing the pKVM hyp vCPU flushhypvcpu copies the host vCPU context into the hyp's private vCPU on every run. ctxttovcpu expects a guest context to have a NULL hyprunningvcpu, which is only...

PT-2026-64507

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 implementation where the flush hyp vcpu function copies the host vCPU context into the hyp's private vCPU during every run. Because the ctxt to vcpu...

Linux Distros Unpatched Vulnerability : CVE-2026-64348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehciisosched before linking the URB to the endpoint queue, and keep the...

Linux Distros Unpatched Vulnerability : CVE-2026-64395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange...

Linux Distros Unpatched Vulnerability : CVE-2026-47054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-60161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-64464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xhci: sideband: fix ring sg table pages leak xhciringtosgtable allocates a temporary pages array and uses it to build the returned sgtable with...

Linux Distros Unpatched Vulnerability : CVE-2026-66041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vfquirc filter that allows an attacker to corrupt he...

Linux Distros Unpatched Vulnerability : CVE-2026-47055

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-60155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Difficult to explo...

Linux Distros Unpatched Vulnerability : CVE-2026-64252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations calling the initial console output handler from a kernel thread other...

Linux Distros Unpatched Vulnerability : CVE-2026-60162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Difficult to explo...