CVE-2026-64351 net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmiarxfixup kalmiarxfixup computes usbpacketlength = skb-len - 2 KALMIAHEADERLENGTH as a u16, guarded only by a pre-loop check that skb-len is at least KALMIAHEADERLENGTH, which is 6. ...

CVE-2026-64339

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...

CVE-2026-64339 usb: misc: usbio: bound bulk IN response length to the received transfer

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...

EUVD-2026-48873

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccgirqhandler calls ucsinotifycommon, which on a connector-change event calls ucsiconnectorchange and schedules connector work. In ucsiccgremove...

CVE-2026-64327 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

CVE-2026-64327

The CVE-2026-64327 in the Linux kernel affects usb: gadget: f_fs. The vulnerability occurred because epfile->in was initialized only in ffs_func_eps_enable(), which runs after USB host connection. Early userspace IOCTLs could observe epfile->in as 0, causing incorrect DMA directions. The fi...

CVE-2026-64263 fuse-uring: fix moving cancelled entry to ent_in_userspace list

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

PT-2026-64712

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix work UAF on disconnect tascam disconnect cancels capture work and midi in work before usb kill anchored urbs kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers...

Linux Distros Unpatched Vulnerability : CVE-2026-65904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's...

PT-2026-64626

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: Fix null ptr deref in hci abort conn hci abort conn read hci skb eventhdev-sent cmd when a connection was pending, but hdev-sent cmd can be NULL while req status is still HCI REQ PEND, leading to a NULL point...

Linux Distros Unpatched Vulnerability : CVE-2026-41637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost...

Linux Distros Unpatched Vulnerability : CVE-2026-59847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an...

Linux Distros Unpatched Vulnerability : CVE-2026-64339

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer...

PT-2026-64572

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia rx fixup kalmia rx fixup computes usb packet length = skb-len - 2 KALMIA HEADER LENGTH as a u16, guarded only by a pre-loop check that skb-len is at least KALMIA HEADER LENGTH,...

PT-2026-64729

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

Linux Distros Unpatched Vulnerability : CVE-2026-65901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-64508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those...

CVE-2026-54342

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...

CGA-25X3-VVHV-H7JM

Bulletin has no description...

CVE-2026-48034 HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...