CVE-2026-74683

A flaw was found in the Linux kernel's evdev component. A local user could provide a specially crafted event type index to the EVIOCGMASK or EVIOCSMASK ioctls. This could lead to speculative execution mispredicting bounds checks and performing out-of-bounds loads, potentially resulting in...

CVE-2026-74676

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74595

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

CVE-2026-74683

CVE-2026-74683 is a speculative execution vulnerability in the Linux kernel's evdev input subsystem . The user-supplied event type index passed to the EVIOCGMASK and EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and the client evmasks array in evdev_get_mask()...

EUVD-2026-64370

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt and client evmasks array i...

EUVD-2026-64363

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74676

CVE-2026-74676 affects the Linux kernel virtual terminal (VT) subsystem. The KDSKBMETA ioctl, which modifies keyboard meta mode, lacked the !perm permission check enforced by all other keyboard setter ioctls in vt_k_ioctl() . This allowed a process to change the meta mode on a non-controlling con...

CVE-2026-74676 vt: add permission check for KDSKBMETA ioctl

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74676 vt: add permission check for KDSKBMETA ioctl

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

PT-2026-79681

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt k ioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74467

A flaw was found in the s390/qeth component of the Linux kernel. An unprivileged local user could exploit this vulnerability by invoking specific SIOCDEVPRIVATE ioctl commands, such as SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE, and SIOCQETHQUERYOAT. These commands were not properly restricte...

CVE-2026-49429

The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...

EUVD-2026-62241

The ZFSIOCSETPROP ioctl, used by zfs-set8, incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv8 stream. Any local user can set the internal ZFS metadata flag "$hasrecvd" on...

CVE-2026-49431

The ZFS_IOC_SET_PROP ioctl in FreeBSD's OpenZFS component incorrectly validated the calling user, allowing any local user to set the internal "$hasrecvd" metadata flag on datasets, falsely indicating they received properties from a zfs-recv(8) stream. The BDU assessment classifies this as an acce...

CVE-2026-49429

A kernel heap overflow in the OpenZFS component of FreeBSD affects the ZFS_IOC_USERSPACE_MANY ioctl used by zfs-userspace(8). The root cause is a 64-bit to 32-bit truncation : the output buffer size is truncated to 32 bits for kernel allocation, but the original 64-bit value is used as the write ...

EUVD-2026-62239

The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...

CVE-2026-72311

A flaw was found in the Linux kernel's drm/xe driver. A local user could trigger a memory leak by repeatedly making ioctl calls that fail the L2 flush validation. This improper memory management can lead to a Denial of Service DoS due to resource exhaustion...

CVE-2026-72294

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component, specifically within the LoongArch architecture. The kvmvcpuioctlinterrupt function, which can be invoked from userspace, lacks proper validation of interrupt requests. This missing validity check could allow a loca...

CVE-2026-61407

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

EUVD-2026-60940

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...