CVE-2026-89442 platform/x86: ISST: Validate socket ID in clos_assoc ioctl

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89442 platform/x86: ISST: Validate socket ID in clos_assoc ioctl

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

PT-2026-90336

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap buffer overflow exists in the intel-thc-hid driver within the intel-quickspi component. The write cmd to txdma function constructs an output report in qsdev-report buf, which is...

PT-2026-90222

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/uverbs component where the UVERBS METHOD REG MR method failed to include UVERBS ATTR UHW. This omission affects the mthca, irdma, and siw drivers, which have...

CVE-2026-89620: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89553: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted...

CVE-2026-89443: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

PT-2026-96461

In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted...

CVE-2026-89442: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

PT-2026-90269

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the non-uvmm path of the nouveau/gem component. This occurs between the info lookup process finding the vma and the gem close path closing the vma, which can...

PT-2026-96379

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in clos assoc ioctl isst if clos assoc validates the user-supplied socket id with 'socket id topology max packages', but isst common.sst inst is allocated with topology max packages entries,...

PT-2026-90158

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the ISST driver. The isst if clos assoc function incorrectly validates the user-supplied socket id using a greater-than comparison against topolog...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107291)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107291 advisory. In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduced signed...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107282)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107282 advisory. In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: flatpak (UTSA-2025-002801)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002801 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a...

CVE-2025-51619

A vulnerability in the Thesycon DPC Latency Checker driver dpc.sys thru 1.4.0 allows local unprivileged users to cause a denial-of-service BSOD condition on Windows systems. The driver exposes an IOCTL interface 0x81772008 that accepts user-controlled input without validating pointers before...

kernel: i2c: stub: Reject I2C block transfers with invalid length

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

kernel: i2c: stub: Reject I2C block transfers with invalid length

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

CVE-2025-51619

A vulnerability in the Thesycon DPC Latency Checker driver dpc.sys thru 1.4.0 allows local unprivileged users to cause a denial-of-service BSOD condition on Windows systems. The driver exposes an IOCTL interface 0x81772008 that accepts user-controlled input without validating pointers before...

CVE-2025-51619

The Thesycon DPC Latency Checker driver (dpc.sys) versions through 1.4.0 on Windows systems contains a vulnerability allowing local unprivileged users to cause a denial-of-service (BSOD) . The root cause is an improper input validation flaw in an IOCTL interface (0x81772008), where the driver der...