CVE-2026-64527 drm/hyperv: validate VMBus packet size in receive callback

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64526 ethtool: tsconfig: fix missing ethnl_ops_complete()

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnlopscomplete tsconfigpreparedata calls ethnlopsbegin, we need to call ethnlopscomplete before returning the error...

CVE-2026-64514

CVE-2026-64514 — Linux kernel (userfaultfd) details: The vulnerability concerns a gate must_wait writability check for userfaultfd on pte_present(). The kernel reads PTEs without holding the page table lock in userfaultfd_must_wait() and userfaultfd_huge_must_wait(), potentially decoding offset b...

CVE-2026-64508

CVE-2026-64508 relates to a Linux kernel vulnerability in BPF JIT memory reuse. The issue arises when the BPF JIT allocator reuses space for new programs, potentially letting indirect jumps reuse stale branch predictions. Fix implemented: flush indirect branch predictors on JIT memory reuse via a...

CVE-2026-64484 ALSA: es1938: check snd_ctl_new1() return value

In the Linux kernel, the following vulnerability has been resolved: ALSA: es1938: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. sndes1938mixer does not check the return value before dereferencing the pointer, which can lead to a NULL pointer dereference. A...

CVE-2026-64483 ALSA: firewire: isight: bound the sample count to the packet payload

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32tocpupayload-samplecount; if...

CVE-2026-64473

In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfscreatedevmseqfile store a devres allocated debugfsdevmentry as inode private data. vfiounregistergroupdev currently calls...

CVE-2026-64456

CVE-2026-64456 affects the Linux kernel virtio-rng driver. A malicious or buggy virtio-rng backend can over-report used.len to trap memcpy past the inline data buffer, reading adjacent slab memory. This enables a potential cross-boundary data leak of guest-kernel heap contents via /dev/hwrng and ...

CVE-2026-64452 6lowpan: fix NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

CVE-2026-64450

CVE-2026-64450: In Linux kernel TIPC, a broadcast Gap ACK blocks record could be read out-of-bounds due to a missing check that the record fits in the message data area. The bug occurs when tipc_get_gap_ack_blks() validates the len against ugack/bgack counts but not msg_data_sz(), allowing a reco...

CVE-2026-64450 tipc: fix out-of-bounds read in broadcast Gap ACK blocks

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...

EUVD-2026-48960

In the Linux kernel, the following vulnerability has been resolved: mm: swapcgroup: fix NULL deref in lookupswapcgroupid on swapless host lookupswapcgroupid passes swapcgroupctrltype.map to swapcgroupidlookup without checking that the type was ever registered via swapcgroupswapon. On a swapless...

CVE-2026-64414

CVE-2026-64414 : In the Linux kernel, the netfilter path handling unreadable fragments has been resolved. The issue arises when an skb with unreadable fragments (eg, from devmem TCP) is processed by the u32 module, causing skb_copy_bits() to return a negative error code. Mitigations described acr...

EUVD-2026-48955

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before findtablelock updatecounters and compatupdatecounters forward a user-supplied 32-byte table name to findtablelock without NUL-terminating it. On a lookup miss, findinlistlock calls...

CVE-2026-64408 Bluetooth: bnep: pin L2CAP connection during netdev registration

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...

EUVD-2026-48904

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfsbnoderead hfsbnoderead can return early without writing to the output buffer when isbnodeoffsetvalid fails or when checkandcorrectrequested length corrects the length to zero. Callers suc...

CVE-2026-64359

CVE-2026-64359 — Linux kernel (nilfs2) vulnerability : The issue arises when user-supplied segment numbers for CLEAN_SEGMENTS are not validated early, leading to long locking of ns_segctor_sem and a hung task scenario (e.g., chmod on a nilfs2 mount). The root cause is validation occurring deep in...

CVE-2026-64351 net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmiarxfixup kalmiarxfixup computes usbpacketlength = skb-len - 2 KALMIAHEADERLENGTH as a u16, guarded only by a pre-loop check that skb-len is at least KALMIAHEADERLENGTH, which is 6. ...

CVE-2026-64342 USB: iowarrior: fix use-after-free on disconnect

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect Submitted write URBs are not stopped on close and therefore need to be stopped unconditionally on disconnect to avoid use-after-free in the completion handler...

EUVD-2026-49035

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...