CVE-2026-98206

The Linux kernel is affected by a vulnerability where the HID report size provided by a device is used as the length for a memcpy() operation into response_buf . Because the size field originates from the device without prior validation, it could lead to a buffer overflow if it exceeds CY_MAX_INP...

EUVD-2026-93134

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into responsebuf, which is CYMAXINPUT bytes...

CVE-2026-98205

The Linux kernel contains a vulnerability in the evdev subsystem where the EVIOCSABS handler copies a user-supplied size into an uninitialized on-stack input_absinfo structure. Because the size is controlled by userspace, a short size allows trailing parts of the structure to retain stale stack b...

EUVD-2026-93133

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...

EUVD-2026-93132

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

CVE-2026-98204

The Linux kernel contains an out-of-bounds read vulnerability in the rmi_smb_write_block() function within the rmi_smbus input. The root cause is an incorrect calculation of block_len, where the loop uses the original total length instead of the remaining length (cur_len). When the total length e...

CVE-2026-98203

The Linux kernel contains a vulnerability where the system may attempt to access btns_desc->package.elements[0] without first verifying that btns_desc->package.count is non-zero. This issue has been resolved by implementing a check to ensure the count is not 0 before accessing the array ele...

CVE-2026-98202

The Linux kernel contains a vulnerability where transport drivers (rmi_i2c and rmi_spi ) trigger a General Protection Fault (GPF) during system power management events. The issue occurs when rmi_driver_suspend() or rmi_driver_resume() is called on an unbound rmi_dev device. Because the transport ...

EUVD-2026-93131

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

EUVD-2026-93130

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Transport drivers such as rmii2c and rmispi invoke rmidriversuspend and rmidriverresume on their child rmidev device during system power management events. Howeve...

CVE-2026-98201

A vulnerability exists in the Linux kernel within the compat path of the input_ff_effect_from_user() function. The issue arises because the function aliases a native struct ff_effect with a smaller struct ff_effect_compat and only copies the compat-sized prefix using copy_from_user(). Consequentl...

CVE-2026-98200

The Linux kernel contains a use-after-free vulnerability in the hwmon (hp-wmi-sensors) component. The issue occurs because fungible_show() dereferences the nsensor->current_state pointer without holding state->lock, while the update_numeric_sensor_from_wobj() function frees and replaces tha...

EUVD-2026-93129

In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...

EUVD-2026-93128

In the Linux kernel, the following vulnerability has been resolved: hwmon: hp-wmi-sensors Fix use-after-free in fungibleshow nsensor-currentstate is dynamically replaced as the sensor's state changes. updatenumericsensorfromwobj does this by freeing the old string and installing a new one: if...

EUVD-2026-93127

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core increase number of phases and add new mask Increase the number of phases to 16 as a new upcoming device supports such a number. While at it, add a new mask for controlling the source of the output voltage. Note...

CVE-2026-98199

The Linux kernel contains a vulnerability in the hwmon (pmbus/core) component. The issue stems from the system supporting fewer phases than some hardware devices actually possess; specifically, the mp2975 driver supports up to 14 phases and the mp2856 driver supports up to 12 phases. This discrep...

CVE-2026-98197

In the Linux kernel , the w83791d driver incorrectly retains the w83791d_group_fanpwm45 sysfs group during normal teardown if the fan/pwm 4-5 pins are not used as GPIO. While the probe error path handles its removal, the normal remove path fails to do so, leaving these sysfs files active after th...

EUVD-2026-93126

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98198

The Linux kernel contains a vulnerability in the hwmon (pwm-fan) component where the sample_timer() function can access freed memory. This occurs because the cleanup action to stop the RPM timer is registered before the ctx->tachs and ctx->pulses_per_revolution arrays are allocated; since d...

EUVD-2026-93125

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are not used as GPIO, w83791dprobe creates the w83791dgroupfanpwm45 sysfs group on the I2C client device. The probe error path removes this group...