EUVD-2026-59100

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-68478 memstick: ms_block: reject a card that reports too many blocks

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-68478

The CVE-2026-68478 vulnerability is in the Linux kernel’s memstick handling (ms_block/ftl). msb_ftl_initialize computes zone_count from block_count without proper bound checking, indexing free_block_count[] (size MS_MAX_ZONES = 16). A card reporting more than 16 zones (8192 blocks) can cause out-...

CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

CVE-2026-68477

Cve-2026-68477 relates to the Linux kernel IP Virtual Server (ipvs) and fixes incorrect IPv6 transport offsets. The detailed description notes that the app code for TCP could assume an IPv4 network header even after the ipv6 context, causing issues for IPv6-enabled apps. The fix also corrects the...

EUVD-2026-59098

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...

CVE-2026-68477 ipvs: fix more places with wrong ipv6 transport offsets

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

CVE-2026-68476 ipvs: reload ip header after head reallocation

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...

CVE-2026-68476

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...

CVE-2026-68477

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

EUVD-2026-59099

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

CVE-2026-68476

CVE-2026-68476 affects the Linux kernel IPVS path. The vulnerability arises when __ip_vs_get_out_rt() calls skb_ensure_writable(), which may reallocate skb->head, possibly impacting packet handling. The issue has been resolved in the Linux kernel (relevant commits referenced in connected recor...

EUVD-2026-59097

In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxiresetinit, when ioremap fails, the memory region obtained via requestmemregion is not released, leading to a resource leak. Add an errmemregion label to properly...

CVE-2026-68475

Mode C: The CVE-2026-68475 entry concerns a Linux kernel sunxi reset path. In sunxi_reset_init(), if ioremap() fails, the memory region obtained with request_mem_region() is not released, causing a resource leak. The fix adds an err_mem_region label to properly release that memory region before f...

CVE-2026-68475 reset: sunxi: fix memory region leak on ioremap failure

In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxiresetinit, when ioremap fails, the memory region obtained via requestmemregion is not released, leading to a resource leak. Add an errmemregion label to properly...

CVE-2026-68475

In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxiresetinit, when ioremap fails, the memory region obtained via requestmemregion is not released, leading to a resource leak. Add an errmemregion label to properly...

EUVD-2026-59096

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...

EUVD-2026-59095

In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIGPPCE500 in maskuseraddress maskuseraddress incorrectly checks for CONFIGE500 instead of CONFIGPPCE500, causing maskuseraddressisel to not be used on E500 hardware. Fix the check to use the...

CVE-2026-68473 powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()

In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIGPPCE500 in maskuseraddress maskuseraddress incorrectly checks for CONFIGE500 instead of CONFIGPPCE500, causing maskuseraddressisel to not be used on E500 hardware. Fix the check to use the...

CVE-2026-68474 powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...