CVE-2026-68473 powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()

In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIGPPCE500 in maskuseraddress maskuseraddress incorrectly checks for CONFIGE500 instead of CONFIGPPCE500, causing maskuseraddressisel to not be used on E500 hardware. Fix the check to use the...

CVE-2026-68474 powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...

CVE-2026-68473

In the Linux kernel, the powerpc/uaccess issue fixes the check for CONFIG_PPC_E500 in mask_user_address(). The bug was that mask_user_address() checked CONFIG_E500 instead of CONFIG_PPC_E500, causing mask_user_address_isel() to not be used on E500 hardware. The root cause is the incorrect macro n...

CVE-2026-68474

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...

CVE-2026-68474

The CVE-2026-68474 issue affects the Linux kernel’s powerpc/spufs subsystem, specifically spufs_mem_mmap_access(). The local store offset is computed as address - vma->vm_start but bounds-checks are performed against vma->vm_end, which on 64-bit leaves the length unbounded relative to the L...

EUVD-2026-59094

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

CVE-2026-68472

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

CVE-2026-68471 wifi: ieee80211: validate MLE common info length

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

CVE-2026-68472 wifi: cfg80211: validate EHT MLE before MLD ID read

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

CVE-2026-68471

The CVE-2026-68471 entry describes a Linux kernel Wi-Fi (ieee80211) vulnerability in MLE length validation. The root cause is that ieee80211_mle_common_size() used the first common-info octet as the length for all MLE types, while ieee80211_mle_size_ok() only validated that octet for Basic, Probe...

CVE-2026-68472

In CVE-2026-68472, Linux kernel code path for wifi cfg80211 is vulnerable when processing MBSSID EHT MLE data. The issue arises in cfg80211_gen_new_ie() which copies ML probe response elements from the parent frame and may read beyond the IE boundary to obtain the MLD ID via ieee80211_mle_get_mld...

EUVD-2026-59093

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

CVE-2026-68471

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

EUVD-2026-59092

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

CVE-2026-68470

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

CVE-2026-68470 wifi: mac80211: validate extension-frame layout before RX

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

CVE-2026-68470

The CVE-2026-68470 vulnerability affects the Linux kernel’s wifi/mac80211 path. It occurs when validating extension-frame layout before RX, allowing extension subtypes beyond S1G beacons to reach regular-header RX processing and potentially read header addresses. The fix narrows RX routing to han...

EUVD-2026-59091

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENTSLEEP -...

CVE-2026-68469 wifi: mwifiex: fix permanently busy scans after multiple roam iterations

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENTSLEEP -...

CVE-2026-68469

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENTSLEEP -...