EUVD-2026-64586

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74649

A missing length validation in the Linux kernel rtl8723bs staging driver's WEP shared-key authentication handler (OnAuthClient()) allows a malicious Access Point to send a malformed WLAN_EID_CHALLENGE element with a length up to 255 bytes, which is then copied via memcpy() into a fixed 128-byte c...

CVE-2026-74649

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74649 staging: rtl8723bs: fix missing shared-key auth challenge length check

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74649 staging: rtl8723bs: fix missing shared-key auth challenge length check

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74647

CVE-2026-74647 is a race condition in the Linux kernel's fastrpc component (DSP interface). The function fastrpc_req_munmap_impl() removed a buffer from its internal list only after unmapping from the DSP. When multiple threads concurrently invoked unmap, one thread could remove the list entry wh...

CVE-2026-74647 misc: fastrpc: Remove buffer from list prior to unmap operation

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Remove buffer from list prior to unmap operation fastrpcreqmunmapimpl is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race...

EUVD-2026-64584

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Remove buffer from list prior to unmap operation fastrpcreqmunmapimpl is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race...

CVE-2026-74648

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

CVE-2026-74647

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Remove buffer from list prior to unmap operation fastrpcreqmunmapimpl is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race...

CVE-2026-74647 misc: fastrpc: Remove buffer from list prior to unmap operation

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Remove buffer from list prior to unmap operation fastrpcreqmunmapimpl is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race...

CVE-2026-74648 staging: rtl8723bs: validate monitor transmit frame lengths

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

EUVD-2026-64585

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

CVE-2026-74648

CVE-2026-74648 affects the rtl8723bs staging driver in the Linux kernel. The function rtw_cfg80211_monitor_if_xmit_entry() removes a radiotap header and then reads the 802.11 frame control field without verifying that a base 802.11 header remains. Additionally, the data path pulls the calculated ...

CVE-2026-74648 staging: rtl8723bs: validate monitor transmit frame lengths

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

CVE-2026-74646 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

EUVD-2026-64583

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

CVE-2026-74646

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

CVE-2026-74646

CVE-2026-74646 is a race condition in the Linux kernel's misc: fastrpc subsystem. When a fastrpc invoke is interrupted by a signal, fastrpc_internal_invoke() moves all buffers from fl->mmaps onto cctx->invoke_interrupted_mmaps via list_del()/list_add_tail() without holding fl->lock , the...

CVE-2026-74646 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...