CVE-2026-90025

CVE-2026-90025 is an out-of-bounds array index flaw in the Linux kernel's UCSI DisplayPort driver (usb: typec: ucsi: displayport). The driver uses the GET_CURRENT_CAM response value to index a port altmode array of fixed length UCSI_MAX_ALTMODES , but only validates that the value is not 0xff wit...

CVE-2026-90025 usb: typec: ucsi: displayport: Fix OOB altmode array index

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM response after checking it is not 0xff. The port altmode array is...

CVE-2026-90025

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM response after checking it is not 0xff. The port altmode array is...

CVE-2026-90025 usb: typec: ucsi: displayport: Fix OOB altmode array index

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM response after checking it is not 0xff. The port altmode array is...

EUVD-2026-80633

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM response after checking it is not 0xff. The port altmode array is...

CVE-2026-90024

CVE-2026-90024 affects the Linux kernel USB gadget MIDI 2.0 function (drivers/usb/gadget/function/f_midi2.c). When the block direction is set to SNDRV_UMP_DIR_INPUT via configfs, the midi1_ep_out endpoint initialization is skipped during the gadget bind phase, leaving usb_ep->card as NULL . La...

CVE-2026-90024

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

CVE-2026-90024 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

EUVD-2026-80632

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

CVE-2026-90023

CVE-2026-90023 is a null pointer dereference in the Linux kernel USB gadget f_mass_storage driver, specifically in fsg_common_set_num_buffers(). The root cause is that the earlier removal of fsg_num_buffers_validate() relied on Kconfig limits (2–256) for the buffer count n, but a user can write p...

CVE-2026-90022 usb: gadget: f_midi2: fix use-after-free in string attribute show path

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

EUVD-2026-80630

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

CVE-2026-90023

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...

EUVD-2026-80631

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...

CVE-2026-90022

CVE-2026-90022 is a use-after-free vulnerability in the Linux kernel 's USB gadget f_midi2 driver. The function f_midi2_opts_str_show() acquires the string lock internally, but its callers dereference the opts->info. pointer before calling it, outside the lock. This races with f_midi2_opts_str...

CVE-2026-90022 usb: gadget: f_midi2: fix use-after-free in string attribute show path

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

CVE-2026-90022

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

CVE-2026-90023 usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...

EUVD-2026-80629

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...

CVE-2026-90021 usb: gadget: f_midi: initialize work in f_midi_alloc()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...