CVE-2026-98207 mmc: spi: reset bytes_xfered before retrying CRC failures

In the Linux kernel, the following vulnerability has been resolved: mmc: spi: reset bytesxfered before retrying CRC failures mmcspidatado updates data-bytesxfered after each block has been transferred successfully. If a later block in the same data request fails with a CRC error, data-bytesxfered...

EUVD-2026-93135

In the Linux kernel, the following vulnerability has been resolved: mmc: spi: reset bytesxfered before retrying CRC failures mmcspidatado updates data-bytesxfered after each block has been transferred successfully. If a later block in the same data request fails with a CRC error, data-bytesxfered...

CVE-2026-98206 Input: cyttsp5 - clamp the HID report size before memcpy

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into responsebuf, which is CYMAXINPUT bytes...

EUVD-2026-93134

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into responsebuf, which is CYMAXINPUT bytes...

CVE-2026-98206

The Linux kernel is affected by a vulnerability where the HID report size provided by a device is used as the length for a memcpy() operation into response_buf . Because the size field originates from the device without prior validation, it could lead to a buffer overflow if it exceeds CY_MAX_INP...

CVE-2026-98206 Input: cyttsp5 - clamp the HID report size before memcpy

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into responsebuf, which is CYMAXINPUT bytes...

CVE-2026-98205 Input: evdev - zero absinfo before partial copy in EVIOCSABS

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...

CVE-2026-98205 Input: evdev - zero absinfo before partial copy in EVIOCSABS

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...

CVE-2026-98205

The Linux kernel contains a vulnerability in the evdev subsystem where the EVIOCSABS handler copies a user-supplied size into an uninitialized on-stack input_absinfo structure. Because the size is controlled by userspace, a short size allows trailing parts of the structure to retain stale stack b...

EUVD-2026-93133

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...

CVE-2026-98204 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

EUVD-2026-93132

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

CVE-2026-98204

The Linux kernel contains an out-of-bounds read vulnerability in the rmi_smb_write_block() function within the rmi_smbus input. The root cause is an incorrect calculation of block_len, where the loop uses the original total length instead of the remaining length (cur_len). When the total length e...

CVE-2026-98204 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

CVE-2026-98202 Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Transport drivers such as rmii2c and rmispi invoke rmidriversuspend and rmidriverresume on their child rmidev device during system power management events. Howeve...

CVE-2026-98203 Input: soc_button_array - check btns_desc->package.count

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

CVE-2026-98203

The Linux kernel contains a vulnerability where the system may attempt to access btns_desc->package.elements[0] without first verifying that btns_desc->package.count is non-zero. This issue has been resolved by implementing a check to ensure the count is not 0 before accessing the array ele...

CVE-2026-98202 Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Transport drivers such as rmii2c and rmispi invoke rmidriversuspend and rmidriverresume on their child rmidev device during system power management events. Howeve...

EUVD-2026-93131

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

CVE-2026-98202

The Linux kernel contains a vulnerability where transport drivers (rmi_i2c and rmi_spi ) trigger a General Protection Fault (GPF) during system power management events. The issue occurs when rmi_driver_suspend() or rmi_driver_resume() is called on an unbound rmi_dev device. Because the transport ...