CVE-2026-68368 usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate datagram bounds in ncmunwrapntb When unpacking host-supplied NTBs, ncmunwrapntb checks datagram length against framemax but does not verify that the datagram fits within the declared block length...

CVE-2026-68368

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate datagram bounds in ncmunwrapntb When unpacking host-supplied NTBs, ncmunwrapntb checks datagram length against framemax but does not verify that the datagram fits within the declared block length...

EUVD-2026-55468

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: synchronize delayed setalt with teardown The ftcm setalt path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses ftcm private state and ma...

CVE-2026-68366 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...

EUVD-2026-55467

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...

CVE-2026-68366

The CVE concerns the Linux kernel USB gadget UVC path. In uvc_send_response, the code builds a control response from a user-supplied uvc_request_data and sets req->length = min(uvc->event_length, data->length). The operation then memcpy(req->buf, data->data, req->length). Since ...

CVE-2026-68365 USB: serial: io_edgeport: cap received transmit credits

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

CVE-2026-68365

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

CVE-2026-68365 USB: serial: io_edgeport: cap received transmit credits

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

EUVD-2026-55466

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

CVE-2026-68364

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix ISM dclock deadlock during suspend Why System hang observed during suspend/resume while video is playing. amdgpudmismdisable is called under dclock and waits for ISM delayed work via disabledelayedworksync. T...

CVE-2026-68363

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

EUVD-2026-55464

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

CVE-2026-68363

The CVE affects the Linux kernel ath9k wireless driver (ath9k_htc) in the hif_usb path. The vulnerability arises when an asynchronous firmware load is re-armed via request_firmware_nowait(), which passes hif_dev as the completion context and later dereferences hif_dev in a post-request dev_info()...

CVE-2026-68363 wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

CVE-2026-68362

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

CVE-2026-68362 wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

EUVD-2026-55463

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

CVE-2026-68362

CVE-2026-68362 concerns the Linux kernel driver ath11k. The issue was a NULL pointer dereference in ath11k_hal_srng_access_begin triggered by improper firmware_ready handling: ATH11K_QMI_EVENT_FW_READY would set ATH11K_FLAG_REGISTERED unconditionally, even if ath11k_core_qmi_firmware_ready() fail...

EUVD-2026-55462

In the Linux kernel, the following vulnerability has been resolved: hwmon: corsair-psu Stop device IO before calling hidhwstop hidhwstop does not stop the device IO. This results in a race condition between hidinputreport and the point immediately following the execution of hiddeviceiostart withi...