CVE-2026-64015 security/keys: fix missed RCU read section on lookup

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assocarrayfind in findkeytoupdate without holding the RCU read lock, while the assocarraygc code really is designed around...

EUVD-2026-45587

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO datalen/xlen to URB buffer size nexioreaddata pulls datalen and xlen from a packed be16 header in the device's interrupt packet and then walks packet-data0..xlen and packet-dataxlen..datalen...

EUVD-2026-45580

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...

CVE-2026-64001

Vulnerability: CVE-2026-64001 in the Linux kernel’s ALSA: pcm: oss path. The bug arises in snd_pcm_oss_proc_write() where a newly allocated setup entry is linked into the OSS setup_list before the task-name is safely duplicated; if the task-name allocation fails, the error path frees the linked e...

CVE-2026-64001 ALSA: pcm: oss: Fix setup list UAF on proc write error

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error sndpcmossprocwrite links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the...

CVE-2026-64001 ALSA: pcm: oss: Fix setup list UAF on proc write error

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error sndpcmossprocwrite links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the...

CVE-2026-63987

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NETDIMPARAMSNUMPROFILES ethnlupdateprofile walks the ETHTOOLAPROFILEIRQMODERATION nest list with an index 'i' and writes newprofilei++ without bounding i. The destination is kmemdup'd at...

CVE-2026-63967

In the Linux kernel, the following vulnerability has been resolved: iio: imu: stlsm6dsx: fix stack leak in tagged FIFO buffer The tagged FIFO path declares iiobuff on the stack with aligned8 but no initializer, but there is a hole in the structure, which will then leak to userspace as...

CVE-2026-63958

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsiconnectorchange The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsiconnectorchange uses it to index the ucsi-connector array without checki...

CVE-2026-63958

The CVE affects the Linux kernel USB Type-C UCSI implementation. In ucsi_connector_change(), the 7-bit connector number from a UCSI CCI notification is used to index ucsi->connector[] without validating it against the number of connectors reported at init time. A buggy/malicious PPM (EC firmwa...

CVE-2026-63958 usb: typec: ucsi: validate connector number in ucsi_connector_change()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsiconnectorchange The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsiconnectorchange uses it to index the ucsi-connector array without checki...

CVE-2026-63958

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsiconnectorchange The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsiconnectorchange uses it to index the ucsi-connector array without checki...

CVE-2026-63934 iio: gyro: itg3200: fix i2c read into the wrong stack location

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: itg3200: fix i2c read into the wrong stack location itg3200readallchannels takes be16 buf' as a parameter and fills the i2cmsg destination as char &buf'. Since buf' is the parameter a pointer, &buf' is the address of t...

CVE-2026-63920

The CVE-2026-63920 entry describes a Linux kernel vulnerability in IPv6 extension header handling. The issue arises when ip6_datagram_recv_specific_ctl() builds IPV6_…cmsgs by trusting on-wire hdrlen (ptr[1]) during put_cmsg() length calculation. Although the write to hdrlen is in-bounds, reading...

CVE-2026-53392

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count fflayoutalloclseg decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzallocobjs, and the current code only rejects...

CVE-2026-63808

CVE-2026-63808 (Linux kernel exFAT): The vulnerability is a potential use-after-free in exfat_find_dir_entry() where a buffer_head is freed before all reads on the TYPE_EXTEND path, leading to a read from invalid memory. The root cause is brelse(bh) occurring before ep is no longer dereferenced; ...

EUVD-2026-45466

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...

CVE-2026-63794

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sevdbgcrypt for ENCRYPT path In sevdbgcrypt, the per-iteration transfer length is bounded by the source page offset PAGESIZE - soff but not by the destination page offset PAGESIZE - doff. When doff...

EUVD-2026-45460

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sevdbgcrypt for ENCRYPT path In sevdbgcrypt, the per-iteration transfer length is bounded by the source page offset PAGESIZE - soff but not by the destination page offset PAGESIZE - doff. When doff...

CVE-2026-53401

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfbmmap omapfbmmap has a race condition with OMAPFBSETUPPLANE ioctl that can lead to use-after-free: The fbmmap entry point holds mmlock but not lock fbinfo-lock, while ioctl handlers like...