CVE-2026-64440

CVE-2026-64440 (Linux kernel) : The vulnerability affects the rtl8723bs HT_capabilities handling in staging. HT_caps_handler() reads pIE->length bytes and writes into a fixed 26-byte HT_cap[]; since pIE->length is from an unvalidated 802.11 AssocResponse, an AP can set it to 255, causing up...

EUVD-2026-48784

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof struct HTcapselement. Because pIE-length is a raw u8 from an...

CVE-2026-64440

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof struct HTcapselement. Because pIE-length is a raw u8 from an...

EUVD-2026-48921

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

CVE-2026-64377 cpufreq: qcom-cpufreq-hw: Fix possible double free

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

CVE-2026-64377 cpufreq: qcom-cpufreq-hw: Fix possible double free

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

CVE-2026-64377

In the Linux kernel, the cpufreq: qcom-cpufreq-hw driver has a double-free fix. qcom_cpufreq.data is allocated with devm_kzalloc() as a per-domain array, and qcom_cpufreq_hw_cpu_init() stores a pointer to an element in policy->driver_data. The driver’s exit path previously invoked kfree() on p...

CVE-2026-64377

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

CVE-2026-64359

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

EUVD-2026-48903

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

CVE-2026-64359 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

CVE-2026-64359 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

CVE-2026-64359

CVE-2026-64359 — Linux kernel (nilfs2) vulnerability : The issue arises when user-supplied segment numbers for CLEAN_SEGMENTS are not validated early, leading to long locking of ns_segctor_sem and a hung task scenario (e.g., chmod on a nilfs2 mount). The root cause is validation occurring deep in...

CVE-2026-64272 Input: mms114 - fix touch indexing for MMS134S and MMS136

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

CVE-2026-64272

The CVE-2026-64272 issue applies to the Linux kernel, affecting MMS114-driven touch controllers MMS134S and MMS136. The event size is 6 bytes, but the driver reads into a buffer using an 8-byte per-entry assumption (sizeof(struct mms114_touch)), causing subsequent events to be read from incorrect...

CVE-2026-64272

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

EUVD-2026-48984

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

CVE-2026-64272 Input: mms114 - fix touch indexing for MMS134S and MMS136

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

JLSEC-2026-796 XSS via unescaped code-fence language in default code block renderer

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out...

JLSEC-2026-791 Writing to SFTP files resulting in sending out-of-bounds data to the server

Impact The write::SftpFile, ::DenseVector method assumed that the element type of the input vector had a size of 1 byte e.g. Int8/UInt8, and used lengthdata instead of sizeofdata to get the number of bytes to send. If the input vector had a eltype with size more than 1 byte then this would result...