CVE-2026-63839

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmidevevaluateint lwmidevevaluateint leaks output.pointer when retval == NULL found by sashiko.dev 1. Fix it by moving retobj = output.pointer' outside of the if retval' block...

CVE-2026-64012

In the Linux kernel, the following vulnerability has been resolved: net/sched: schsfb: Replace direct dequeue call with peek and qdiscdequeuepeeked When sfb has children eg qfq qdisc whose peek callback is qdiscpeekdequeued, we could get a kernel panic. When the parent of such qdiscs eg illustrat...

CVE-2026-64004

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucvsocksetsockopt and wrap the whole switch in locksock/releasesock. The pre-existing SOMSGLIMIT-only lock becomes redundant and is removed. Any AFIUCV HIPER user can potentially crash...

CVE-2026-64004 net/iucv: fix locking in .getsockopt

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucvsocksetsockopt and wrap the whole switch in locksock/releasesock. The pre-existing SOMSGLIMIT-only lock becomes redundant and is removed. Any AFIUCV HIPER user can potentially crash...

CVE-2026-64004

CVE-2026-64004 concerns the Linux kernel net/iucv subsystem. The vulnerability arises from a race between recvmsg() and getsockopt(SO_MSGSIZE) where the SO_MSGSIZE path dereferences iucv->hs_dev->mtu after iucv_sock_close() has set hs_dev to NULL, causing a NULL pointer dereference oops. Mi...

CVE-2026-64004 net/iucv: fix locking in .getsockopt

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucvsocksetsockopt and wrap the whole switch in locksock/releasesock. The pre-existing SOMSGLIMIT-only lock becomes redundant and is removed. Any AFIUCV HIPER user can potentially crash...

EUVD-2026-45577

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucvsocksetsockopt and wrap the whole switch in locksock/releasesock. The pre-existing SOMSGLIMIT-only lock becomes redundant and is removed. Any AFIUCV HIPER user can potentially crash...

EUVD-2026-45564

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skbclone return value in sendmcastpkt The skbclone function can return NULL if memory allocation fails. sendmcastpkt calls skbclone without checking the return value, which can lead to a NULL pointer...

CVE-2026-63991

The CVE CVE-2026-63991 concerns the Linux kernel Bluetooth 6lowpan path. The issue: skb_clone() may return NULL on allocation failure, and send_mcast_pkt() did not check this, risking a NULL pointer dereference in send_pkt() when dereferencing skb->data. The connected records indicate a fix wa...

CVE-2026-63991 Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skbclone return value in sendmcastpkt The skbclone function can return NULL if memory allocation fails. sendmcastpkt calls skbclone without checking the return value, which can lead to a NULL pointer...

CVE-2026-63991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skbclone return value in sendmcastpkt The skbclone function can return NULL if memory allocation fails. sendmcastpkt calls skbclone without checking the return value, which can lead to a NULL pointer...

CVE-2026-63973

Concrete details found: Linux kernel net: mana module added NULL guards in teardown paths to prevent panics when attach fails. The fix protects against dereferencing apc->rxqs and apc->tx_qp after partial queue allocation failures. Affected functions and behavior: mana_chn_setxdp() now chec...

CVE-2026-63973 net: mana: Add NULL guards in teardown path to prevent panic on attach failure

In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc-txqp and apc-rxqs. Multiple teardown paths such as manaremove,...

CVE-2026-63973 net: mana: Add NULL guards in teardown path to prevent panic on attach failure

In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc-txqp and apc-rxqs. Multiple teardown paths such as manaremove,...

CVE-2026-63973

In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc-txqp and apc-rxqs. Multiple teardown paths such as manaremove,...

EUVD-2026-45746

In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc-txqp and apc-rxqs. Multiple teardown paths such as manaremove,...

CVE-2026-63972

The CVE-2026-63972 entry concerns the Linux kernel vulnerability in the mana net driver. Affected component: mana per-port queue handling in the kernel’s mana_detach path. Root cause: after a prior detach succeeded but attach failed, a port remained detached with apc->tx_qp and apc->rxqs fr...

CVE-2026-63972

In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When manaperportqueueresetworkhandler runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc-txqp and apc-rxqs already...

EUVD-2026-45745

In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When manaperportqueueresetworkhandler runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc-txqp and apc-rxqs already...

EUVD-2026-45737

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...