CVE-2026-80575 Input: cs40l50-vibra - validate custom data from user space

In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50add copies the custom data of an FFPERIODIC/FFCUSTOM effect straight from the ffeffect the user passed to EVIOCSFF, without requiring it to hold anything:...

CVE-2026-80574 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

CVE-2026-80574

CVE-2026-80574 is an array out-of-bounds write in the Linux kernel's Focaltech input driver, specifically in the focaltech_process_rel_packet function. The root cause is that the finger1 and finger2 variables are signed; when a packet carries a finger index of 0, subtracting 1 yields -1 , which b...

CVE-2026-80575

CVE-2026-80575 affects the cs40l50-vibra Linux kernel input driver (a haptic vibration controller). The function cs40l50_add() copies user-supplied custom_data from an FF_PERIODIC/FF_CUSTOM effect via the EVIOCSFF ioctl without sufficient validation. Three distinct issues exist: custom_len == 0 c...

CVE-2026-80575 Input: cs40l50-vibra - validate custom data from user space

In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50add copies the custom data of an FFPERIODIC/FFCUSTOM effect straight from the ffeffect the user passed to EVIOCSFF, without requiring it to hold anything:...

CVE-2026-80573 Input: iforce - validate input packet lengths

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

CVE-2026-80573 Input: iforce - validate input packet lengths

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

CVE-2026-80569

CVE-2026-80569 is a heap buffer overflow in the Linux kernel's synaptics-rmi4 input driver. The F54 diagnostics function allocates its report_data buffer based on F54 electrode counts, but computes the transfer size from F55 electrode counts. A malicious or malfunctioning RMI4 device that reports...

CVE-2026-80569 Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmif54work reads a diagnostics report from the device into f54-reportdata, sizing the transfer with rmif54getreportsize: reportsize = rmif54getreportsizef5...

CVE-2026-80569 Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmif54work reads a diagnostics report from the device into f54-reportdata, sizing the transfer with rmif54getreportsize: reportsize = rmif54getreportsizef5...

CVE-2026-80566

This Linux kernel vulnerability affects the hynitron_cstxxx input driver. The root cause is insufficient validation of touch count and finger IDs against the allocated input slot range before processing touch reports. An out-of-range finger ID or an oversized touch count can corrupt the touch sta...

CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...

CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...

CVE-2026-80558 libceph: Avoid using invalid osd indices from primary_temp

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primarytemp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pgtemp, primarytemp, pgupmap, and pgupmapitems parts that don't exist, i.e., that are...

CVE-2026-80558 libceph: Avoid using invalid osd indices from primary_temp

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primarytemp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pgtemp, primarytemp, pgupmap, and pgupmapitems parts that don't exist, i.e., that are...

CVE-2026-80558

This Linux kernel vulnerability affects the libceph subsystem. A corrupted osdmap received from a Ceph monitor or OSD may contain OSD indices in its primary_temp field that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). While most OSD indices in the osdmap are validated, the one...

CVE-2026-80552 s390/vfio_ccw: Ensure index for read/write regions are within range

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing...

CVE-2026-80552

CVE-2026-80552 affects the Linux kernel on s390 architectures, specifically the vfio_ccw driver. When the capability chain was introduced, it correctly clamped region indexes to the capability range but neglected to apply the same bounds check to existing read/write regions , allowing out-of-rang...

CVE-2026-80552 s390/vfio_ccw: Ensure index for read/write regions are within range

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing...

CVE-2026-80550 s390/vfio_ccw: Fix out of bounds check on CCW array

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Fix out of bounds check on CCW array The routine ccwchaincalclength counts the number of channel command words CCWs that are chained together in a single channel program, and rejects anything larger than...