746408 matches found
CVE-2026-80788
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...
EUVD-2026-71423
In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...
CVE-2026-80781
CVE-2026-80781 is an out-of-bounds read in the Linux kernel's HID core subsystem. The function hid_set_field() passes field->usage + offset to hid_dump_input() before validating that the offset is within field->report_count. When CONFIG_DEBUG_FS is enabled, hid_dump_input() dereferences the...
CVE-2026-80781
In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset: hiddumpinputfield-report-device, field-usage + offset, value; if offset =...
EUVD-2026-71424
In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset: hiddumpinputfield-report-device, field-usage + offset, value; if offset =...
CVE-2026-80779
In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...
CVE-2026-80779
CVE-2026-80779 is a Linux kernel vulnerability in the net/ionic network driver. The dedicated hardware timestamp RX queue is allocated with an index equal to nrxqs_per_lif , but the txqcqs array only holds regular queue pairs. Using that out-of-bounds index to set rxq->partner can read one ent...
CVE-2026-80779 net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...
EUVD-2026-71422
In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...
EUVD-2026-71419
In the Linux kernel, the following vulnerability has been resolved: futex: Fix race in futexpivotpending during private hash resize A task performing a custom private hash resize can remain blocked in uninterruptible sleep indefinitely. The hung-task detector reports: INFO: task futex-resizer:314...
CVE-2026-80772 HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses it, guarding the cast only with a 12-byte length check: if size = 12 /...
CVE-2026-80772
CVE-2026-80772 is an out-of-bounds read in the Linux kernel 's HID Nintendo driver, specifically in joycon_ctlr_read_handler(). The function guards a cast of incoming HID input reports to a 49-byte struct joycon_input_report with only a 12-byte length check. A 12-byte report with data[0] == JC_IN...
CVE-2026-80772
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses it, guarding the cast only with a 12-byte length check: if size = 12 /...
EUVD-2026-71408
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTHHIDINITIALDEVICEINFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsconreceivedeviceinfo trusts...
CVE-2026-80765
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTHHIDINITIALDEVICEINFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsconreceivedeviceinfo trusts...
CVE-2026-80765
CVE-2026-80765 affects the Linux kernel 's Hyper-V synthetic HID driver. The function mousevsc_on_receive_device_info() trusts the bLength and wDescriptorLength fields in SYNTH_HID_INITIAL_DEVICE_INFO messages without verifying that the received VMBus packet actually contains both the HID descrip...
CVE-2026-80765 HID: hyperv: validate initial device info bounds
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTHHIDINITIALDEVICEINFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsconreceivedeviceinfo trusts...
EUVD-2026-71406
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...
CVE-2026-80763
CVE-2026-80763 is an out-of-bounds read in the Linux kernel Bluetooth HCI subsystem. In hci_cc_le_set_cig_params(), the handler trusts the num_handles field of the LE Set CIG Parameters Command Complete response and reads the trailing handle array without verifying that the remaining skb data act...
CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...