CVE-2026-64030

The CVE-2026-64030 entries describe a Linux kernel WiFi bug in mac80211 (ieee80211_ml_epcs) where link_id = 15 can read sdata->link[15] beyond the 0..14 range, causing a crash when processing an EPCS Enable Response from a WiFi 7 AP. A NULL-check slip and dereferencing link->sdata leads to ...

CVE-2026-64018

The Linux kernel vulnerability CVE-2026-64018 affects net: mana: validate rx_req_idx to prevent out-of-bounds array access. Root cause: mana_hwc_rx_event_handler() uses rx_req_idx derived from sge->address in DMA-coherent memory, and in Confidential VMs (SEV-SNP/TDX) this memory is shared unen...

EUVD-2026-45591

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler, rxreqidx is derived from sge-address in DMA-coherent memory. In Confidential VMs SEV-SNP/TDX, this memory is shared unencrypted and HW c...

CVE-2026-64018 net: mana: validate rx_req_idx to prevent out-of-bounds array access

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler, rxreqidx is derived from sge-address in DMA-coherent memory. In Confidential VMs SEV-SNP/TDX, this memory is shared unencrypted and HW c...

CVE-2026-64018 net: mana: validate rx_req_idx to prevent out-of-bounds array access

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler, rxreqidx is derived from sge-address in DMA-coherent memory. In Confidential VMs SEV-SNP/TDX, this memory is shared unencrypted and HW c...

CVE-2026-64014

The CVE-2026-64014 issue affects the Linux kernel USB touchscreen path for NEXIO devices (nexio_read_data). It describes a vulnerability where data_len and x_len are read from a 16-bit header and used to walk packet data without proper bounds, potentially enabling a ~64 KiB out-of-bounds read pas...

CVE-2026-64009

The CVE-2026-64009 family affects the Linux kernel xfrm subsystem, specifically an out-of-bounds write in ESP handling due to an underflow in xfrm_state_mtu(). The function computes using unsigned arithmetic: it subtracts attacker-influenced header_len + authsize + net_adj from a small mtu, allow...

CVE-2026-64009

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

CVE-2026-64000 net: hsr: fix potential OOB access in supervision frame handling

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeofstruct hsrsuptlv to the pskbmaypull calls. Without this, a truncated frame could cause an...

CVE-2026-64000 net: hsr: fix potential OOB access in supervision frame handling

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeofstruct hsrsuptlv to the pskbmaypull calls. Without this, a truncated frame could cause an...

EUVD-2026-45573

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeofstruct hsrsuptlv to the pskbmaypull calls. Without this, a truncated frame could cause an...

CVE-2026-63996 ethtool: cmis: require exact CDB reply length

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

CVE-2026-63996 ethtool: cmis: require exact CDB reply length

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

EUVD-2026-45569

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

CVE-2026-63996

CVE-2026-63996 concerns the Linux kernel ethtool cmis path. The issue arises when a malicious SFP module responds with a reply length longer than what cmis_cdb_process_reply() expects, potentially causing out-of-bounds writes. The fix involves strengthening the existing length checks to also guar...

CVE-2026-63996

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

CVE-2026-63995 ethtool: cmis: validate start_cmd_payload_size from module

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63995 ethtool: cmis: validate start_cmd_payload_size from module

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

EUVD-2026-45568

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63995

CVE-2026-63995 affects the Linux kernel ethtool CMIS firmware update path. The CMIS FW update code reads start_cmd_payload_size from the module FW Management Features CDB reply and uses it directly as the byte count for memcpy, writing into a destination buffer of 112 bytes (ETHTOOL_CMIS_CDB_LPL_...