414075 matches found
CVE-2026-80783
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unbounded recursion in magicmouserawevent magicmouserawevent handles DOUBLEREPORTID 0xf7 packets, which pack two touch reports into one, by splitting the packet and calling itself on each half. The only...
AZL-99492 CVE-2026-80783 affecting package kernel 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unbounded recursion in magicmouserawevent magicmouserawevent handles DOUBLEREPORTID 0xf7 packets, which pack two touch reports into one, by splitting the packet and calling itself on each half. The only...
CVE-2026-80760
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...
CVE-2020-0023
CVE-2020-0022 Seems like Android 9-6 have similar Bluetooth subsystem, Android 5 and 4 are different. Android 9.0 BlueFrag experiments Patch: https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf Below I hit the patched condition. OK I think I got it, but...
CVE-2026-80852 tls: device: fix out-of-bounds write in tls_append_frag()
In the Linux kernel, the following vulnerability has been resolved: tls: device: fix out-of-bounds write in tlsappendfrag Found with syzkaller and a local syzbot instance running on top of a netdevsim TLS offload emulation; tlsdevice.c is otherwise only reachable on a machine with a NIC that...
CVE-2026-85670
tokenizers Hugging Face is affected by an out-of-bounds buffer access in BpeBuilder::build tokenizers/src/models/bpe/model.rs. When loading a tokenizer.json via Tokenizer::fromfile/fromstr, the builder sizes a scratch buffer to the longest vocabulary key, then writes each concatenated merge rule...
CVE-2026-80814 rndis_host: add overflow check in rndis_rx_fixup()
In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...
CVE-2026-80814
A vulnerability in the Linux kernel 's rndis_host driver (a USB RNDIS host driver) was identified in the rndis_rx_fixup() function. The root cause is a missing overflow check: if data_offset + data_len + 8 wraps around, it enables an out-of-bounds (OOB) read of the USB data buffer. The fix, as de...
CVE-2026-80814
In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...
CVE-2026-80814 rndis_host: add overflow check in rndis_rx_fixup()
In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...
EUVD-2026-71249
In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...
CVE-2026-80811 io_uring/cmd: fix iovec leak when the async cmd is not recycled
In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...
CVE-2026-80811 io_uring/cmd: fix iovec leak when the async cmd is not recycled
In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...
CVE-2026-80811
CVE-2026-80811 is a memory leak in the Linux kernel's io_uring/cmd subsystem. An io_async_cmd carries an iovec array that is allocated when the vector must grow and retained across recycling via ctx->cmd_cache. On two code paths, the iovec is never freed: io_req_uring_cleanup() only clears the...
EUVD-2026-71245
In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...
CVE-2026-80810
In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...
CVE-2026-80810 io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...
CVE-2026-80810 io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...
CVE-2026-80810
CVE-2026-80810 is an out-of-bounds write/read vulnerability in the Linux kernel's io_uring resource management subsystem. The root cause is an integer overflow in io_vec_fill_bvec(), which computes the folio size using a plain int 1 shifted by imu->folio_shift. When folio_shift is 32 or greate...
EUVD-2026-71243
In the Linux kernel, the following vulnerability has been resolved: ext4: stop retrying saturated xattr cache entries ext4xattrblockset retries when a cache entry selected for reuse has a saturated reference count after taking the buffer lock. The retry returns to the mbcache lookup without makin...