CVE-2026-64114 ipv4: raw: reject IP_HDRINCL packets with ihl < 5

In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...

EUVD-2026-45650

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: move to two-stage removal scheme Like previous patches for xtables, follow same pattern in ebtables. We can't reuse xt helpers: ebttable struct layout is incompatible. table-ops assignment is now done while...

CVE-2026-64071 nvme-pci: fix use-after-free in nvme_free_host_mem()

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix use-after-free in nvmefreehostmem nvmefreehostmem frees dev-hmbsgt via dmafreenoncontiguous but never clears the pointer afterward. This leads to a use-after-free if nvmefreehostmem is called twice in the same error...

CVE-2026-64056

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device ...

EUVD-2026-45628

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmacrx NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmacrx, but the packet is not y...

CVE-2026-64052

CVE-2026-64052 is a null pointer dereference in the Linux kernel's block layer , specifically in bio_integrity_map_user(). The root cause is that pin_user_pages_fast() can partially succeed (pinning fewer pages than requested), but bio_integrity_map_user() does not handle this case, causing bvec_...

CVE-2026-64050 drm/msm/dpu: don't mix devm and drmm functions

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed becaus...

CVE-2026-64049 drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

EUVD-2026-45621

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ismdev slot On the SMC-D client, slot 0 of ini-ismdev/ini-ismchid is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt populates V2 entries starting at index 1, so when no ...

CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

DEBIAN-CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

EUVD-2026-45753

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

EUVD-2026-45749

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan-ident on ECRED reconfiguration success l2capecredreconfrsp returns early on success without clearing chan-ident. Every other L2CAP response handler l2capecredconnrsp, l2capleconnectrsp, l2capconfigrsp...

CVE-2026-63952 memfd: deny writeable mappings when implying SEAL_WRITE

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...

CVE-2026-63946 Bluetooth: ISO: fix UAF in iso_recv_frame

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...

CVE-2026-63915 nfc: hci: fix out-of-bounds read in HCP header parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...

EUVD-2026-45668

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63895 usb: gadget: f_fs: copy only received bytes on short ep0 read

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63895

Summary: CVE-2026-63895 affects the Linux kernel's FunctionFS (f_fs) gadget driver. The bug occurs in ffs_ep0_read(), where a control-OUT request’s data buffer is allocated with kmalloc(len) and then fully copied to userspace via copy_to_user(buf, data, len) even when only ret bytes were actually...

CVE-2026-63895

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...