EUVD-2026-76500

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

CVE-2026-89588 ACPI: APEI: GHES: fix ARM section length accounting after header

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

CVE-2026-89588 ACPI: APEI: GHES: fix ARM section length accounting after header

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

CVE-2026-89583 Bluetooth: eir: Fix OOB read in eir_get_service_data()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

CVE-2026-89583

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

CVE-2026-89583

CVE-2026-89583 is an out-of-bounds (OOB) read in the Linux kernel's Bluetooth EIR parser, specifically in eir_get_service_data(). The root cause is an incorrect length calculation: when walking Extended Inquiry Response advertising data, the eir_len variable is decremented by only the data length...

EUVD-2026-76495

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

CVE-2026-89583 Bluetooth: eir: Fix OOB read in eir_get_service_data()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

CVE-2026-89574

CVE-2026-89574 is a vulnerability in the Linux kernel's device mapper (dm) array component. The root cause is insufficient validation of array block headers during read operations: array_block_check() only verifies blocknr and csum, while element_at() performs unguarded pointer arithmetic driven ...

CVE-2026-89574

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

CVE-2026-89574 dm array: validate array block headers on read

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

EUVD-2026-76486

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

CVE-2026-89574 dm array: validate array block headers on read

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

EUVD-2026-76485

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...

CVE-2026-89573 dm array: reject an array block whose value size is not the caller's

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...

CVE-2026-89573

A local out-of-bounds read in the Linux kernel's device mapper (dm) array component allows memory corruption via crafted metadata . The root cause is that array_block_check() only validates a block's header against itself, so a 4-byte value_size block with max_entries 1018 passes as internally co...

CVE-2026-89573

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...

CVE-2026-89573 dm array: reject an array block whose value size is not the caller's

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...

CVE-2026-89571

This is an out-of-bounds read in the Linux kernel's CXL (Compute Express Link) features subsystem. The fwctl_cmd_rpc() function copies user-supplied data into a fixed-size buffer, but the downstream cxlctl_set_feature() callback validates the user-controlled op_size only from below, never against...

CVE-2026-89571 cxl/features: bound fwctl command payload to the input buffer

In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctlcmdrpc copies cmd-inlen bytes into inbuf = kvzalloccmd-inlen and passes inbuf and inlen to -fwrpc. The CXL callback cxlctlfwrpc ignores inlen and never checks the...