CVE-2026-90413 IB/isert: reject login PDUs declaring more data than was received

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares...

CVE-2026-90413

CVE-2026-90413 is a slab-out-of-bounds read in the Linux kernel's iSCSI target over RDMA (isert) subsystem. The root cause is that isert_rx_login_req() copies only the actually-received bytes into a fixed 8192-byte buffer, but subsequent login handlers (iscsi_target_locate_portal() and iscsi_deco...

CVE-2026-90408

CVE-2026-90408 affects the ath12k WiFi driver in the Linux kernel. The root cause is twofold: a missing TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT (so no minimum length is enforced), and the firmware-supplied num_vdevs field being used as an unbounded loop counter over the vd...

EUVD-2026-82069

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix overreads in ath12kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

CVE-2026-90408 wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix overreads in ath12kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

CVE-2026-90408 wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix overreads in ath12kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

CVE-2026-90407 wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

CVE-2026-90407 wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

EUVD-2026-82068

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

CVE-2026-90407

CVE-2026-90407 affects the ath11k Linux WiFi driver in the function ath11k_wmi_process_csa_switch_count_event(). Two root causes produce an out-of-bounds read : (1) no TLV policy entry exists for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum le...

EUVD-2026-82035

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

CVE-2026-90350

CVE-2026-90350 affects the mt76 WiFi driver in the Linux kernel (mt7996 variant). The function mt76_vif_link() indexes the mvif->link[] array without validating link_id. Callers pass deflink_id, which holds IEEE80211_LINK_UNSPECIFIED (0xf) until the first link is added. Since IEEE80211_MLD_MAX...

EUVD-2026-82011

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

CVE-2026-90350 wifi: mt76: reject out-of-range link ids in mt76_vif_link()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

CVE-2026-90350 wifi: mt76: reject out-of-range link ids in mt76_vif_link()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

CVE-2026-90328

CVE-2026-90328 affects the Linux kernel 's HID Steam controller driver. The root cause is that FEATURE reports from the Steam Controller encode the message size within the report itself, but the driver previously trusted that the reported size matched the actual number of bytes read , without ver...

EUVD-2026-81989

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

EUVD-2026-81975

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...

CVE-2026-90314 remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...

CVE-2026-90314

CVE-2026-90314 is an out-of-bounds read vulnerability in the Linux kernel remoteproc subsystem, specifically in rsc_table_for_each_entry(). The root cause is a signed/unsigned type mismatch : table->offset[i] is a u32 value supplied by firmware, but was stored into a signed int. A crafted offs...