EUVD-2026-86152

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...

CVE-2026-93280

The Linux kernel is vulnerable to an out-of-bounds read within the greybus: audio component. The issue occurs because gb_audio_gb_get_topology() fetches a topology blob based on a size provided by a module, but gbaudio_tplg_parse_data() fails to verify if the module-supplied section sizes (size_d...

CVE-2026-93280 greybus: audio: bound the topology section sizes against the fetched size

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...

EUVD-2026-86256

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks every MSI-X vector and uses strstr to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector...

CVE-2026-93246 octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks every MSI-X vector and uses strstr to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector...

CVE-2026-93246

A vulnerability in the Linux kernel (specifically the octeontx2-af driver) allows an out-of-bounds read during the setting of MSI-X IRQ affinity. The rvu_register_interrupts() function uses strstr() to search for "Mbox" or "FLR" within the irq_name buffer. Because this buffer may contain uninitia...

CVE-2026-93246 octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks every MSI-X vector and uses strstr to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector...

CVE-2026-93234 drm/gud: validate TV mode names before creating enum property

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...

CVE-2026-93234

A vulnerability exists in the Linux kernel 's drm/gud component where the gud_connector_add_tv_mode() function fails to validate that TV mode names returned via the GUD protocol are NUL-terminated. Because the protocol uses fixed-size entries, a device returning a name without a terminating NUL b...

EUVD-2026-86239

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...

CVE-2026-93234 drm/gud: validate TV mode names before creating enum property

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...

EUVD-2026-86234

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

CVE-2026-93229 nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

CVE-2026-93229

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

CVE-2026-58004

Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Trusted Firmware: through socfpgav2.14.0...

CVE-2026-58005

Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Trusted Firmware: through socfpgav2.14.0...

CVE-2026-18870

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...

CVE-2026-93213 of: fix out-of-bounds read in of_alias_scan() stem parser

In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property name when the name is empty or all digits. Check the bound first...

EUVD-2026-85942

In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property name when the name is empty or all digits. Check the bound first...

CVE-2026-93213

The Linux kernel contains an out-of-bounds read vulnerability in the of_alias_scan() stem parser. The flaw occurs because the parser evaluates isdigit(*(end - 1)) before verifying that end > start. This logic error causes the system to read one byte before the property name when the name is em...