CVE-2026-98204 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

EUVD-2026-93132

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

CVE-2026-98204

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

CVE-2026-98204 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

CVE-2026-98203

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

CVE-2026-98193

The Linux kernel contains a vulnerability in the libipw component where the libipw_michael_mic_verify() function incorrectly assumes the presence of an eight-byte Michael MIC. A short TKIP frame can cause the unsigned payload length to wrap, leading to an out-of-bounds read as michael_mic() reads...

CVE-2026-98193 wifi: libipw: reject TKIP frames without a full MIC

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipwmichaelmicverify assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michaelmic to read past the skb...

EUVD-2026-93121

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipwmichaelmicverify assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michaelmic to read past the skb...

CVE-2026-98193 wifi: libipw: reject TKIP frames without a full MIC

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipwmichaelmicverify assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michaelmic to read past the skb...

CVE-2026-98190

The Linux kernel (specifically the wilc1000 driver) contains an out-of-bounds read vulnerability in the processing of P2P public action frames . The issue arises because ieee80211_is_public_action() only verifies a minimum length of 25 bytes, while the subsequent parsing in wilc_wfi_p2p_rx() and ...

CVE-2026-98190 wifi: wilc1000: fix out-of-bounds read in P2P public action frames

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...

EUVD-2026-93118

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...

CVE-2026-98190

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...

CVE-2026-98190 wifi: wilc1000: fix out-of-bounds read in P2P public action frames

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...

CVE-2026-98188

The Linux kernel contains an out-of-bounds read vulnerability in the wifi: p54 driver. The functions p54_convert_rev0() and p54_convert_rev1() fail to validate the length of calibration curve data read from a device-supplied EEPROM entry . Specifically, the functions use channel and points-per-ch...

CVE-2026-98188 wifi: p54: validate curve data length in the calibration curve converters

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54convertrev0 and p54convertrev1 read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken...

EUVD-2026-93116

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54convertrev0 and p54convertrev1 read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken...

CVE-2026-98188 wifi: p54: validate curve data length in the calibration curve converters

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54convertrev0 and p54convertrev1 read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken...

CVE-2026-98187

A vulnerability exists in the Linux kernel 's wifi: p54 driver. The PDR_INTERFACE_LIST loop fails to verify that a full exp_if record fits within its entry before reading, allowing a truncated trailing record to cause reads to cross entry boundaries into the heap beyond the EEPROM buffer. This fl...

CVE-2026-98187 wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: require a full expif record in PDRINTERFACELIST The PDRINTERFACELIST loop only checks that the record start is within the entry before reading an entire struct expif from it. A truncated trailing record makes the...