CVE-2026-64464

Consolidated details show CVE-2026-64464 affects the Linux kernel xhci sideband path: xhci_ring_to_sgtable() allocates a temporary pages array used to build an sg_table via sg_alloc_table_from_pages(). On success, the temporary array isn’t freed, causing a leak each time a sideband client uses an...

CVE-2026-64402 coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()

In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smbsyncperfbuffer When the SMB sink is used as a perf AUX sink, smbupdatebuffer calls smbsyncperfbuffer to copy hardware trace data into the perf AUX ring buffer pages. It derives pgidx =...

CVE-2026-64300 perf/aux: Fix page UAF in map_range()

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in maprange maprange reads rb-auxpages, rb-auxnrpages and rb-auxpgoff via perfmmaptopage while holding only event-mmapmutex. Those fields are serialized by rb-auxmutex, and mmapmutex is per event. Thus, two...

EUVD-2026-48971

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

SUSE CVE-2026-63841

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v5.0.1 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 742a98e2e81702df8fe1b1eccee5223220a03dc2...

SUSE CVE-2026-63842

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v5.0.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 0f43893d3cd478fa57836697525b338817c9c23d...

SUSE CVE-2026-63844

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v4.0.3 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 2f6afc97d259d530f4f86c7743efbc573a8da927...

SUSE CVE-2026-63845

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v4.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 8d0cac9478a3f046279c657d6a2545de49ae675a...

SUSE CVE-2026-63847

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v2.5 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 3216a7f4e2642bda5fd14f57586e835ae9202587...

SUSE CVE-2026-63848

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v2.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 96179da0c6b059eb31706a0abe8dd6381c533143...

SUSE CVE-2026-63849

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v5.0.1 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

EUVD-2026-46379

Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in ring.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...

EUVD-2026-46365

Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elemsize in ringreadseq. The attach-time validator ringvalidateheader checks the capacity-overflow and totalsize consistency of the header but never caps elemsize against the destination size...

CVE-2026-59144

Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elemsize in ringreadseq. The attach-time validator ringvalidateheader checks the capacity-overflow and totalsize consistency of the header but never caps elemsize against the destination size...

CVE-2026-59144

Data::RingBuffer::Shared prior to v0.04 for Perl has a stack-buffer overflow: ring_read_seq copies elem_size bytes into an 8-byte destination without capping elem_size, allowing a file-writable header to cause overflow and stack corruption. The attach-time header validation does not cap elem_size...

CVE-2026-59144 Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq

Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elemsize in ringreadseq. The attach-time validator ringvalidateheader checks the capacity-overflow and totalsize consistency of the header but never caps elemsize against the destination size...

SUSE CVE-2026-64047

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sgchain entry count for wrapped skmsg ring When an skmsg scatterlist ring wraps sg.end sg.datamsgpl-sg.start, MAXSKBFRAGS - msgpl-sg.start + 1, msgpl-sg.data; This places the chain pointer at...

CVE-2026-63846

A flaw was found in the Linux kernel's drm/amdgpu/jpeg component, specifically within the JPEG v3.0 ring. This component does not support 64-bit user fence writes. Consequently, any command submissions CS that attempt to use 64-bit user fences will be rejected, leading to a functional limitation ...

PT-2026-62051

Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem size in ring read seq. The attach-time validator ring validate header checks the capacity-overflow and total size consistency of the header but never caps elem size against the destination...