CVE-2026-53385 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

In the Linux kernel, the following vulnerability has been resolved: vcscreen: fix null-ptr-deref in vcsnotifier during concurrent vcswrite A KASAN null-ptr-deref was observed in vcsnotifier: BUG: KASAN: null-ptr-deref in vcsnotifier+0x98/0x130 Read of size 2 at addr qmpcmdname: qmpcapabilities,...

CVE-2026-53375 drm/amdgpu/vce: Prevent partial address patches

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW...

CVE-2026-53375 drm/amdgpu/vce: Prevent partial address patches

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW...

CVE-2026-53371

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound nodedesc sysfs read with %.64s nodedesc64 in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason drivers/infiniband/core/sysfs.c:1307, since...

CVE-2026-53371 RDMA/ionic: bound node_desc sysfs read with %.64s

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound nodedesc sysfs read with %.64s nodedesc64 in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason drivers/infiniband/core/sysfs.c:1307, since...

PT-2026-61232

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc hci recv from llc and nci hci data received cb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A...

PT-2026-61275

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi connector change The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi connector change uses it to index the ucsi-connector array without...

PT-2026-61450

In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access at reading cache find control to retrieve a cached info accesses the array with the given index blindly, which may lead to an OOB array access. Add a sanity check for avoiding it...

PT-2026-61085

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rzv2h-ivc media component where the buffer list rzv2h ivc::buffers.queue is accessed concurrently. While the list is intended to be protected by the rzv2h...

PT-2026-61276

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpci maxim: validate header NDO against RX BYTE CNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this,...

PT-2026-61213

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GET URL handling The WebUSB GET URL handler in composite setup narrows landing page length to fit the host-supplied wLength using landing page length = w length - WEBUSB URL...

PT-2026-61438

In the Linux kernel, the following vulnerability has been resolved: net: ifb: report ethtool stats over num tx queues ifb dev init allocates dp-tx private to dev-num tx queues entries via kzalloc objstxp, dev-num tx queues. Both IFB per-queue RX and TX stats live in those entries: ifb xmit update...

PT-2026-61411

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Without rtnl lock held, a hardif might be retrieved as primary interface of a meshif, but then while operating on this interface getting decoupled from the mes...

PT-2026-61459

In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against m fp list lookups ksmbd durable scavenger has two related races against any walker that iterates f ci-m fp list, including ksmbd lookup fd inode used by ksmbd vfs rename and the...

PT-2026-61300

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or...

PT-2026-61125

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1-rc5 Description Memory corruption can occur in the BPF sysctl handler. The proc sys call handler function allocates a temporary sysctl buffer using kvzalloc, which may use vmalloc for large allocations...

PT-2026-61282

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix stack leak in bmp580 trigger handler bmp580 trigger handler declares its scan buffer on the stack without an initializer and then memcpys 3 bytes of 24-bit sensor data into each 4-byte le32 field. The...

CVE-2026-54498 view_component: around_render HTML-Safety Bypass

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...

CVE-2026-54498 view_component: around_render HTML-Safety Bypass

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI summary text is embedded into generated TypeScript MCP server source without proper escaping. oapi-codegen has a similar vulnerability in its server...