CVE-2026-63959

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpcimaxim: validate header NDO against RXBYTECNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this, an...

CVE-2026-63920

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...

CVE-2026-64092

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

CVE-2026-64166 firmware: arm_ffa: Check for NULL FF-A ID table while driver registration

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Check for NULL FF-A ID table while driver registration The bus match callback assumes that every FF-A driver provides an idtable and dereferences it unconditionally. Enforce that contract at registration time so...

CVE-2026-64151

The CVE-2026-64151 entry concerns the Linux kernel iommupt component, where a driver could omit PAGE_SIZE from the pgsize_bitmap. The root cause is that removing PAGE_SIZE from the bitmap is technically allowed but would leave an iommu_domain unused with the DMA API; the design is violated. The d...

CVE-2026-64137

The CVE-2026-64137 issue affects the Linux kernel CIFS client (SWN netlink). The vulnerability arises because CIFS_GENL_CMD_SWN_NOTIFY and related SWN multicast group handling lack proper capability checks, allowing an unprivileged local process to send witness notifications or join the multicast...

CVE-2026-64136

In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tccount increment in smb2findsmbsesstconunlocked Commit 96c4af418586 "cifs: Fix locking usage for tcon fields" refactored cifs code to change cifstcpseslock for tclock around tccount changes. There was missin...

CVE-2026-64127

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecredreconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 "Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings" converted the on-stack request PDU in l2capecredreconfigure from an...

CVE-2026-64101 fwctl: pds: Validate RPC input size before parsing

In the Linux kernel, the following vulnerability has been resolved: fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback. pdsfcfwrpc casts the buffer to struct fwctlrpcpds...

CVE-2026-64090 batman-adv: tt: avoid empty VLAN responses

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 "batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs" added checks to the local direct TT response code. But the response can also be done...

CVE-2026-64036

The CVE-2026-64036 issue affects the Linux kernel cgroup/rstat path. The vuln arises because css_rstat_updated(), a BPF kfunc, accepts a caller-provided cpu value used for per-cpu rstat lookups without validating it against a valid CPU. A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON could...

UBUNTU-CVE-2026-63873

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mmstruct reference leak in aie2populaterange aie2populaterange jumps back to the again label without calling mmputmm, leaking a reference to the mmstruct. Add the missing mmput before jumping to again...

CVE-2026-63871

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...

CVE-2026-63984

CVE-2026-63984 affects the Linux kernel, addressing an overflow in the IPv6 RPL SRH decompression path. The bug occurs in ipv6_rpl_srh_decompress(): hdrlen is computed as outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); since hdrlen is an 8-bit value, for n >= 127 the resu...

EUVD-2026-45757

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6rplsrhdecompress ipv6rplsrhdecompress computes: outhdr-hdrlen = n + 1 sizeofstruct in6addr 3; hdrlen is u8. For n = 127 the result exceeds 255 and silently truncates. With n=127 cmpri=15,...

EUVD-2026-45755

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix ethx:ingress - ethy:egress - ethx:ingress mirred loop When mirred redirects to ingress from either ingress or egress the loop state from schedmirreddev array dev is lost because of 1 the packet deferral into the...

CVE-2026-63981

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: Fix blockcast recursion bypass leading to stack overflow tcfmirredact checks schedmirrednest against MIRREDNESTLIMIT 4 to prevent deep recursion. However, when the action uses blockcast tcfmblockid != 0, the...

EUVD-2026-45720

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

EUVD-2026-45711

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change PSC requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximu...

EUVD-2026-45686

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an...