SUSE CVE-2026-63899

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size...

SUSE CVE-2026-63900

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...

SUSE CVE-2026-63901

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device report smaller buffers...

SUSE CVE-2026-63902

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

SUSE CVE-2026-63903

In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkinsa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from...

SUSE CVE-2026-63932

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

SUSE CVE-2026-63956

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...

SUSE CVE-2026-63957

In the Linux kernel, the following vulnerability has been resolved: USB: serial: safeserial: fix memory corruption with small endpoint Make sure that the bulk-out buffer size is at least eight bytes to avoid user-controlled slab corruption in "safe" mode should a malicious device report a smaller...

SUSE CVE-2026-63961

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...

SUSE CVE-2026-64168

In the Linux kernel, the following vulnerability has been resolved: spi: sprd: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to check the dma.enabled flag before trying to release the DMA channels also on late probe...

CVE-2026-63904

A flaw was found in the Linux kernel's USB Test and Measurement Class USBTMC driver. This vulnerability occurs because the driver does not properly verify the size of incoming notification messages, specifically failing to ensure that required two-byte headers are present. An attacker could explo...

CVE-2026-63896

A flaw was found in the Linux kernel's USB gadget composite driver. A remote attacker, acting as a malicious USB host, could send a specially crafted GETURL request. This request, with a small wLength value, triggers an integer underflow when calculating the buffer length for a memory copy...

CVE-2026-63928

A flaw was found in the Linux kernel's USB serial omninet driver. A malicious Universal Serial Bus USB device could exploit this by reporting a smaller maximum packet size than anticipated. This action would cause the system to allocate undersized data buffers, leading to memory corruption. Such...

CVE-2026-64144

A flaw was found in the Linux kernel's Bluetooth MediaTek btmtk driver. This vulnerability allows a local attacker to cause a memory leak by triggering specific error paths during Universal Serial Bus USB Bluetooth operations. The setuppacket of a control urb USB Request Block is not properly fre...

[SECURITY] Fedora 44 Update: gpsd-3.27.5-5.fc44

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications such as...

CVE-2026-8169

CVE-2026-8169 concerns ExtremeXOS (EXOS) where the privileged debug-mode access relies on a challenge-response mechanism. The challenge is generated from an insufficiently random source, allowing, under certain conditions, an attacker to predict the expected response and activate debug-mode witho...

EUVD-2026-46047

ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...

CVE-2026-53384

A flaw was found in the Linux kernel's 8250dw serial driver. When the clknotifierregister function fails during the probe process, the 8250 port is not properly unregistered. This oversight can lead to a use-after-free vulnerability, where previously freed memory is still referenced. An attacker...

CVE-2026-64170

A flaw was found in the Linux kernel's Serial Peripheral Interface SPI Qualcomm Universal Peripheral QUP driver. When the Direct Memory Access DMA setup fails during the driver's initialization, the driver attempts to fall back to Programmed Input/Output PIO mode. However, it fails to properly...

Linux Distros Unpatched Vulnerability : CVE-2026-63957

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: safeserial: fix memory corruption with small endpoint Make sure that the bulk-out buffer size is at least eight bytes to avoid user-controlled slab...