UBUNTU-CVE-2026-72490

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

UBUNTU-CVE-2026-72484

In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure compregistervideodev allocates a videodevice with videodevicealloc and releases it if videoregisterdevice fails. This can double free the videodevice when...

EUVD-2026-59389

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

CVE-2026-72490 staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtwaesdecrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

EUVD-2026-59383

In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure compregistervideodev allocates a videodevice with videodevicealloc and releases it if videoregisterdevice fails. This can double free the videodevice when...

CVE-2026-72484 staging: most: video: avoid double free on video register failure

In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure compregistervideodev allocates a videodevice with videodevicealloc and releases it if videoregisterdevice fails. This can double free the videodevice when...

PT-2026-72678

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtw aes decrypt The null-pointer-guard was incorrect, returning FAIL on valid pointer. Invert the guard, so it returns FAIL on invalid pointer...

PT-2026-72677

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nvec rx completed function. When an incomplete RX transfer is detected, the nvec msg free function is called to return the message to the pool by...

SUSE CVE-2026-68190

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetwpsie rtwgetwpsie iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - iniecnt...

SUSE CVE-2026-68084

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

staging: vme_user: fix location monitor leak in tsi148 bridge

...

UBUNTU-CVE-2026-68190

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetwpsie rtwgetwpsie iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - iniecnt...

CVE-2026-68190

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetwpsie rtwgetwpsie iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - iniecnt...

CVE-2026-68190 staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetwpsie rtwgetwpsie iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - iniecnt...

PT-2026-69485

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the vme user staging driver within the tsi148 bridge. The tsi148 probe function allocates a location monitor resource and adds it to the lm resources list of the...

AZL-93959 CVE-2026-64536 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...

AZL-93596 CVE-2026-64443 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

AZL-93680 CVE-2026-64441 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie and rtwgetwapiie iterate over a raw IE buffer without verifying that t...

CVE-2026-64443

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

AZL-90315 CVE-2026-53178 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction Add guards to ensure ielength is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow...