CVE-2026-12522

The HL7800 cellular modem driver's +CGCONTRDP: response handler oncmdatcmdinfoipaddr in drivers/modem/vendorstandalone/hl7800.c parses the PDP-context dynamic parameters local address, subnet mask, gateway, and DNS servers that the cellular network assigns to the device. The response is linearize...

EUVD-2026-63075

The HL7800 cellular modem driver's +CGCONTRDP: response handler oncmdatcmdinfoipaddr in drivers/modem/vendorstandalone/hl7800.c parses the PDP-context dynamic parameters local address, subnet mask, gateway, and DNS servers that the cellular network assigns to the device. The response is linearize...

PT-2026-78684

The HL7800 cellular modem driver's +CGCONTRDP: response handler on cmd atcmdinfo ipaddr in drivers/modem/vendor standalone/hl7800.c parses the PDP-context dynamic parameters local address, subnet mask, gateway, and DNS servers that the cellular network assigns to the device. The response is...

CVE-2026-12235

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...

CVE-2026-12235 Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...

EUVD-2026-57070

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...

CVE-2026-12235 Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...

CVE-2026-12235

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...

CVE-2026-12235 Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...

CVE-2026-12235

The CVE describes an out-of-bounds write in the Xtensa llext PLT relocation path. Specifically, during relocation in llext_link_plt(), the patch address is computed using rela.r_offset without validating it, allowing a crafted RELA entry with a large r_offset to write outside the extension’s text...

PT-2026-70994

The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llext link plt subsys/llext/llext link.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch...