EUVD-2026-108735

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...

CVE-2026-99069 Input: ati_remote2 - fix type confusion in device attribute handlers

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...

CVE-2026-99069

The Linux kernel contains a type confusion vulnerability in the ati_remote2 driver. The issue arises because the channel_mask and mode_mask attributes were moved to the bound usb_interface devices, but the show and store callbacks were not updated and continued to invoke to_usb_device() on a usb_...

CVE-2026-98780

A flaw was found in the Linux kernel's AMD GPU driver. When registering hardware discovery entries within the sysfs system filesystem interface, the driver fails to release allocated memory if a kernel object fails to register. An unexpected registration failure can cause the memory to remain...

K000163832: Linux kernel vulnerability CVE-2026-46121

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect memcgpath kfree with damonsysfslock Patch series "mm/damon/sysfs-schemes: fix use-after-free for memcgpath". Reads of 'memcgpath' and 'path' files in DAMON sysfs...

CVE-2026-89835

A flaw was found in the Linux kernel's f2fs filesystem. This vulnerability occurs when the checkpointmerge feature is enabled without an active checkpoint merge thread, such as during a read-only mount. A local attacker with write access to ckptthreadioprio through sysfs could trigger a null...

CVE-2026-89822

A flaw was found in the Linux kernel's drm/i915 module. A local user could exploit a null pointer dereference in the i915pciprobe function. This occurs when a device is force-bound via sysfs driveroverride, causing driverdata to be NULL and subsequently dereferenced. Successful exploitation could...

CVE-2026-93038

A flaw was found in the Linux kernel's AD5686 digital-to-analog converter DAC driver. A local user can exploit this vulnerability by attempting to bind the driver to an unrecognized device name through the system file interface sysfs. This trigger leads to an invalid null pointer access due to...

CVE-2026-93053

A flaw was found in the Linux kernel's speakup component. A local attacker with root privileges could exploit a vulnerability in the keyhelp module by overriding function names in sysfs. This manipulation could cause an out-of-bounds write in the letteroffsets array, potentially leading to system...

CVE-2026-93051

A flaw was found in the Linux kernel's ad525xdpot driver. The addpotprobe function's manual creation of sysfs files could lead to improper resource management during device probing and removal. This could result in incomplete cleanup of system resources, potentially affecting system stability...

CVE-2026-90389

A flaw was found in the Linux kernel. A concurrency issue in the Multiple Device MD subsystem's handling of memallocnoiosave tokens can occur during concurrent suspend sysfs writes. This allows a task to return to userspace while still within a PFMEMALLOCNOIO scope, enabling another task to resto...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43421)

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Fix netdevice lifecycle with devicemove The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to sol...

CVE-2026-98771

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

UBUNTU-CVE-2026-98771

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

SUSE CVE-2026-98771

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

AZL-109214 CVE-2026-98771 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

DEBIAN-CVE-2026-98771

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

CVE-2026-98771

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

CVE-2026-98657

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iiodevice left registered on PM setup failure pmruntimesetactive failing in probe jumps to errorunregbuffer, which only calls iiotriggeredbuffercleanup -- it does not undo the iiodeviceregister th...

CVE-2026-98771 usb: storage: sierra_ms: reject short SWoC info transfers

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...