CVE-2026-64499

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119triggeredbufferpreenable resumes the device with pmruntimeresumeandget before starting a conversion. If i2csmbuswritebyte fails, the function returns the erro...

CVE-2026-64337

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

UBUNTU-CVE-2026-64337

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

UBUNTU-CVE-2026-64303

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

CVE-2026-64499 iio: adc: ti-ads1119: fix PM reference leak in buffer preenable

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119triggeredbufferpreenable resumes the device with pmruntimeresumeandget before starting a conversion. If i2csmbuswritebyte fails, the function returns the erro...

CVE-2026-64499

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119triggeredbufferpreenable resumes the device with pmruntimeresumeandget before starting a conversion. If i2csmbuswritebyte fails, the function returns the erro...

CVE-2026-64499

CVE-2026-64499 affects the Linux kernel driver for the TI ADS1119 ADC under the IIO subsystem. The root cause is a PM runtime reference leak in iio: adc: ti-ads1119 during buffer preenable: ads1119_triggered_buffer_preenable() resumes the device via pm_runtime_resume_and_get() before the conversi...

CVE-2026-64499 iio: adc: ti-ads1119: fix PM reference leak in buffer preenable

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119triggeredbufferpreenable resumes the device with pmruntimeresumeandget before starting a conversion. If i2csmbuswritebyte fails, the function returns the erro...

EUVD-2026-48793

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: bound slave read/write to the kernbuf size The SLAVE-path helpers buffertouser and bufferfromuser copy 'count' bytes into/out of the fixed-size kernbuf sizebuf == PCIBUFSIZE == 0x20000, 128 KiB using ppos as the...

CVE-2026-64339 usb: misc: usbio: bound bulk IN response length to the received transfer

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...

EUVD-2026-48883

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...

CVE-2026-64337 usb: mtu3: unmap request DMA on queue failure

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

CVE-2026-64335 USB: serial: digi_acceleport: fix broken rx after throttle

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix broken rx after throttle If the port is closed while throttled, the read urb is never resubmitted and the port will not receive any further data until the device is reconnected or the driver is...

EUVD-2026-48872

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit, which sets its kref counter to 1. Then, dmaresvaddfence gets a second...

CVE-2026-64328 usb: gadget: f_fs: Fix DMA fence leak

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit, which sets its kref counter to 1. Then, dmaresvaddfence gets a second...

CVE-2026-64319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

CVE-2026-64303

In CVE-2026-64303, a Linux kernel vulnerability in the fsl-lpspi driver occurs when dmaengine_prep_slave_sg() fails for the TX channel: the TX path is terminated but the RX path (already submitted) continues, unmapping buffers on -EINVAL and risking memory corruption or use-after-free. The fixed ...

CVE-2026-64278

Summary of CVE-2026-64278 (Linux kernel) : On some i.MX platforms, certain I2C client drivers run a periodic workqueue that can trigger I2C transfers during suspend/resume. A timing window exists between suspend_noirq and resume_noirq when hardware resources (clock, pinctrl) may be disabled or no...

CVE-2026-64278 i2c: imx-lpi2c: mark I2C adapter when hardware is powered down

In the Linux kernel, the following vulnerability has been resolved: i2c: imx-lpi2c: mark I2C adapter when hardware is powered down On some i.MX platforms, certain I2C client drivers keep a periodic workqueue which continues to trigger I2C transfers. During system suspend/resume, there exists a ti...

JLSEC-2026-791 Writing to SFTP files resulting in sending out-of-bounds data to the server

Impact The write::SftpFile, ::DenseVector method assumed that the element type of the input vector had a size of 1 byte e.g. Int8/UInt8, and used lengthdata instead of sizeofdata to get the number of bytes to send. If the input vector had a eltype with size more than 1 byte then this would result...