CVE-2026-63979

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

CVE-2026-63928

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...

CVE-2026-63897

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data and leaking it to user space...

CVE-2026-63900

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...

CVE-2026-63898

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increas...

CVE-2026-63895

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-64086

The CVE-2026-64086 issue affects the Linux kernel PMBUS adm1266 hwmon path. A read transaction for the pmbus_block_xfer path set .len to ADM1266_PMBUS_BLOCK_MAX + 2 while read_buf was declared as ADM1266_PMBUS_BLOCK_MAX + 1. For max-length block responses, this allowed writing 257 bytes into a 25...

CVE-2026-64086

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 include PEC byte in pmbusblockxfer read buffer adm1266pmbusblockxfer sets up the read transaction with .buf = data-readbuf, .len = ADM1266PMBUSBLOCKMAX + 2, but readbuf in struct adm1266data is declared as u8...

CVE-2026-64086 hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 include PEC byte in pmbusblockxfer read buffer adm1266pmbusblockxfer sets up the read transaction with .buf = data-readbuf, .len = ADM1266PMBUSBLOCKMAX + 2, but readbuf in struct adm1266data is declared as u8...

CVE-2026-64085

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 bounce blackbox records through a protocol-sized buffer adm1266pmbusblockxfer copies the device-supplied block payload into the caller-provided buffer using the device-supplied length: memcpydatar, &msgs1.buf...

CVE-2026-63867

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

EUVD-2026-45587

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO datalen/xlen to URB buffer size nexioreaddata pulls datalen and xlen from a packed be16 header in the device's interrupt packet and then walks packet-data0..xlen and packet-dataxlen..datalen...

CVE-2026-63928 USB: serial: omninet: fix memory corruption with small endpoint

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...

EUVD-2026-45701

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...

CVE-2026-63928

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...

CVE-2026-63928

The CVE-2026-63928 entry concerns the Linux kernel USB serial omninet driver. The issue is a memory corruption risk when handling a small endpoint: bulk-out buffers must be at least as large as the hardcoded transfer size to prevent user‑controlled slab corruption if a malicious device reports a ...

CVE-2026-63928 USB: serial: omninet: fix memory corruption with small endpoint

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...

CVE-2026-63900

CVE-2026-63900 concerns the Linux kernel USB serial driver for Keyspan devices (usa49wg). The vulnerability was a missing sanity check on the size of indat transfers, which could allow parsing of stale or uninitialised slab data. The issue has been addressed by adding the missing sanity check to ...

EUVD-2026-45673

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...

CVE-2026-63900 USB: serial: keyspan: fix missing indat transfer sanity check

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...