CVE-2026-64537

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itself via queuedelayedwork using the configured expinterval converted by intervaltous. When expinterval is BRCFMCCMINTERVALNONE or out of...

spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

...

CVE-2026-64303

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

UBUNTU-CVE-2026-64470

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue...

UBUNTU-CVE-2026-64303

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

CVE-2026-64470 Bluetooth: btusb: fix use-after-free on marvell probe failure

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue...

CVE-2026-64409

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix infinite loop in btmtksdiotxrxwork Every once in a while we see a hung btmtksdioflush task: INFO: task kworker/u17:0:189 blocked for more than 122 seconds. cancelworktimer+0x3f4/0x460...

CVE-2026-64303 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

CVE-2026-64303 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

CVE-2026-64303

In CVE-2026-64303, a Linux kernel vulnerability in the fsl-lpspi driver occurs when dmaengine_prep_slave_sg() fails for the TX channel: the TX path is terminated but the RX path (already submitted) continues, unmapping buffers on -EINVAL and risking memory corruption or use-after-free. The fixed ...

SUSE CVE-2026-63859

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add missing bits in airohaqdmacleanuptxqueue Similar to airohaqdmacleanuprxqueue, reset DMA TX descriptors in airohaqdmacleanuptxqueue routine. Moreover, reset TXDMAIDX to TXCPUIDX to notify the NIC the QDMA TX ring ...

K000162379: Linux Kernel vulnerabilities CVE-2026-23310, CVE-2026-23336, CVE-2026-23340, and CVE-2026-23343

Security Advisory Description CVE-2026-23310 In the Linux kernel, the following vulnerability has been resolved: bpf/bonding: reject vlan+srcmac xmithashpolicy change when XDP is loaded bondoptionmodeset already rejects mode changes that would make a loaded XDP program incompatible via...

CVE-2026-63859

A flaw was found in the Linux kernel's airoha network driver. The airohaqdmacleanuptxqueue routine, responsible for cleaning up transmit queues, was missing critical steps. This omission could lead to improper resetting of Direct Memory Access DMA transmit descriptors and incorrect notification t...

SUSE CVE-2026-64175

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes e.g., NMIINTERRUPTUNKNOWN on Intel BE201/Wi-Fi 7, iwlmldnicerror sets mld-fwstatus.inhwrestart to true. However, iwlmldtxfromtxq does not check thi...

SUSE CVE-2026-64176

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index 0-3/0-7 but rather their PLCP value e.g. 10 for 1 Mbp...

CVE-2026-64035

A flaw was found in the Linux kernel's igc network driver. The igcfpeinitsmdframe function, responsible for initializing transmit TX buffer fields for Stream-based Data SMD frames, does not correctly set the buffer type. This can result in stale XDP eXpress Data Path or XSK AFXDP socket types...

CVE-2026-64110

A flaw was found in the Linux kernel's igc driver, which handles Intel Gigabit Ethernet devices. When the igcfpeinittxdescriptor function fails to initialize a transmit descriptor, an allocated socket buffer skb is not properly released. This oversight leads to a memory leak within the kernel. Ov...

CVE-2026-64176

A flaw was found in the Linux kernel's iwlwifi driver, affecting older Intel wireless devices. This vulnerability arises from incorrect handling of transmit TX rates, specifically when the driver attempts to set these rates. An attacker could potentially trigger a firmware assert or crash, leadin...

Investigation of STEEP for Secure Communications over SIMO and MISO Channels Subject to Full-Duplex Jamming and Eavesdropping

Secure communications over SIMO and MISO channels between wireless nodes are commonly encountered in applications and widely considered in the literature. This paper investigates such a problem by considering a newly proposed scheme called secrecy-message transmission by echoing encrypted probes...

CVE-2026-64190

In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears team-ops with memset before restoring safe dummy handlers via teamadjustops. A concurrent teamxmit running under RCU on another CPU can...