CVE-2026-64467

The CVE-2026-64467 entry details a Linux kernel vulnerability in the rust_binder path. The issue occurs in Allocation’s Drop when walking the offsets array (binder_size_t = u64 entries): previously the stride and per-entry read used usize, causing 8-byte entries to be advanced in 4-byte steps on ...

EUVD-2026-48811

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

CVE-2026-64467 rust_binder: use a u64 stride when cleaning up the offsets array

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

CVE-2026-64445

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...

CVE-2026-64445 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...

EUVD-2026-48789

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...

CVE-2026-64445 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...

CVE-2026-64445

The CVE-2026-64445 record documents concrete fixes in the Linux kernel (staging: rtl8723bs) for WEP-related issues in the OnAuth() path. Specifically, a vulnerability existed where rtw_wep_decrypt() could read beyond the frame when the frame length was shorter than WLAN_HDR_A3_LEN + iv_len + icv_...

CVE-2026-64445

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...

CVE-2026-64351

CVE-2026-64351 affects the Linux kernel USB Kalmia driver (kalmia_rx_fixup). The bug computes usb_packet_length as skb->len - (2 * KALMIA_HEADER_LENGTH) without ensuring both framing headers are present on every loop iteration. This can allow a short bulk-IN frame to underflow usb_packet_lengt...

CVE-2026-64351 net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmiarxfixup kalmiarxfixup computes usbpacketlength = skb-len - 2 KALMIAHEADERLENGTH as a u16, guarded only by a pre-loop check that skb-len is at least KALMIAHEADERLENGTH, which is 6. ...

CVE-2026-64275

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device...

CVE-2026-64275 Input: elan_i2c - prevent division by zero and arithmetic underflow

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device...

EUVD-2026-48987

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device...

EUVD-2026-48753

A flaw was found in libsoup. An unsigned integer underflow in the soupfilterinputstreamreaduntil function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client...

Linux Distros Unpatched Vulnerability : CVE-2026-26199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the si...

Linux Distros Unpatched Vulnerability : CVE-2026-64467

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, bu...

Linux Distros Unpatched Vulnerability : CVE-2026-64275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: elani2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts ...

PT-2026-64572

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia rx fixup kalmia rx fixup computes usb packet length = skb-len - 2 KALMIA HEADER LENGTH as a u16, guarded only by a pre-loop check that skb-len is at least KALMIA HEADER LENGTH,...

PT-2026-64743

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5e component where the mlx5e xfrm add state function incorrectly handles acquire-flow temporary Security Associations SAs. When allocating software state an...