CVE-2026-74508 Bluetooth: HIDP: reject frames without a transaction header

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidprecvctrlframe and hidprecvintrframe read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mo...

CVE-2026-74508

CVE-2026-74508 affects the Linux kernel Bluetooth HIDP path. The bug occurs in hidp_recv_ctrl_frame() and hidp_recv_intr_frame(): they read skb->data[0] before verifying the L2CAP SDU header, enabling an uninitialized-byte use from skb tailroom when an empty basic-mode SDU is received or when ...

CVE-2026-74508 Bluetooth: HIDP: reject frames without a transaction header

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidprecvctrlframe and hidprecvintrframe read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mo...

CVE-2026-74507

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA transactio...

CVE-2026-74507

The CVE-2026-74507 vulnerability affects the Linux kernel Bluetooth HIDP implementation. The issue occurs in hidp_get_raw_report()/hidp_process_data() when validating numbered HID reports: a peer can reply with a DATA header and cause the code to read beyond the payload, potentially reading a pee...

EUVD-2026-59700

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA transactio...

CVE-2026-74507 Bluetooth: HIDP: validate numbered report payloads

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA transactio...

CVE-2026-74507 Bluetooth: HIDP: validate numbered report payloads

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA transactio...

EUVD-2026-59665

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields the driver owns, but misses -state and -ublksrvpid. A device added wit...

CVE-2026-74453

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

MINI-3P2R-C9M9-CGXG

Bulletin has no description...

MINI-2MP3-2VJ8-JPPR

Bulletin has no description...

CVE-2026-74399

In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evmxattrs read buffer evmreadxattrs allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlentemp to simplereadfrombuffer. When no configured xattrs are enabled, the...

CVE-2026-74315

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile filehash digests the first LOCKDFHHASHSIZE bytes of nfsfh.data when bucketing nlmfiles, independent of fh.size. Commit 3de744ee4e45 "lockd: Use xdrgen XDR functions fo...

CVE-2026-72501

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Initialize dpi variable to zero dpi is initialized only for BNXTREALLOCWCPAGE, but copied for all the cases. So initialize the dpi to 0...

CVE-2026-72479

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read errors in mma8452read Currently, If i2csmbusreadi2cblockdata fails but mma8452setruntimepmstate succeeds, mma8452read returns 0. As a result, the caller mma8452readraw assumes the read was...

CVE-2026-72481

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2csmbusreadi2cblockdataoremulated...

CVE-2026-72471

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not found within runs0, causing runlookup to return false. This causes runlookupentry to return false, which in turn results in a len value of ...

CVE-2026-72455

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 "apparmor: move check for aanull file to cover all cases" intrdouced a small bug, where pathname may pass a potentially uninitialized name ...

CVE-2026-72444

In the Linux kernel, the following vulnerability has been resolved: flowdissector: check device type before reading ETHADDRS skbflowdissect unconditionally reads 12 bytes from ethhdrskb when FLOWDISSECTORKEYETHADDRS is requested. This assumes the skb has a valid Ethernet header at macheader, whic...