CVE-2026-64337 usb: mtu3: unmap request DMA on queue failure

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

CVE-2026-64338 USB: misc: uss720: unregister parport on probe failure

In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720probe registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get1284register fails, the error path drops the driver...

EUVD-2026-48882

In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720probe registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get1284register fails, the error path drops the driver...

CVE-2026-64338

In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720probe registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get1284register fails, the error path drops the driver...

CVE-2026-64336

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however...

CVE-2026-64334

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix hard lockup on disconnect If submitting the OOB write urb fails persistently e.g if the device is being disconnected the driver would loop indefinitely with interrupts disabled. Check for urb...

EUVD-2026-48878

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix hard lockup on disconnect If submitting the OOB write urb fails persistently e.g if the device is being disconnected the driver would loop indefinitely with interrupts disabled. Check for urb...

EUVD-2026-48879

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix broken rx after throttle If the port is closed while throttled, the read urb is never resubmitted and the port will not receive any further data until the device is reconnected or the driver is...

EUVD-2026-48876

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference...

CVE-2026-64332

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference...

CVE-2026-64333 USB: serial: digi_acceleport: fix write buffer corruption

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the u...

EUVD-2026-48874

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdmconsumemodes In svdmconsumemodes, the SVID value is read from pmdata-svids using pmdata-svidindex as an array index without bounds validation: paltmode-svid =...

CVE-2026-64329

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccgirqhandler calls ucsinotifycommon, which on a connector-change event calls ucsiconnectorchange and schedules connector work. In ucsiccgremove...

CVE-2026-64330

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdmconsumemodes In svdmconsumemodes, the SVID value is read from pmdata-svids using pmdata-svidindex as an array index without bounds validation: paltmode-svid =...

CVE-2026-64330 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdmconsumemodes In svdmconsumemodes, the SVID value is read from pmdata-svids using pmdata-svidindex as an array index without bounds validation: paltmode-svid =...

CVE-2026-64328 usb: gadget: f_fs: Fix DMA fence leak

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit, which sets its kref counter to 1. Then, dmaresvaddfence gets a second...

CVE-2026-64328

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit, which sets its kref counter to 1. Then, dmaresvaddfence gets a second...

CVE-2026-64324

In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the...

CVE-2026-64323

CVE-2026-64323 affects the Linux kernel UDF filesystem handling. The bug is in udf_load_vat() where the virtual partition start offset is taken from vat20->lengthHeader without validating against the VAT inode size, allowing a fully attacker-controlled 16-bit lengthHeader to underflow s_num_en...

CVE-2026-64323

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...