AZL-96431 CVE-2026-74499 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

UBUNTU-CVE-2026-74499

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

CVE-2026-74497

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode sndusbhandlesyncurb scales received sync packet sizes by the sender's stride and stores the result directly in outpacket-packetsizei. If a connected USB device sends an...

CVE-2026-72403

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

UBUNTU-CVE-2026-72403

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

CVE-2026-72403

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

CVE-2026-72403

Summary: CVE-2026-72403 concerns the Linux kernel ALSA FCP USB handling. A malformed vendor-specific USB interface with no endpoint descriptors can cause a NULL pointer dereference in fcp_find_fc_interface() when it incorrectly reads endpoint 0 from the first vendor-specific interface without ver...

CVE-2026-72403 ALSA: FCP: Fix NULL pointer dereference in interface lookup

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcpfindfcinterface currently selects the first vendor-specific interface...

PT-2026-72951

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd usbmidi akai output snd usbmidi akai output computes its fill-loop bound buf end = ep-max transfer - MAX AKAI SYSEX LEN - 1; as a signed int, so a small device-advertised bulk-OUT max transfe...

Linux Distros Unpatched Vulnerability : CVE-2026-74499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill- loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a...

PT-2026-72591

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcp find fc interface currently selects the first vendor-specific...

PT-2026-72268

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect ims pcu disconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distingui...

CVE-2026-68227

A flaw was found in the cx231xx media driver within the Linux kernel. This vulnerability arises from incorrect management of device-managed resources, where their lifetime is tied to the parent Universal Serial Bus USB device instead of the USB interface. This can lead to memory leaks when driver...

EUVD-2026-55473

In the Linux kernel, the following vulnerability has been resolved: usb: core: port: Deattach Type-C connector on component unbind connectorunbind is the mirror of connectorbind, but it is missing the symmetric call to typecdeattach that connectorbind makes via: if portdev-child...

CVE-2026-68344

The CVE concerns the Linux kernel USB ATM driver (ueagle-atm). A pre-/post-firmware descriptor mismatch in uea_probe() vs uea_disconnect() allows a crafted device to cause an out-of-bounds access when tracing interface data, due to incorrect handling of interface data (struct completion vs struct...

EUVD-2026-55332

In the Linux kernel, the following vulnerability has been resolved: media: airspy: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

Linux Distros Unpatched Vulnerability : CVE-2026-68231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: airspy: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If...

usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

...

CVE-2026-64583

Summary: CVE-2026-64583 affects the Linux kernel usb gadget Broadcom BDC UDC driver. The issue arises from the irq handling window after devm_request_irq() but before teardown, allowing a shared IRQ to dereference freed memory and cause NULL-deref or use-after-free in bdc_udc_interrupt and relate...

CVE-2026-64571

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...