CVE-2026-68344

The CVE concerns the Linux kernel USB ATM driver (ueagle-atm). A pre-/post-firmware descriptor mismatch in uea_probe() vs uea_disconnect() allows a crafted device to cause an out-of-bounds access when tracing interface data, due to incorrect handling of interface data (struct completion vs struct...

EUVD-2026-55332

In the Linux kernel, the following vulnerability has been resolved: media: airspy: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: usb: ChipIdea UDC: Fix for DMA and SG cleanup in epnuke The ChipIdea UDC driver may encounter errors where “not-page-aligned sg buffers” occur when a USB device is reconnected after being disconnected during an active transfer...

Linux Distros Unpatched Vulnerability : CVE-2026-68231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: airspy: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If...

usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

...

CVE-2026-64583

Summary: CVE-2026-64583 affects the Linux kernel usb gadget Broadcom BDC UDC driver. The issue arises from the irq handling window after devm_request_irq() but before teardown, allowing a shared IRQ to dereference freed memory and cause NULL-deref or use-after-free in bdc_udc_interrupt and relate...

CVE-2026-64571

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

CVE-2026-64571

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

CVE-2026-64571

Technical details are not publicly available in the provided documents. Monitor for updates on affected versions, fixes, and affected hardware/software.

CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

CVE-2026-64571

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

Linux Distros Unpatched Vulnerability : CVE-2026-64571

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without...

PT-2026-67672

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in ims pcu process data The ims pcu process data processes incoming URB data byte by byte. However, it fails to check if the read pos index exceeds IMS PCU BUF SIZE. If a malicious USB...

CVE-2026-64331

A flaw was found in the Linux kernel's usbip virtual USB device controller vudc. This vulnerability, a NULL pointer dereference, occurs when vepallocrequest fails to initialize a vrequest's udc field, causing asynchronous input/output AIO cancellations on the FunctionFS path to arrive without a...

SUSE CVE-2026-64346

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

CVE-2026-64478

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the...

UBUNTU-CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64342

The CVE-2026-64342 issue concerns the Linux kernel USB iowarrior driver. A use-after-free is triggered because submitted write URBs are not stopped on close(), and are not unconditionally halted on disconnect, allowing a completion handler to access freed resources. Multiple vendor advisories (Re...

CVE-2026-64337

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

CVE-2026-64337 usb: mtu3: unmap request DMA on queue failure

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...