UBUNTU-CVE-2026-64347

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-64465

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhcifreestreams When a USB device with active stream endpoints is disconnected, xhcifreestreams is called from the hubevent workqueue to free the stream resources. It calls...

UBUNTU-CVE-2026-64336

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however...

UBUNTU-CVE-2026-64337

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

UBUNTU-CVE-2026-64341

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use ...

UBUNTU-CVE-2026-64453

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device. auxiliarydeviceuninit drops the device reference, and for an unbound child that can r...

UBUNTU-CVE-2026-64478

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the...

UBUNTU-CVE-2026-64349

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3readl and dwc3writel calls in dwc3ulpisetup The dwc3ulpisetup calls the register read and write calls with dwc3-regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the...

UBUNTU-CVE-2026-64505

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

CVE-2026-64505

The CVE-2026-64505 entry concerns the Linux kernel USB gadget rndis function. The identified issue involved missing validation of the rndis header fields (MessageType, MessageLength, DataOffset, DataLength) before access. According to the description and linked references, a fix was implemented b...

CVE-2026-64505

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

CVE-2026-64505 usb: gadget: function: rndis: add length check for header

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

CVE-2026-64505

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

CVE-2026-64505 usb: gadget: function: rndis: add length check for header

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

CVE-2026-64491

CVE-2026-64491 affects the Linux kernel’s ALSA subsystem for usx2y/us144mkii. The bug arises in tascam_disconnect(): capture_work and midi_in_work are canceled after URBs are killed, but some URBs may complete in the window between cancel_work_sync() and usb_kill_anchored_urbs(), re‑arming the wo...

CVE-2026-64491

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix work UAF on disconnect tascamdisconnect cancels capturework and midiinwork before usbkillanchoredurbs kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule...

CVE-2026-64478

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the...

CVE-2026-64478

Summary (CVE-2026-64478) : In the Linux kernel, the ALSA: usb-audio path for DualSense devices has been resolved to avoid an unsafe kobject path lookup during rapid hotplug reconnects. The vulnerable code path was in the DualSense jack-detection input handler, where snd_dualsense_ih_match() compa...

CVE-2026-64471

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This...

EUVD-2026-48814

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue...