EUVD-2026-59036

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint...

CVE-2026-68456 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous requestfirmwarenowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...

EUVD-2026-59078

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous requestfirmwarenowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...

ZoneMinder Snapshots - Command Injection

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the...

PT-2026-72671

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421 hub control The max3421 hub control function handles USB hub class requests to the virtual root hub. In the default branches of both the ClearPortFeature and SetPortFeature...

PT-2026-72873

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvc status stop is called from async ctrl.work If a UVC camera has an asynchronous control, uvc status stop may be called from async ctrl.work: uvc ctrl status event work uvc ctrl status event uvc...

PT-2026-72951

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd usbmidi akai output snd usbmidi akai output computes its fill-loop bound buf end = ep-max transfer - MAX AKAI SYSEX LEN - 1; as a signed int, so a small device-advertised bulk-OUT max transfe...

PT-2026-72267

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint...

PT-2026-72265

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in ims pcu irq debug logging The debug logging in ims pcu irq unconditionally prints data from pcu-urb in buf. However, if the interrupt fired for pcu-urb ctrl, the actual data resides in...

PT-2026-72168

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous request firmware nowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...

PT-2026-72631

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during snd usb midi v2 create. A later setup failure can still jump to snd usb midi v2 free, which currently frees each endpoint and its...

PT-2026-72950

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill max is set When a USB audio endpoint requests full packet transfers via the fill max descriptor flag, data ep set params promotes ep-curpacksize to ep-maxpacksize...

PT-2026-72949

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd usb handle sync urb scales received sync packet sizes by the sender's stride and stores the result directly in out packet-packet sizei. If a connected USB device sen...

CVE-2026-74500

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status sndrmedigifacereadstatus reads a four-word status block from the device into an uninitialised on-stack le32 buf4 and, whenever the vendor control-IN transfer does not...

CVE-2026-74501

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata, but it never installs an...

CVE-2026-74499

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

CVE-2026-74498

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fillmax is set When a USB audio endpoint requests full packet transfers via the fillmax descriptor flag, dataepsetparams promotes ep-curpacksize to ep-maxpacksize. However,...

CVE-2026-74459

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: es58xreadbulkcallback: fix RX buffer leak on URB resubmit failure es58xreadbulkcallback resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handl...

CVE-2026-74458

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...

CVE-2026-74455

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...