Linux Distros Unpatched Vulnerability : CVE-2026-63895

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from...

Linux Distros Unpatched Vulnerability : CVE-2026-63901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: digiacceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesse...

Linux Distros Unpatched Vulnerability : CVE-2026-63928

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoi...

Linux Distros Unpatched Vulnerability : CVE-2026-63897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: mctu232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale o...

Linux Distros Unpatched Vulnerability : CVE-2026-63899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid...

SUSE CVE-2026-63821

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

CVE-2026-63963

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdmconsumeidentity or svdmconsumeidentitysopprime as the device-controlled value could index of...

CVE-2026-63964

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

CVE-2026-63961

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...

CVE-2026-63956

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...

CVE-2026-63958

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsiconnectorchange The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsiconnectorchange uses it to index the ucsi-connector array without checki...

CVE-2026-63959

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpcimaxim: validate header NDO against RXBYTECNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this, an...

CVE-2026-63960

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pdmessage in wcovereadrxbuffer wcovereadrxbuffer copies the PD RX FIFO into the caller's struct pdmessage with for i = 0; i regmap, USBCRXDATA + i, msg + i; which has two problems:...

CVE-2026-63927

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usbhcdgivebackurb so save the urb-status ahead of time...

CVE-2026-63899

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size...

CVE-2026-63897

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data and leaking it to user space...

CVE-2026-63900

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data...

CVE-2026-63898

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increas...

CVE-2026-63902

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

CVE-2026-63894

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: serialize DMABUF cancel against request completion ffsepfiledmabufiocomplete calls usbepfreerequest on the completed request but leaves priv-req, the back-pointer that ffsdmabuftransfer set on submission, pointi...