CVE-2026-90020 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...

CVE-2026-90020 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...

CVE-2026-90019 usb: gadget: fix null pointer dereference in usb_put_function_instance()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocinst error path. However, fd is not allocated until later in...

EUVD-2026-80628

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...

CVE-2026-89881 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...

CVE-2026-89881

This CVE affects the rtl2832_sdr media driver in the Linux kernel . On USB disconnect, rtl2832_sdr_remove() clears dev->udev to NULL before any pending streaming teardown has completed. When user space subsequently closes its file descriptor, usb_free_coherent() is invoked with a NULL device p...

EUVD-2026-80481

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...

CVE-2026-89881 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...

CVE-2026-89817

CVE-2026-89817 affects the Linux kernel DRM/GUD driver. The function gud_connector_add_tv_mode() reads fixed-size TV mode name buffers from a USB device and passes pointers to drm_mode_create_tv_properties_legacy(), which calls strlen() on each name. Because the device does not guarantee NUL-term...

Panasonic Industry MINAS A5/A6 USB device drivers for Windows vulnerable to buffer overflow

Overview MINAS A5/A6 USB device drivers for Windows provided by Panasonic Industry Co., Ltd. contain the following vulnerability. Classic Buffer Overflow CWE-120 - CVE-2026-16726 Luca Borzacchiello of Nozomi Networks reported the issue directly to Panasonic. Panasonic reported this issue to...

kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()

A flaw was found in the Linux kernel's ioti USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the getmanufinfo function. This occurs because the driver does not properly validate the size of data read from the...

kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()

A flaw was found in the Linux kernel's ioti USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the getmanufinfo function. This occurs because the driver does not properly validate the size of data read from the...

SUSE CVE-2026-89621

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

PT-2026-93686

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the USB gadget functionfs ffs component. The io data structure stores a pointer to the mm struct of the submitting task but fails to maintain a reference...

PT-2026-93667

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb: typec: qcom-pmic component where the pdphy stop function disables IRQs but leaves reset work pending. If the IRQ handler schedules this work immediately befor...

PT-2026-93662

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB gadget MIDI function where work is not properly initialized. The f midi alloc function initializes free ref to 1, but the INIT WORK process is only performed...

PT-2026-93685

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free issue exists in the USB gadget functionfs module. In the ffs epfile write iter and ffs epfile read iter functions, when ffs epfile io fails with an error other than...

PT-2026-93664

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference exists in the fsg common set num buffers function within the usb gadget mass storage module. This occurs when the kstrtou8 function returns a value of 0 or 1 f...

CVE-2026-90045: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling iodata stores a pointer to the submitting task's mmstruct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task...

CVE-2026-90044: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix Use-After-Free in AIO error path In ffsepfilewriteiter and ffsepfilereaditer, when ffsepfileio fails with an error other than -EIOCBQUEUED, the iodata structure p is freed. However, for AIO operations, the...