CVE-2026-68401

The CVE-2026-68401 entry concerns Linux kernel firmware: arm_ffa, specifically the ffa_setup_and_transmit() path. The issue is out-of-bounds writes: (1) Writing ep_mem_access->reserved can exceed bounds for FFA versions

CVE-2026-68401

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit Sashiko locally reports multiple out-of-bound issues in ffasetupandtransmit: 1 Writing epmemaccess-reserved can write out of bounds for FFA versions 1.2 as...

CVE-2026-68401 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit Sashiko locally reports multiple out-of-bound issues in ffasetupandtransmit: 1 Writing epmemaccess-reserved can write out of bounds for FFA versions 1.2 as...

CVE-2026-68373 wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76guessfreq at76guessfreq checks only that the received frame is at least a bare 802.11 header 24 bytes before subtracting the fixed management-body offset: len -= eloff; For both...

CVE-2026-68373

The CVE-2026-68373 entry documents a Linux kernel vulnerability in the wifi: at76c50x-usb driver, where at76_guess_freq() can underflow when processing beacon and probe response frames. If a frame is shorter than the 36-byte element offset (el_off), the subtraction len -= el_off causes an oversiz...

CVE-2026-68373

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76guessfreq at76guessfreq checks only that the received frame is at least a bare 802.11 header 24 bytes before subtracting the fixed management-body offset: len -= eloff; For both...

EUVD-2026-55559

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76guessfreq at76guessfreq checks only that the received frame is at least a bare 802.11 header 24 bytes before subtracting the fixed management-body offset: len -= eloff; For both...

CVE-2026-68373 wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76guessfreq at76guessfreq checks only that the received frame is at least a bare 802.11 header 24 bytes before subtracting the fixed management-body offset: len -= eloff; For both...

CVE-2026-68371 usb: musb: omap2430: Do not put borrowed of_node in probe

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed ofnode in probe omap2430probe stores pdev-dev.ofnode in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. The success and error paths...

CVE-2026-68371

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed ofnode in probe omap2430probe stores pdev-dev.ofnode in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. The success and error paths...

EUVD-2026-55472

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed ofnode in probe omap2430probe stores pdev-dev.ofnode in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. The success and error paths...

CVE-2026-68371 usb: musb: omap2430: Do not put borrowed of_node in probe

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed ofnode in probe omap2430probe stores pdev-dev.ofnode in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. The success and error paths...

CVE-2026-68371

CVE-2026-68371 relates to the Linux kernel subsystem usb: musb: omap2430. The vulnerability arises when omap2430_probe() stores pdev->dev.of_node in a local np variable (a borrowed pointer) and erroneously calls of_node_put(np) on all paths. This drains a reference owned by the platform device...

CVE-2026-68369 usb: gadget: printer: fix infinite loop in printer_read()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printerread printerread uses the same variable for the requested copy size and the number of bytes actually copied to user space. copytouser returns the number of bytes not copied, so wh...

CVE-2026-68369

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printerread printerread uses the same variable for the requested copy size and the number of bytes actually copied to user space. copytouser returns the number of bytes not copied, so wh...

EUVD-2026-55470

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printerread printerread uses the same variable for the requested copy size and the number of bytes actually copied to user space. copytouser returns the number of bytes not copied, so wh...

CVE-2026-68369

The CVE affects the Linux kernel USB gadget printer driver (printer_read) where the code used the same variable for the requested copy size and the actual copied bytes. If copy_to_user fails to copy anything, the copied length becomes zero and RX data can cause an infinite loop because len/buf/cu...

CVE-2026-68369 usb: gadget: printer: fix infinite loop in printer_read()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printerread printerread uses the same variable for the requested copy size and the number of bytes actually copied to user space. copytouser returns the number of bytes not copied, so wh...

CVE-2026-68353

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx without validation against the buffer length. This allows...

CVE-2026-68353

The CVE-2026-68353 entry describes a Linux kernel vulnerability in the ath6kl WiFi driver where the firmware-controlled num_msg field (u8, 0–255) could drive a loop in ath6kl_wmi_tx_complete_event_rx() past the WMI event buffer, enabling out-of-bounds reads up to 1020 bytes. The fix adds a check ...