EUVD-2026-45580

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...

CVE-2026-64007

The CVE concerns the Linux kernel netfilter synproxy path. In synproxy_tstamp_adjust, the code rewrites the TCP timestamp in place and then updates the TCP checksum via inet_proto_csum_replace4() on a caller-supplied tcphdr pointer. Between retrieving the pointer (via skb_header_pointer) and use,...

CVE-2026-64006 netfilter: nf_tables: fix dst corruption in same register operation

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then...

CVE-2026-64006 netfilter: nf_tables: fix dst corruption in same register operation

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then...

EUVD-2026-45579

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then...

CVE-2026-64006

The CVE affects Linux kernel netfilter nf_tables. A dst corruption in the same-register operation occurred during shift (lshift/rshift) when src and dst pointed to the same memory location: the carry for the next iteration was read from the dst (modified) instead of the original src. The fix cach...

CVE-2026-64006

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then...

CVE-2026-63947 Bluetooth: HIDP: fix missing length checks in hidp_input_report()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

EUVD-2026-45720

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

CVE-2026-63947

CVE-2026-63947 concerns the Linux kernel Bluetooth HIDP path. The vulnerability arises in hidp_input_report(), which reads keyboard/mouse payloads from an skb without first ensuring skb->len has enough data. The caller hidp_recv_intr_frame() fetches the 1-byte HIDP header before dispatching to...

CVE-2026-63947 Bluetooth: HIDP: fix missing length checks in hidp_input_report()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

CVE-2026-63947

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

CVE-2026-63944

The set of CVE records (CVE-2026-63944) describes a Linux kernel issue in Bluetooth hci_sync: hci_le_create_cis_sync that can cause a use-after-free by dereferencing conn->conn_timeout after releasing rcu_read_lock() and hci_dev_lock(hdev). The conn pointer originates from an RCU-protected ite...

CVE-2026-63944 Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix UAF in hcilecreatecissync hcilecreatecissync dereferences conn-conntimeout after releasing both rcureadlock and hcidevlockhdev. The conn pointer was obtained from an RCU-protected iteration over...

EUVD-2026-45717

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix UAF in hcilecreatecissync hcilecreatecissync dereferences conn-conntimeout after releasing both rcureadlock and hcidevlockhdev. The conn pointer was obtained from an RCU-protected iteration over...

CVE-2026-63944 Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix UAF in hcilecreatecissync hcilecreatecissync dereferences conn-conntimeout after releasing both rcureadlock and hcidevlockhdev. The conn pointer was obtained from an RCU-protected iteration over...

CVE-2026-63944

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix UAF in hcilecreatecissync hcilecreatecissync dereferences conn-conntimeout after releasing both rcureadlock and hcidevlockhdev. The conn pointer was obtained from an RCU-protected iteration over...

EUVD-2026-45709

In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358readimp In mt6358readimp, the variable valv is passed to regmapread but the return value is not checked. If the read fails, valv remains uninitialized and its random stack...

CVE-2026-63936 iio: adc: mt6359: fix unchecked return value in mt6358_read_imp

In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358readimp In mt6358readimp, the variable valv is passed to regmapread but the return value is not checked. If the read fails, valv remains uninitialized and its random stack...

CVE-2026-63936

The CVE-2026-63936 entry documents a Linux kernel vulnerability in iio: adc mt6359, where in mt6358_read_imp() the return value of regmap_read() was not checked. As a result, if the read failed, val_v could be uninitialized and later exposed as a measurement result. The fix initializes val_v to z...