CVE-2026-64503

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on writeraw error kxsd9writeraw takes a runtime PM reference with pmruntimegetsync but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the...

CVE-2026-64449

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: bound slave read/write to the kernbuf size The SLAVE-path helpers buffertouser and bufferfromuser copy 'count' bytes into/out of the fixed-size kernbuf sizebuf == PCIBUFSIZE == 0x20000, 128 KiB using ppos as the...

CVE-2026-64440

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof struct HTcapselement. Because pIE-length is a raw u8 from an...

CVE-2026-64435

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

CVE-2026-64402

In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smbsyncperfbuffer When the SMB sink is used as a perf AUX sink, smbupdatebuffer calls smbsyncperfbuffer to copy hardware trace data into the perf AUX ring buffer pages. It derives pgidx =...

CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

CVE-2026-64399

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl overwrites the destination file's data via vfsclonefilerange with neither the share-level KSMBDTREECONNFLAGWRITABLE che...

CVE-2026-64342

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect Submitted write URBs are not stopped on close and therefore need to be stopped unconditionally on disconnect to avoid use-after-free in the completion handler...

CVE-2026-64336

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however...

CVE-2026-64333

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the u...

CVE-2026-64298

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAYWRITE in open permission mask for OTRUNC POSIX requires write permission to truncate a file, so an open that specifies OTRUNC must be authorized for write access regardless of the OACCMODE access mode...

CVE-2026-64269

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

UBUNTU-CVE-2026-64435

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

UBUNTU-CVE-2026-64440

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof struct HTcapselement. Because pIE-length is a raw u8 from an...

UBUNTU-CVE-2026-64391

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...

UBUNTU-CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

UBUNTU-CVE-2026-64333

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the u...

UBUNTU-CVE-2026-64298

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAYWRITE in open permission mask for OTRUNC POSIX requires write permission to truncate a file, so an open that specifies OTRUNC must be authorized for write access regardless of the OACCMODE access mode...

UBUNTU-CVE-2026-64399

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl overwrites the destination file's data via vfsclonefilerange with neither the share-level KSMBDTREECONNFLAGWRITABLE che...

UBUNTU-CVE-2026-64503

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on writeraw error kxsd9writeraw takes a runtime PM reference with pmruntimegetsync but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the...