CVE-2026-64089

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative lastchangesetlen batadvpivtt::lastchangesetlen len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative...

CVE-2026-64015

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assocarrayfind in findkeytoupdate without holding the RCU read lock, while the assocarraygc code really is designed around...

CVE-2026-63970

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtiotransportsendpktinfo allocates or reuses the zerocopy uarg before entering the send loop, but virtiotransportallocskb still fills the skb before it inherits that uarg. Whe...

CVE-2026-63964

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

CVE-2026-63963

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdmconsumeidentity or svdmconsumeidentitysopprime as the device-controlled value could index of...

CVE-2026-63962

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: bound altmodedesc per iteration in svdmconsumemodes svdmconsumemodes checks pmdata-altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the loop. I...

CVE-2026-63960

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pdmessage in wcovereadrxbuffer wcovereadrxbuffer copies the PD RX FIFO into the caller's struct pdmessage with for i = 0; i regmap, USBCRXDATA + i, msg + i; which has two problems:...

CVE-2026-63961

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...

CVE-2026-63959

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpcimaxim: validate header NDO against RXBYTECNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this, an...

CVE-2026-63958

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsiconnectorchange The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsiconnectorchange uses it to index the ucsi-connector array without checki...

CVE-2026-63954

In the Linux kernel, the following vulnerability has been resolved: hpfs: fix a crash if hpfsmapdnodebitmap fails If hpfsmapdnodebitmap fails, the code would call hpfsbrelse4 on uninitialized quad buffer head, causing a crash...

CVE-2026-63922

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6parsetlv caches skbnetworkheaderskb in nh while walking IPv6 TLVs. ipv6desthao may call pskbexpandhead for a cloned skb, which can move the skb head and invalidate the cached...

CVE-2026-63923

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvumboxhandlerrepeventnotify rvumboxhandlerrepeventnotify in drivers/net/ethernet/marvell/ octeontx2/af/rvurep.c queues a sender-controlled REPEVENTNOTIFY request body verbatim, and...

CVE-2026-63882

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svmrangesetattr The processinfo could be NULL if user doesn't call kfdioctlacquirevm before calling kfdioctlsvm. cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

CVE-2026-63881

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...

CVE-2026-63879

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpuhmmrangegetpages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the comm...

CVE-2026-63836

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: avoid divide-by-zero for deccwnd The cwnd is always MSS = cwnd = 0x20000000. But the calculation in batadvtpupdatecwnd assumes unsigned 32 bit arithmetics. mss 8 2 / cwnd 8 In case cwnd is actually 0x20000000...

CVE-2026-63835

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadvhardifdisableinterface - ... - batadvvogmifacedisable. In this process, the skb aggrlist is also...

CVE-2026-63834

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: restrict number of unacked list entries When the unackedlist is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more...

CVE-2026-63833

In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into iuid, igid and imode from ntfsgetwslperm. Because the empty-prefi...

CVE-2026-63831

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skbcowdata before in-place crypto llsecdoencryptunauth, llsecdoencryptauth, llsecdodecryptunauth, and llsecdodecryptauth all perform in-place cryptographic transformations on skb data. They build a scatterli...

CVE-2026-63832

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76staadd Since mt7925macstaadd publishes wcid, add publish check in mt76staadd to avoid reinitializing the wcid-polllist. Found dev-stapolllist corruption when using mt7925 and 7.1-rc4...

CVE-2026-63829

In the Linux kernel, the following vulnerability has been resolved: net: ipgre: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other...

CVE-2026-63830

In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The skmsg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells skmsgcomputedatapointers not to expose the entry through writable BPF ctx-data. This...

CVE-2026-63827

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aareplaceprofiles walks ns-rawdatalist to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aaloaddata, list...

CVE-2026-63828

In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg/sendto with MSGFASTOPEN is a combination of connect2 and write2: it opens the connection in the SYN. apparmorsocketsendmsg only checks AAMAYSEND, so a profil...

CVE-2026-63826

In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in storemodes storemodes replaces a framebuffer's modelist with modes from userspace. On success it frees the old modelist with fbdestroymodelist. Two fields still point into that freed list. One pointer...

CVE-2026-63824

In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctlpkeyparamsget2 The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffer is provided. Fix the bug by allocating internal output with the siz...

CVE-2026-63825

In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentation can merge global branch counters with loop induction variables as an optimization. In inflatefast, the inner copy loops get transformed ...

CVE-2026-63823

In the Linux kernel, the following vulnerability has been resolved: keys: Pin requestkeyauth payload in instantiate paths A: requestkey B: KEYCTLINSTANTIATEIOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy...

CVE-2026-63822

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp-txringi.txstatus are released. However this is released again when the device is unbinded ath11kpci, and...

CVE-2026-63820

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing read bio submission on large folio error f2fsreaddatalargefolio can keep a read bio across multiple readahead folios. If a later folio hits an error before any of its blocks are added to the bio, folioinbio is...

CVE-2026-63821

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

CVE-2026-63818

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fsrecoverorphaninodes trusts the orphan block entrycount when replaying orphan inodes from the checkpoint pack. A corrupted entrycount larger than F2FSORPHANSPERBLOCK makes the recovery...

CVE-2026-63819

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on f2fsgetnodefoliora kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 1 SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller 0 PREEMPTfull Hardware name: QEMU...

CVE-2026-63817

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FSCOMPRESSINO uses NMIsbi-maxnid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compresscache mount option is enabled. Wh...

CVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63816

In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping = F2FSIinode-atomicinode-imapping : f2fsiscowfilecowinode is true -...

CVE-2026-63813

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptodate folio from the page cache in movedatablock" This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. The kernel panics are keeping to be reported especially when the f2fs partition get almos...

CVE-2026-63814

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate ACL entry sizes in f2fsaclfromdisk f2fsaclcount only validates the aggregate ACL xattr length. A malformed ACL can still place ACLUSER or ACLGROUP in a slot that only contains struct f2fsaclentryshort bytes, and...

CVE-2026-63812

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FINOEXTENT handling in destroyextentnode When destroyextentnode sets the inode flag FINOEXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the...

CVE-2026-63811

In the Linux kernel, the following vulnerability has been resolved: f2fs: read COW data with the original inode during atomic write When updating an atomic-write file, f2fswritebegin may read the previously written data back from the COW inode: prepareatomicwritebegin locates the block in the COW...

CVE-2026-63810

In the Linux kernel, the following vulnerability has been resolved: block: Avoid mounting the bdev pseudo-filesystem in userspace The bdev pseudo-filesystem is an internal kernel filesystem with which userspace should not interfere. Unregister it so that userspace cannot even attempt to mount it...

CVE-2026-63808

In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfatfinddirentry In exfatfinddirentry, the bufferhead obtained from exfatgetdentry is released with brelsebh before the fall-through TYPEEXTEND branch reads the directory entry through ep...

CVE-2026-63809

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysctl. Since kvzalloc may fall back to vmalloc for large allocations,...

CVE-2026-63806

In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUGON in ioeventfd datamatch with getunaligned Drop a BUGON that has been reachable since it was first added, way back in 2009, and instead use getunaligned to perform potentially-unaligned accesses...

CVE-2026-63807

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, before queryi...

CVE-2026-63804

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2qddealloc gfs2qddealloc, called as an RCU callback from gfs2qddispose, accesses the superblock object sdp through qd-qdsbd after freeing qd. It does so to decrement sdquotacount and wake up...

CVE-2026-63805

In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix nxcryptoctxexit argument nxcryptoctxshashexit calls nxcryptoctxexit with cryptoshashctx... but cryptoshashctx gives a nxcryptoctx , not a cryptotfm . Fix the type in nxcryptoctxexit and drop the bogus cryptotfmct...

CVE-2026-63803

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. That struct ppp is the hdlc-state allocation, which detachhdlcprotocol...