CVE-2026-63908

The CVE-2026-63908 entry concerns the Linux kernel driver for atmel_mxt_ts. A configuration file could supply an object size larger than the driver’s known mxt_obj_size(object); the code intended to discard extra bytes but used a faulty loop bound, checking for i > mxt_obj_size(object). Since ...

CVE-2026-63907

The CVE concerns the Linux kernel driver for uio_pci_sva. The issue arises because uio_pci_sva_dev is allocated with devm_kzalloc() in probe() but is freed explicitly with kfree() both on the probe() error path and again in remove(). Since devm_kzalloc() memory is managed by the device core and i...

CVE-2026-63906

CVE-2026-63906 concerns the Linux kernel USB MUSB driver for the omap2430. The issue is a use-after-free in omap2430_probe() caused by calling of_node_put(np) prematurely before the last access to np, which can lead to a reference-count based crash if the node is freed while still in use. The doc...

CVE-2026-63905

CVE-2026-63905 concerns the Linux kernel’s usbip vudc path, resolving a use-after-free in vudc_remove caused by a race with a timer. The issue arises because vudc_probe() binds an embedded timer to vudc->tr_timer.timer, and usbip_sockfd_store() can start the timer, while vudc_remove() may free...

CVE-2026-63904

The CVE-2026-63904 entry concerns the Linux kernel USBTMC driver and its handling of interrupt-IN notifications. A vulnerability existed where the driver did not verify that the URB actual_length contained the two-byte header payload before accessing data buffers, potentially causing an out-of-bo...

CVE-2026-63902

The CVE-2026-63902 issue affects the Linux kernel USB-serial Cypress M8 driver. cypress_read_int_callback() parses the interrupt-in buffer for two Cypress packet formats (format 1: two-byte status/count header; format 2: one-byte combined header). The interrupt buffer is sized from the endpoint w...

CVE-2026-63903

The CVE-2026-63903 entry concerns the Linux kernel USB-serial Belkin sa driver. The vulnerability arises from belkin_sa_read_int_callback() treating the interrupt data as a four-byte status report and reading LSR/MSR fields from offsets 2 and 3, with the interrupt-in buffer length derived from en...

CVE-2026-63901

The CVE-2026-63901 entry describes a memory corruption fix in the Linux kernel USB serial driver for digi_acceleport. The vulnerability stemmed from missing sanity checks on bulk-out buffer sizes, which could allow out-of-bounds memory accesses or slab corruption if a malicious device reported sm...

CVE-2026-63899

CVE-2026-63899 concerns a memory corruption in Linux kernel USB serial mxuport implementation. The vulnerability arises when handling the bulk-out endpoint where the maximum packet size could be smaller than safe, enabling user-controlled slab corruption if a malicious USB device reports a small ...

CVE-2026-63900

CVE-2026-63900 concerns the Linux kernel USB serial driver for Keyspan devices (usa49wg). The vulnerability was a missing sanity check on the size of indat transfers, which could allow parsing of stale or uninitialised slab data. The issue has been addressed by adding the missing sanity check to ...

CVE-2026-63898

In the Linux kernel USB serial stack, the mct_u232 driver could override the maximum transfer size for a device that only accepts 16-byte packets on its 32-byte bulk-out endpoint, risking slab corruption if a smaller endpoint max packet size was reported. The vulnerability is addressed by ensurin...

CVE-2026-63897

The CVE-2026-63897 entry concerns the Linux kernel USB serial driver mct_u232. A missing sanity check on the size of interrupt-in transfers could allow parsing of stale or uninitialised slab data, potentially leaking kernel data to user space. The vulnerability is addressed by kernel fixes that a...

CVE-2026-63896

The CVE-2026-63896 entry documents a Linux kernel flaw in usb: gadget: composite: GET_URL handling for WebUSB, where landing_page_length is miscomputed as an unsigned difference when wLength

CVE-2026-63895

Summary: CVE-2026-63895 affects the Linux kernel's FunctionFS (f_fs) gadget driver. The bug occurs in ffs_ep0_read(), where a control-OUT request’s data buffer is allocated with kmalloc(len) and then fully copied to userspace via copy_to_user(buf, data, len) even when only ret bytes were actually...

CVE-2026-63893

The connected documents describe a Linux kernel vulnerability in thunderbolt property parsing: a wrap of the 32-bit sum (entry->value + entry->length) allows an attacker-controlled offset to read memory beyond the property block. The root cause is not validating the sum with overflow checks...

CVE-2026-63894

Summary (CVE-2026-63894): A race in Linux kernel’s FunctionFS DMABUF handling allows a freed usb_request to be dequeued via an obsolete priv->req pointer when cancelling a DMABUF attachment. The root cause is that ffs_epfile_dmabuf_io_complete() frees the request but leaves priv->req pointi...

CVE-2026-63892

CVE-2026-63892 affects the Linux kernel thunderbolt property parsing. The non-root path in __tb_property_parse_dir() may read beyond the end of a property block when entry->length length and the code copies 4 dwords from dir_offset regardless of dir_len. This creates two OOB conditions: (1) a ...

CVE-2026-63890

The CVE-2026-63890 entry describes a Linux kernel vulnerability in the SCSI FCoE CVL walker where an unauthenticated L2 peer can hang fcoe_ctlr_recv_work on fcoe, qedf, or bnx2fc initiators by sending a CVL frame with a non‑critical descriptor (fip_dtype >= 128) and fip_dlen == 0. The issue ar...

CVE-2026-63891

The CVE affects the Linux kernel Thunderbolt property parser. A crafted peer can trigger a back‑reference loop in DIRECTORY entries, exhausting stack via __tb_property_parse_dir() because the value is used as dir_offset without a depth counter. The fix threads a depth counter through tb_property_...

CVE-2026-63889

The CVE-2026-63889 entry concerns the Linux kernel, specifically the SCSI FC transport (scsi_transport_fc) and a bug in the FPIN pname walker. The issue triggers when an adjacent Fibre Channel fabric actor can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator, potentially causing a ...

CVE-2026-63887

The CVE-2026-63887 issue affects Linux kernel SCSI/ISCSI login handling. iscsi_encode_text_output() concatenates key=value records into login->rsp_buf using an 8192-byte buffer without checking remaining capacity, while a single PDU can carry up to 2048 pairs, potentially expanding to ~32 KiB....

CVE-2026-63888

The CVE concerns the Linux kernel iSCSI target: two related Text-phase bugs in iscsit_handle_text_cmd() were fixed. First, a CRC32C DataDigest overread occurs because rx_size includes the CRC length when calling iscsit_crc_buf(), reading 4 bytes past the allocated text_in. The patch fixes this by...

CVE-2026-63886

The CVE-2026-63886 entry concerns the Linux kernel SCSI iSCSI path, where chap_server_compute_hash() could overflow a digest buffer during BASE64 decoding. Root cause: chap_r is fed to chap_base64_decode() without validation that the decoded output fits into client_digest (kzalloc(chap->digest...

CVE-2026-63885

The CVE concerns a race in the Linux kernel DRM GEM path: drm_gem_change_handle_ioctl can leave the old handle live in the IDR during the window after spin_unlock(table_lock) and before the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle may decrement handle_coun...

CVE-2026-63884

CVE-2026-63884 affects the Linux kernel i915 driver with a UAF risk during TTM object purge. The issue arises when a bo->ttm object is mutated by ttm_bo_validate() and then cast to an i915_tt pointer, leading to a dereference after the object’s placement/caching policy may be changed (eviction...

CVE-2026-63883

The CVE relates to the Linux kernel serial driver for Qualcomm GENI: a kfifo underflow race when uart_flush_buffer() runs before the DMA completion IRQ. The race sequence can cause stale DMA data to be submitted due to kfifo_len() being reset to 0 while tx_remaining is nonzero, leading to an inco...

CVE-2026-63882

CVE-2026-63882 concerns the Linux kernel’s DRM/AMDKFD component, specifically the function svm_range_set_attr . The issue is a possible NULL pointer dereference where process_info could be NULL if the user does not call kfd_ioctl_acquire_vm before kfd_ioctl_svm . The vulnerability has been fixed ...

CVE-2026-63881

CVE-2026-63881 affects the Linux kernel DRM/AMDKFD debugger path. The get_queue_ids() function computed array_size as num_queues * sizeof(uint32_t), which could overflow on 32-bit size_t builds. The fix replaces this with a safe-sized approach using array_size(), causing saturation to SIZE_MAX on...

CVE-2026-63880

CVE-2026-63880 affects the Linux kernel AMDGPU driver (drm/amdgpu) in the AMDGPU_GEM_OP_GET_MAPPING_INFO path. A -ENOMEM failure in kvcalloc could skip cleanup and leak three locks (drm_gem_object reference, drm_exec lock on the GEM, and drm_exec lock on the per-process VM root PD), causing a loa...

CVE-2026-63879

The CVE-2026-63879 entry relates to the Linux kernel DRM/AMDGPU stack, where a race in amdgpu_hmm_range_get_pages could allow operations on invalid pages due to reading the notifier sequence more than once. The issue has been resolved by a patch that fixes the range getter and also tidies coding ...

CVE-2026-63877

The CVE-2026-63877 entry concerns the Linux kernel DZ serial driver (serial: dz) and its transition from legacy probing to a platform device model. A null-pointer dereference occurred when the first serial port was initialized, caused by using a port parent device that could be derived from a nul...

CVE-2026-63878

The CVE-2026-63878 entry concerns the Linux kernel driver drm/amdgpu, specifically GEM_OP GET_MAPPING_INFO. The issue arises when user-supplied num_entries is used directly to allocate memory via kvcalloc without an upper bound, with num_entries as __u32 and each entry-sized 32 bytes. This can le...

CVE-2026-63876

CVE-2026-63876 concerns the Linux kernel’s DECstation Z85C30 serial driver when initializing the first serial port. The root cause described is a null-pointer-derived access to the port’s parent device during initialisation, leading to a crash. The fix changes the driver to use a platform device ...

CVE-2026-63875

CVE-2026-63875 (arm64 Linux kernel) : The issue occurs during unsharing PMD tables in huge_pmd_unshare(), where tlb_unshare_pmd_ptdesc() sets tlb->unshared_tables=true but aarch64 tlb_flush() only checked tlb->freed_tables. This mismatch allowed stale PMD entries to remain in the walk cache...

CVE-2026-63874

In the Linux kernel, CVE-2026-63874 affects the MCTP USB path (net: mctp: usb). The vulnerability arises from a race between urb completion and rx_retry cancellation during ndo_stop, which could leave an urb queued and re-schedule rx_retry_work. The fix strengthens sequencing between stopping and...

CVE-2026-63873

In the Linux kernel advisory, the bug is in accel/amdxdna handling inside aie2_populate_range, where a missing mmput(mm) before jumping to the again label leaks an mm_struct reference. The issue affects the kernel component implementing the aie2_populate_range path; the root cause is a reference ...

CVE-2026-63872

CVE-2026-63872 affects the Linux kernel esp path (esp4/esp6) where, on skb_to_sgvec failure during esp_output_tail, old skb page fragments are not unrefsed when a second scatterlist build fails. The root cause: a page frag reference leak in the source scatterlist if the destination sgvec creation...

CVE-2026-63871

CVE-2026-63871 concerns the Linux kernel Bluetooth ISO path. The issue is a data-race on the iso_pi fields passed to hci_get_route() in iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync(), which read iso_pi(sk)->dst/src/src_type without holding lock_sock(). Concurre...

CVE-2026-63870

The CVE-2026-63870 issue affects linux ieee802154/6lowpan where non‑IPv6 packets (e.g., from an aoe driver) queued for transmission on a 6LoWPAN interface bypass the IPv6 check. The header creation function returns early and leaves lowpan_addr_info uninitialized in skb headroom; the transmit path...

CVE-2026-63869

Summary of concrete details (CVE-2026-63869): In the Linux kernel’s wifi/mac80211 stack, parsing the radiotap header of an injected frame may read an 8-bit antenna index from userspace and apply it as a shift count, potentially shifting up to 255. The code path ieee80211_parse_tx_radiotap in net/...

CVE-2026-63868

The CVE-2026-63868 issue affects the Linux kernel network code (net: garp) where the on-wire attribute length (ga->len) is used alongside the header to compute dlen. The subtraction dlen = sizeof(*ga) - ga->len underflows, leading to a truncated data length passed to garp_attr_lookup() and ...

CVE-2026-63867

CVE-2026-63867 : In the Linux kernel, a TOCTOU race in MPTCP was resolved in the rcv_wnd computation. The MPTCP output path locklessly accesses the MPTCP-level ack_seq multiple times, potentially using different data_ack values from the DSS option to compute the announced rcv_wnd for the same pac...

CVE-2026-16221

CVE-2026-16221 affects fast-uri versions 2.3.1–4.1.0 (including 3.x up to 3.1.3 and 2.x up to 2.4.2). The root cause is that a literal backslash (U+005C) is not treated as an authority delimiter, causing two URL parsers to extract different hosts from the same input. Node’s native WHATWG URL pars...

CVE-2026-63866

CVE-2026-63866 relates to a Linux kernel issue in the mt76/mt7996 Wi‑Fi stack. The vulnerability arises from the mt7996_mac_sta_deinit_link() routine where the WCID pointer is cleared, removing the STA link. The issue is addressed by kernel fixes documented in the linked patches (stable kernel up...

CVE-2026-63865

Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security advisories to obtain affected products, impact, and remediation.

CVE-2026-63864

The CVE affects the Linux kernel BPF tail-call path. Root cause: visit_tailcall_insn() was added without checking its return value, creating an unchecked error path in tail calls. A fix was applied in commit e40f5a6bf88a to correct stack liveness and propagate the error from visit_tailcall_insn()...

CVE-2026-63863

The CVE-2026-63863 entry concerns the Linux kernel drm/gpusvm subsystem. The issue is a unbalanced unlock of gpusvm notifier_lock detected during drm_gpusvm_scan_mm(), where a path under err_free calls drm_gpusvm_notifier_lock() after unlocking, leading to a bad unlock balance warning. Connected ...

CVE-2026-63862

The CVE-2026-63862 vulnerability affects the Linux kernel’s PCI subsystem for Mediatek Gen3 hardware. In mtk_pcie_setup_irq(), IRQ domains were allocated before obtaining the controller’s IRQ; if obtaining the IRQ fails, allocated domains were not cleaned up, leading to leakage. The mitigation is...

CVE-2026-63861

The CVE covers a Linux kernel SPI subsystem issue: the mtk-snfi (on-host NAND ECC) engine registered during mtk_snand_probe() lacked proper teardown on probe unwind and remove-time cleanup. The fix introduces a devm cleanup action so nand_ecc_unregister_on_host_hw_engine() is automatically invoke...

CVE-2026-63860

The CVE-2026-63860 entry affects the Linux kernel RDMA/core code, where attributes are evaluated as C-strings and NLA_STRING does not ensure a terminating null. The vulnerability is addressed by switching to NLA_NUL_STRING (or equivalent safe comparison via nla_strcmp and adjusted printf formatti...