CVE-2026-64301

The CVE-2026-64301 issue affects the Linux kernel regulator subsystem for SCMI: the function scmi_regulator_probe() calls of_find_node_by_name(), which takes a reference to the device node. On the error path of process_scmi_regulator_of_node(), the code returned without calling of_node_put(), lea...

CVE-2026-64300

CVE-2026-64300 (Linux kernel, perf/aux): Concrete details across connected docs show a page-use-after-free (UAF) in map_range() due to reading rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff under the wrong mutex, enabling a race between rb_alloc_aux() and map_range() when PERF_EVEN...

CVE-2026-64298

CVE-2026-64298: Linux kernel NFSv4: when O_TRUNC is used, the open permission mask must include MAY_WRITE so the local check aligns with server behavior. Current nfs_open_permission_mask() derives the mask from O_ACCMODE, which can let an open(O_RDONLY|O_TRUNC) pass local checks while the server ...

CVE-2026-64299

CVE-2026-64299 (Linux kernel) fixes an out-of-bounds read in glob matching within tracing at xfs_lookup tracepoints by introducing a length-bounded glob_match_len() and using it in regex_match_glob(). String event fields may not be NUL-terminated, so previous length handling was inconsistent; the...

CVE-2026-64297

CVE-2026-64297 concerns a Linux kernel module path in which module_extend_max_pages() calls kvrealloc() and returns -ENOMEM on failure, but the return value is never checked. If the initial allocation fails, info->pages is NULL and info->max_pages is 0; later calls to module_get_next_page()...

CVE-2026-64296

The CVE concerns the Linux kernel exFAT driver: in exfat_find_dir_entry(), processing directory NAME entries (TYPE_EXTEND) advances the output buffer by a fixed amount while the guard tracks name length, allowing an out-of-bounds read/write when name fragments are long/short. The bug arises becau...

CVE-2026-64295

The vulnerability CVE-2026-64295 affects the Linux kernel’s page_ext iteration API. The issue arises when memory hotplug advances the iterator past the last valid section, causing page_ext_lookup to dereference a NULL PFN. The root cause is that for_each_page_ext() can increment the iterator boun...

CVE-2026-64294

CVE-2026-64294 : In the Linux kernel(mm subsystem) a vulnerability was resolved where inode ownership checks for side-channel protection in mincore() and MADV_PAGEOUT used nop_mnt_idmap, ignoring the file mount’s idmap. This could misreport ownership under idmapped mounts (e.g., when file ownersh...

CVE-2026-64292

The CVE-2026-64292 issue affects the Linux kernel iommufd path where veventq memory allocations occurred inside a spinlock. The underlying cause is that user-space-configured veventq depth could allow large queue allocations, exhausting atomic memory reserves. The mitigated fix moves the allocati...

CVE-2026-64293

CVE-2026-64293 affects the Linux kernel iommufd component. A 32-bit bound-check in iommufd_veventq_fops_read() uses sizeof(hdr) (size of the pointer) instead of sizeof(*hdr), causing under-count of the vEVENT header and potentially writing past the user buffer during header+data payload copy. Mul...

CVE-2026-64290

The CVE-2026-64290 issue affects the Linux kernel iommufd component. A copy_to_user() failure in iommufd_fault_fops_read() can cause the outer loop to spin, since only the inner loop breaks and the outer while retriggers the operation while holding fault->mutex, yielding 100% CPU and a DoS con...

CVE-2026-64291

CVE-2026-64291 affects the Linux kernel’s iommufd: veventq_depth upper bound. The issue: iommufd_veventq_alloc() accepts any non-zero depth up to U32_MAX, enabling userspace to allocate excessively large queues and exhaust kernel memory reserves. Mitigation/patch: cap veventq_depth to 1 <

CVE-2026-64289

CVE-2026-64289 (Linux kernel) affects the iommufd path where iommufd_hwpt_invalidate() uses user-controlled entry_num and entry_len. The issue arises because these values were previously only bounded by U32_MAX, allowing excessively large inputs to drive the backend invalidation loop and cause pr...

CVE-2026-64287

CVE-2026-64287 affects the Linux kernel’s KVM on arm64. The issue stems from flush_hyp_vcpu() copying host vgic_v3 state to the hyp’s vCPU and not enforcing the expected bound on list registers, which can lead to out-of-bounds access to ICH_LR_EL2 when host values exceed the number of implemented...

CVE-2026-64288

CVE-2026-64288 concerns the Linux kernel’s KVM arm64 subsystem. The vulnerability arises from a NULL dereference in VNCR pseudo-TLB invalidation, which can race against a vcpu being onlined or against an unallocated pseudo-TLB, leading to unsafe dereferences during MMU notifier or TLBI-triggered ...

CVE-2026-64286

CVE-2026-64286 affects the Linux kernel’s KVM on arm64. The vulnerability arises in flush_hyp_vcpu(): it copies the host vCPU context into the hyp private vCPU on every run. The guest-context resolver (ctxt_to_vcpu()) expects a NULL __hyp_running_vcpu (only set on the host); since the host’s valu...

CVE-2026-64285

CVE-2026-64285 affects the Linux kernel KVM SNP guest activity. When populating a guest_memfd’s initial CPUID data, KVM may pin the source page as writable, because KVM writes back CPUID information if userspace data is rejected by trusted firmware. Because the page is accessed via a kernel mappi...

CVE-2026-64284

CVE-2026-64284 — Linux kernel (KVM/x86): The vulnerability involves moving the handling of fastpath userspace exits into vendor code so KVM can run vendor-specific operations before userspace gains control of the vCPU. The description notes that, for VMX (and soon SVM), KVM must flush the PML buf...

CVE-2026-64283

CVE-2026-64283 : In the Linux kernel KVM guest_memfd binding, the offset and size for a memslot were treated inconsistently (signed/unsigned), enabling a potential overflow-related bypass where an extremely large positive offset plus size could be misinterpreted as smaller than the file size. The...

CVE-2026-64282

CVE-2026-64282 affects the Linux kernel (arm64 KVM). When kvm_translate_vncr() races with the MMU notifier, the early return does not release the faulted PFN, potentially leaking a PFN. The fix adds a call to kvm_release_faultin_page() to release the unused PFN. Public advisories (SUSE, NVD, Debi...

CVE-2026-64281

CVE-2026-64281 affects the Linux kernel svcrdma transport (svc_rdma) where threads parked in svc_rdma_sq_wait() could hang indefinitely during transport teardown due to missing wakeups on close. The fixed flow adds svc_rdma_xprt_deferred_close(), which calls svc_xprt_deferred_close() and then wak...

CVE-2026-64280

The CVE concerns the Linux kernel’s FPGA driver for DFL FPGA management (fpga: dfl-afu). A 64-bit length passed via the DFL_FPGA_PORT_DMA_MAP ioctl to afu_ioctl_dma_map() can overflow when computing the number of pages (length >> PAGE_SHIFT) passed to pin_user_pages_fast(), since npages is ...

CVE-2026-64279

CVE-2026-64279 concerns the Linux kernel i2c core: a race in adapter deregistration where an adapter may be accessed after resources are freed. The fix removes the adapter from the IDR before tearing it down during deregistration or on registration failure to prevent use-after-free of resources s...

CVE-2026-64278

The CVE-2026-64278 issue affects the Linux kernel i2c driver for imx-lpi2c on some i.MX platforms. A workqueue can trigger I2C transfers while hardware resources (clock/pinctrl) are disabled or not yet restored during the suspend/noirq suspend → resume_noirq window, risking access to I2C register...

CVE-2026-64276

CVE-2026-64276 affects the Linux kernel synaptics-rmi4 input driver. The F30/GP I/O mapping code incorrectly allocated gpioled_key_map for at most 6 entries but later iterated up to gpioled_count (0..31) and advanced input->keycodemax to the full count, risking out-of-bounds reads in the atten...

CVE-2026-64277

The CVE-2026-64277 issue affects the Linux kernel synaptics-rmi4 input driver. The rmi_f3a_map_gpios() path allocates gpio_key_map using min(gpio_count, TRACKSTICK_RANGE_END) (at most 6 entries), but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], while input-&g...

CVE-2026-64275

The CVE-2026-64275 entry concerns the Linux kernel Elan I2C touchpad driver. Public documents describe a vulnerability where invalid firmware or device-tree-provided x_traces/y_traces (zero values) could trigger a fatal division-by-zero during device probe, and where an underflow in touch reporti...

CVE-2026-64274

Summary: CVE-2026-64274 affects the Linux kernel Goodix touchscreen driver. The runtime check for the device-reported touch count does not clamp the value (ts->max_touch_num) to the maximum supported contacts, which can be up to 15 due to a 4‑bit field. This allows a stack-based out-of-bounds ...

CVE-2026-64273

CVE-2026-64273 describes a Linux kernel issue in the iforce driver where a status packet uses a device-provided force-feedback effect index without proper bounds. Specifically, data[1] is masked with 0x7f (0–127) while core_effects[] only has IFORCE_EFFECTS_MAX (32) entries. For indices 32–127, t...

CVE-2026-64272

The CVE-2026-64272 issue applies to the Linux kernel, affecting MMS114-driven touch controllers MMS134S and MMS136. The event size is 6 bytes, but the driver reads into a buffer using an 8-byte per-entry assumption (sizeof(struct mms114_touch)), causing subsequent events to be read from incorrect...

CVE-2026-64271

CVE-2026-64271 concerns the Linux kernel touchscreen code for the Touchwindow (touchwin) input path. A vulnerability arises in tw_interrupt() where non-zero serial bytes are accumulated in a fixed three-byte buffer with an index reset only when the 2nd and 3rd bytes match (tw->data[1] == tw-&g...

CVE-2026-64270

CVE-2026-64270 affects the Linux kernel where mms114_interrupt() reads I2C touch data into a fixed-size stack buffer without properly bounding the reported packet_size. A malicious or faulty device/controller can report packet_size up to 255, allowing a write past the end of touch[] on the IRQ th...

CVE-2026-64269

The CVE-2026-64269 issue affects the Linux kernel’s RDMA path (RDMA/rtrs-srv) where rdma_write_sg() uses desc[0].len from the wire descriptor to determine the RDMA_WRITE length. The length could exceed the bound of the mapped chunk because it wasn’t checked against max_chunk_size, enabling a peer...

CVE-2026-64268

CVE-2026-64268 concerns a Linux kernel vulnerability in the SIW (RDMA) path where Read Response segments could overrun the sink buffer. The issue resides in siw_qp_rx.c (siw_proc_rresp) which places inbound Read Response DDP segments at sge->laddr + wqe->processed and accumulates processed ...

CVE-2026-64267

Summary: CVE-2026-64267 affects the Linux kernel's FUSE prune notification handling. On 32-bit systems, FUSE_NOTIFY_PRUNE could misvalidate the payload length, allowing a daemon-controlled count to wrap and trigger a copy loop that may read nodeids not present in the userspace buffer (e.g., in QE...

CVE-2026-64266

CVE-2026-64266 affects the Linux kernel fuse subsystem. The vulnerability stems from fuse_ref_folio() unlocking the request but not re-locking before return, allowing fuse_chan_abort() to end the request and for the async end callback to free args while the copy chain later accesses them, causing...

CVE-2026-64265

The CVE-2026-64265 issue affects the Linux kernel fuse subsystem. When fuse_resend() moves a request from fpq->processing back to fiq->pending, it marks FR_PENDING and clears FR_SENT but fails to remove the request’s intr_entry from fiq->interrupts. If FR_INTERRUPTED was set previously, ...

CVE-2026-64263

CVE-2026-64263 affects the Linux kernel fuse-uring subsystem. The issue arises when fuse_uring_cancel() moves entries that are still available (with no reqs) to the ent_in_userspace list and ent_list_request_expired() dereferences ent->fuse_req unconditionally, which can crash a cancelled entr...

CVE-2026-64264

In CVE-2026-64264, the Linux kernel fuse-uring path is affected: copy_from_user can leave a positive residual in err, then -EFAULT is overwritten by fuse_uring_req_end, causing an incorrect success path and potentially uninitialised req->out.args. The fix assigns err = -EFAULT in the failure b...

CVE-2026-64262

The CVE-2026-64262 entry concerns a Linux kernel issue in fuse-uring where, during io_uring task work with tw.cancel set, the cancel handling could leave a fuse_req reference in the userspace queue and fail to end the request, potentially delaying cleanup: the code path could set -ECANCELED, mark...

CVE-2026-64260

CVE-2026-64260 affects the Linux kernel’s fuse-uring path. The issue concerns races on the queue->stopped flag: several readers check the value under a lock, but fuse_uring_commit_fetch() (and in fuse_uring_abort_end_requests() as noted) did not, meaning the flag could be observed/modified wit...

CVE-2026-64261

The CVE-2026-64261 issue affects the Linux kernel’s fuse-uring component. The vulnerability arises when fuse_uring_async_stop_queues() might run after the last reference on ring->queue_refs has been dropped, risking use-after-free. Red Hat, SUSE, Debian OSV, and other trackers confirm the flaw...

CVE-2026-64259

CVE-2026-64259 (Linux kernel, fuse-uring) : A race allowed a use-after-free in fuse-uring by letting a fuse_req on an SQE commit become findable after memcpy, if a malicious userspace sent commit SQEs before the request reached fuse-server. The fix reorders operations: moving fuse_uring_add_to_pq...

CVE-2026-64258

CVE-2026-64258 affects the Linux kernel fuse-uring path. When copying into the userspace ring buffer fails, fuse_uring_req_end() clears ent->fuse_req but may leave the ent_w_req_queue entry in FRRS_FUSE_REQ, enabling a NULL dereference during expiration scanning. The fix removes the entry from...

CVE-2026-64257

CVE-2026-64257 affects the Linux kernel SMB2 client logic. The issue arose from overlap handling in __smb2_calc_size(), where clearing data_length could cause an invalid SMB2 response to appear as if it has no data area, allowing an unintended length-exemption path. The fix tracks data area overl...

CVE-2026-64256

CVE-2026-64256 affects the Linux kernel/XFS: a dqiterate quota-id loop uses an unsigned 32-bit q_id, which can wrap when reaching XFS_DQ_ID_MAX, causing the iteration to restart. The fix casts to 64-bit (u64) to prevent truncation. Exploitation details are not provided in the supplied documents. ...

CVE-2026-16766

Catalyst::View::Wkhtmltopdf for Perl versions before 0.6.1 are vulnerable to shell command injection (RCE) via PDF render options. The vulnerability arises because options passed to wkhtmltopdf are not sanitized, and user-controlled options such as page_size, orientation, or margins can inject co...

CVE-2026-10818

WPForms Pro (WordPress) is affected by an Arbitrary File Upload vulnerability up to version 1.10.1.1, exploitable via the ajax_chunk_upload_finalize path. The issue arises because file type validation occurs after chunk metadata and file contents are written to disk, and the assembled file isn’t ...

CVE-2026-15425

The CVE concerns the Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress (Yoast SEO) vulnerable to Stored Cross-Site Scripting via the Post Slug (post_name) feature. Affected versions: all up to and including 28.0. Root cause: insufficient input sanitization and ...

CVE-2026-14955

The CVE-2026-14955 entry affects the Checkout Field Editor for WooCommerce (Pro) for WordPress, specifically versions up to 3.7.7. The root cause is a Directory Traversal vulnerability in the thwcfe_legacy_file parameter, allowing authenticated users with subscriber-level access and above to read...