CVE-2026-63892 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...

CVE-2026-63891 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...

CVE-2026-63890 scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fipdlen in CVL walker drivers/scsi/fcoe/fcoectlr.c::fcoectlrrecvclrvlink advanced the descriptor cursor by an attacker-supplied fipdlen without ever requiring dlen = sizeofstruct fipde...

CVE-2026-63889 scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

In the Linux kernel, the following vulnerability has been resolved: scsi: scsitransportfc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport...

CVE-2026-63887 scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput concatenates "key=value\0" records into login-rspbuf, an 8192-byte kzallocMAXKEYVALUEPAIRS buffer allocated in iscsitallocloginsetupbuffer...

CVE-2026-63888 scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextcmd Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c "iscsi-target: Add iSCSI fabric suppor...

CVE-2026-63886 scsi: target: iscsi: Validate CHAP_R length before base64 decode

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAPR length before base64 decode chapservercomputehash allocates clientdigest as kzallocchap-digestsize and then, for BASE64-encoded responses, passes chapr directly to chapbase64decode without...

CVE-2026-63885 drm/gem: fix race between change_handle and handle_delete

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlocktablelock and the final spinlocktablelock. A concurrent drmgemhandledelete ...

CVE-2026-63884 drm/i915: Fix potential UAF in TTM object purge

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

CVE-2026-63883 serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ

In the Linux kernel, the following vulnerability has been resolved: serial: qcomgeni: fix kfifo underflow when flush precedes DMA completion IRQ When uartflushbuffer runs before the DMA completion IRQ is delivered, the following race can occur all steps serialized by uartportlock: 1. DMA starts:...

CVE-2026-63882 drm/amdkfd: fix NULL pointer bug in svm_range_set_attr

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svmrangesetattr The processinfo could be NULL if user doesn't call kfdioctlacquirevm before calling kfdioctlsvm. cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

CVE-2026-63881 drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...

CVE-2026-63880 drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lock leak on ENOMEM in AMDGPUGEMOPGETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO branch of amdgpugemopioctl holds three cleanup-tracked resources before calling kvcalloc: the drmgemobject reference from...

CVE-2026-63879 drm/amdgpu: fix amdgpu_hmm_range_get_pages

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpuhmmrangegetpages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the comm...

CVE-2026-63878 drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check numentries in GEMOP GETMAPPINGINFO kvcallocargs-numentries, sizeofvmentries, GFPKERNEL at amdgpugem.c:1050 uses the user-supplied numentries directly without any upper bounds check. Since numentries is a u32 and...

CVE-2026-63877 serial: dz: Convert to use a platform device

In the Linux kernel, the following vulnerability has been resolved: serial: dz: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to colour frame buffer device 160x64 tgafb: SFB+ detected, rev=0x02 fb0: Digital ZLX-E1 frame...

CVE-2026-63876 serial: zs: Convert to use a platform device

In the Linux kernel, the following vulnerability has been resolved: serial: zs: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to mono frame buffer device 160x64 fb0: PMAG-AA frame buffer device at tc0 DECstation Z85C30...

CVE-2026-63875 arm64: tlb: Flush walk cache when unsharing PMD tables

In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When hugepmdunshare is called to unshare a PMD table, the tlbunsharepmdptdesc function sets tlb-unsharedtables=true but the aarch64 tlbflush only checked tlb-freedtables to...

CVE-2026-63874 net: mctp: usb: fix race between urb completion and rx_retry cancellation

In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rxretry cancellation It's possible that sequencing between setting -stopped and cancelling the rxretry work in ndostop could leave us with an urb queued: T1: ndostop T2:...

CVE-2026-63873 accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mmstruct reference leak in aie2populaterange aie2populaterange jumps back to the again label without calling mmputmm, leaking a reference to the mmstruct. Add the missing mmput before jumping to again...

CVE-2026-63872 esp: fix page frag reference leak on skb_to_sgvec failure

In the Linux kernel, the following vulnerability has been resolved: esp: fix page frag reference leak on skbtosgvec failure In espoutputtail, when esp-inplace is false, the old skb page frags are replaced with a new page from the xfrm pagefrag cache. The source scatterlist sg is built from the ol...

CVE-2026-63870 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpanxmit The aoe driver or similar generates a non-IPv6 packet e.g., ETHPAOE and queues it for transmission via devqueuexmit on a 6LoWPAN interface configured by the user or test...

CVE-2026-63871 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...

CVE-2026-63869 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211parsetxradiotap When parsing the radiotap header of an injected frame, ieee80211parsetxradiotap uses the IEEE80211RADIOTAPANTENNA value directly as a shift count:...

CVE-2026-63868 net: garp: fix unsigned integer underflow in garp_pdu_parse_attr

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...

CVE-2026-63867 mptcp: close TOCTOU race while computing rcv_wnd

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

CVE-2026-63865 bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop tasktoinode and inetconnestablished from lsm sleepable hooks bpflsmtasktoinode is called under rcureadlock and bpflsminetconnestablished is called from softirq context, so neither hook can be used by sleepable LSM...

CVE-2026-63866 wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Clear wcid pointer in mt7996macstadeinitlink Clear WCID pointer removing the sta link in mt7996macstadeinitlink routine...

CVE-2026-63864 bpf: Propagate error from visit_tailcall_insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visittailcallinsn Commit e40f5a6bf88a "bpf: correct stack liveness for tail calls" added visittailcallinsn but did not check its return value...

CVE-2026-63863 drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drmgpusvmscanmm There is a unbalanced lock/unlock to gpusvm notifier lock: 931.045868 ===================================== 931.046509 WARNING: bad unlock balance detected! 931.047149...

CVE-2026-63862 PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtkpciesetupirq, the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without...

CVE-2026-63861 spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback

In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove callback mtksnandprobe registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action aft...

CVE-2026-63860 RDMA/core: Prefer NLA_NUL_STRING

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLANULSTRING These attributes are evaluated as c-string passed to strcmp, but NLASTRING doesn't check for the presence of a \0 terminator. Either this needs to switch to nlastrcmp and needs to adjust printf fmt...

CVE-2026-63859 net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add missing bits in airohaqdmacleanuptxqueue Similar to airohaqdmacleanuprxqueue, reset DMA TX descriptors in airohaqdmacleanuptxqueue routine. Moreover, reset TXDMAIDX to TXCPUIDX to notify the NIC the QDMA TX ring ...

CVE-2026-63857 net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airohadevxmit The transmit loop in airohadevxmit reads fragment address and length during its final iteration, when the loop index equals skbshinfoskb-nrfrags, at which...

CVE-2026-63858 netfilter: nf_tables: add hook transactions for device deletions

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFTHOOKREMOVE, but add a new transaction object to track deletion of hooks without altering the...

CVE-2026-63855 drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v2.5 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-63856 drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v2.0 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-63854 drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v3.0 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-63852 drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v4.0.3 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-63853 drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v4.0 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit fd852c048b46f9825e904a4f3f4538fe9d8827...

CVE-2026-63851 drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v4.0.5 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-63849 drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v5.0.1 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-63850 drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v5.0.0 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-63848 drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v2.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 96179da0c6b059eb31706a0abe8dd6381c533143...

CVE-2026-63847 drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v2.5 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 3216a7f4e2642bda5fd14f57586e835ae9202587...

CVE-2026-63845 drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v4.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 8d0cac9478a3f046279c657d6a2545de49ae675a...

CVE-2026-63846 drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v3.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 4d7d774f100efb5089c86a1fb8c5bf47c63fc9ef...

CVE-2026-63844 drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v4.0.3 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 2f6afc97d259d530f4f86c7743efbc573a8da927...