CVE-2026-64051

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

CVE-2026-64183

In the Linux kernel, the following vulnerability has been resolved: efi: Allocate runtime workqueue before ACPI init Since commit 5894cf571e14 "acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers" ACPI PRM calls are delegated to a workqueue which runs in a kernel thread, making it easier to...

CVE-2026-64046

In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != 0 the current code will create a chain link to content type right after the wrap link: This would create a chain where the wrap link...

CVE-2026-64029

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with eventinput sequmpprocessevent borrows client-outrfile.output without synchronizing with the first-open and last-close transition in sequmpclientopen and sequmpclientclose. The last...

CVE-2026-64128

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv guards against a missing ISOSTART by checking...

CVE-2026-64032

In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables...

CVE-2026-64135

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 widen blackbox-info buffer to I2CSMBUSBLOCKMAX adm1266nvmemreadblackbox declares a 5-byte stack buffer and passes it to i2csmbusreadblockdata to retrieve the 4-byte BLACKBOXINFO response. i2csmbusreadblockdat...

CVE-2026-64064

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsinvalidatefolio to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfsfolio struct hung off of folio-privat...

CVE-2026-64015

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assocarrayfind in findkeytoupdate without holding the RCU read lock, while the assocarraygc code really is designed around...

CVE-2026-64113

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevfcleanrxirq prunes frames whose source MAC matches the VF's own address VEPA multicast workaround by freeing the skb and continuing to the next descriptor:...

CVE-2026-64165

In the Linux kernel, the following vulnerability has been resolved: ARM: integrator: Fix early initialization Starting with commit bdb249fce9ad4 "ARM: integrator: read counter using syscon/regmap", intcpinitearly calls sysconregmaplookupbycompatible which in turn calls ofsysconregister. This...

CVE-2026-63994

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skbcow in iptunnelpmtudbuildicmpv6 Sashiko found that iptunnelpmtudbuildicmp and iptunnelpmtudbuildicmpv6 were caching iphdr and ipv6hdr before an skbcow call which can reallocate skb-head. Fix...

CVE-2026-64127

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecredreconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 "Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings" converted the on-stack request PDU in l2capecredreconfigure from an...

CVE-2026-64174

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

CVE-2026-64182

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: fix memory block reference leak in poison accounting memblknrpoisoninc and memblknrpoisonsub look up a memory block via findmemoryblockbyid, which acquires a reference to the memory block device. Both helpers...

CVE-2026-63920

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...

CVE-2026-64108

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c "cifs: open files should not hold ref on superblock", cifs file only holds the dentry refcnt, the cifs file close workcfile-deferred could be executed after...

CVE-2026-64170

In the Linux kernel, the following vulnerability has been resolved: spi: qup: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer...

CVE-2026-63860

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLANULSTRING These attributes are evaluated as c-string passed to strcmp, but NLASTRING doesn't check for the presence of a \0 terminator. Either this needs to switch to nlastrcmp and needs to adjust printf fmt...

CVE-2026-63964

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

CVE-2026-63956

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...

CVE-2026-63931

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: fix division by zero in writeraw Add a zero check for val2 before using it as a divisor when setting the sampling frequency. A user writing a zero fractional part to the samplingfrequency sysfs attribute...

CVE-2026-63980

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

CVE-2026-63949

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length messagestore linedispdisplay unconditionally reads msgcount - 1 before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg-1:...

CVE-2026-63952

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...

CVE-2026-63875

In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When hugepmdunshare is called to unshare a PMD table, the tlbunsharepmdptdesc function sets tlb-unsharedtables=true but the aarch64 tlbflush only checked tlb-freedtables to...

CVE-2026-63886

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAPR length before base64 decode chapservercomputehash allocates clientdigest as kzallocchap-digestsize and then, for BASE64-encoded responses, passes chapr directly to chapbase64decode without...

CVE-2026-64026

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

CVE-2026-53375

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW...

CVE-2026-53379

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov8856: free control handler on error in ov8856initcontrols The control handler wasn't freed if adding controls failed, add an error exit label and convert the existing error return to use it...

CVE-2026-63846

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v3.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 4d7d774f100efb5089c86a1fb8c5bf47c63fc9ef...

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-64063

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix streaming write being overwritten In order to avoid reading whilst writing, netfslib will allow "streaming writes" in which dirty data is stored directly into folios without reading them first. Such folios are marked...

CVE-2026-64012

In the Linux kernel, the following vulnerability has been resolved: net/sched: schsfb: Replace direct dequeue call with peek and qdiscdequeuepeeked When sfb has children eg qfq qdisc whose peek callback is qdiscpeekdequeued, we could get a kernel panic. When the parent of such qdiscs eg illustrat...

CVE-2026-64014

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO datalen/xlen to URB buffer size nexioreaddata pulls datalen and xlen from a packed be16 header in the device's interrupt packet and then walks packet-data0..xlen and packet-dataxlen..datalen...

CVE-2026-64008

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-64022

In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: remove the software node when deactivating the aggregator The dynamic software node we create for the aggregator platform device when using configfs is leaked when the device is deactivated. Destroy it as the la...

CVE-2026-64072

In the Linux kernel, the following vulnerability has been resolved: nvme: fix bio leak on mapping failure The local bio is always NULL, so we'd leak the bio if the integrity mapping failed. Just get it directly from the request...

CVE-2026-64074

In the Linux kernel, the following vulnerability has been resolved: fs/statmount: fix slab out-of-bounds write in statmountmntidmap statmountmntidmap writes one mapping with seqprintf and then manually advances seq-count to include the NUL separator. If seqprintf overflows, seqsetoverflow sets...

CVE-2026-64079

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: allocate hook ops while under mutex arp/ip6tregistertable add the table to the per-netns list via xtregistertable before allocating the per-netns hook ops copy via kmemduparray. This leaves a window where the...

CVE-2026-64081

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

CVE-2026-63963

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdmconsumeidentity or svdmconsumeidentitysopprime as the device-controlled value could index of...

CVE-2026-64058

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsreadfolio to wait on writeback Fix netfsreadfolio to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio-private folio-private may get cleaned up by the...

CVE-2026-63965

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix stack leak in bmp580 trigger handler bmp580triggerhandler declares its scan buffer on the stack without an initializer and then memcpys 3 bytes of 24-bit sensor data into each 4-byte le32 field. The hig...

CVE-2026-63970

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtiotransportsendpktinfo allocates or reuses the zerocopy uarg before entering the send loop, but virtiotransportallocskb still fills the skb before it inherits that uarg. Whe...

CVE-2026-63937

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READONCE/WRITEONCE...

CVE-2026-63939

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible si...

CVE-2026-63951

In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zramwritebackendio A crash was observed in zramwritebackendio due to a NULL pointer dereference in wakeup. The root cause is a race condition between the bio completion handler zramwritebackendio and t...

CVE-2026-63962

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: bound altmodedesc per iteration in svdmconsumemodes svdmconsumemodes checks pmdata-altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the loop. I...

CVE-2026-64082

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since cregs is an uninitialized stack variable, a copyin failure causes...