Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0982
Vulnerability from certfr_avis - Published: 2026-08-07 - Updated: 2026-08-07
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 11 bullseye versions ant\u00e9rieures \u00e0 5.10.262-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
},
{
"description": "Debian 12 bookworm versions ant\u00e9rieures \u00e0 6.1.180-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-64376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64376"
},
{
"name": "CVE-2026-53398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53398"
},
{
"name": "CVE-2026-64552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64552"
},
{
"name": "CVE-2026-53381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53381"
},
{
"name": "CVE-2026-64275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64275"
},
{
"name": "CVE-2026-64274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64274"
},
{
"name": "CVE-2026-64538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64538"
},
{
"name": "CVE-2026-64452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64452"
},
{
"name": "CVE-2026-64483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64483"
},
{
"name": "CVE-2026-64322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64322"
},
{
"name": "CVE-2026-64470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64470"
},
{
"name": "CVE-2026-64461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64461"
},
{
"name": "CVE-2026-64413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64413"
},
{
"name": "CVE-2026-64512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64512"
},
{
"name": "CVE-2026-64409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64409"
},
{
"name": "CVE-2026-64380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64380"
},
{
"name": "CVE-2026-64268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64268"
},
{
"name": "CVE-2026-64489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64489"
},
{
"name": "CVE-2026-64510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64510"
},
{
"name": "CVE-2026-64480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64480"
},
{
"name": "CVE-2026-64399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64399"
},
{
"name": "CVE-2026-63818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63818"
},
{
"name": "CVE-2026-64454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64454"
},
{
"name": "CVE-2026-64531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64531"
},
{
"name": "CVE-2026-53399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53399"
},
{
"name": "CVE-2026-53400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53400"
},
{
"name": "CVE-2026-64365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64365"
},
{
"name": "CVE-2026-53138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53138"
},
{
"name": "CVE-2026-63830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63830"
},
{
"name": "CVE-2026-64333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64333"
},
{
"name": "CVE-2025-23131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23131"
},
{
"name": "CVE-2026-64514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64514"
},
{
"name": "CVE-2026-64279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64279"
},
{
"name": "CVE-2026-64337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64337"
},
{
"name": "CVE-2026-64550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64550"
},
{
"name": "CVE-2026-64430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64430"
},
{
"name": "CVE-2026-64497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64497"
},
{
"name": "CVE-2026-64189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64189"
},
{
"name": "CVE-2026-63798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63798"
},
{
"name": "CVE-2026-63810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63810"
},
{
"name": "CVE-2026-63801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63801"
},
{
"name": "CVE-2026-63815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63815"
},
{
"name": "CVE-2026-63827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63827"
},
{
"name": "CVE-2026-64304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64304"
},
{
"name": "CVE-2026-64557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64557"
},
{
"name": "CVE-2026-53397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53397"
},
{
"name": "CVE-2026-64252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64252"
},
{
"name": "CVE-2026-64276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64276"
},
{
"name": "CVE-2026-64475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64475"
},
{
"name": "CVE-2026-64323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64323"
},
{
"name": "CVE-2026-64438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64438"
},
{
"name": "CVE-2026-64271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64271"
},
{
"name": "CVE-2026-64462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64462"
},
{
"name": "CVE-2026-64455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64455"
},
{
"name": "CVE-2026-52942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52942"
},
{
"name": "CVE-2026-46331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46331"
},
{
"name": "CVE-2026-46252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46252"
},
{
"name": "CVE-2026-64445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64445"
},
{
"name": "CVE-2026-64500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64500"
},
{
"name": "CVE-2026-63806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63806"
},
{
"name": "CVE-2026-64330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64330"
},
{
"name": "CVE-2026-64348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64348"
},
{
"name": "CVE-2026-64469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64469"
},
{
"name": "CVE-2026-64362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64362"
},
{
"name": "CVE-2026-63800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63800"
},
{
"name": "CVE-2026-64486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64486"
},
{
"name": "CVE-2026-64446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64446"
},
{
"name": "CVE-2026-64534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64534"
},
{
"name": "CVE-2026-64338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64338"
},
{
"name": "CVE-2026-46116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46116"
},
{
"name": "CVE-2026-64249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64249"
},
{
"name": "CVE-2026-64536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64536"
},
{
"name": "CVE-2026-64364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64364"
},
{
"name": "CVE-2026-64553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64553"
},
{
"name": "CVE-2026-53402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53402"
},
{
"name": "CVE-2026-64351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64351"
},
{
"name": "CVE-2026-23204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23204"
},
{
"name": "CVE-2026-63835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63835"
},
{
"name": "CVE-2026-64432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64432"
},
{
"name": "CVE-2026-63796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63796"
},
{
"name": "CVE-2026-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43499"
},
{
"name": "CVE-2026-53332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53332"
},
{
"name": "CVE-2026-64363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64363"
},
{
"name": "CVE-2026-64375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64375"
},
{
"name": "CVE-2026-64296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64296"
},
{
"name": "CVE-2026-64546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64546"
},
{
"name": "CVE-2026-64370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64370"
},
{
"name": "CVE-2026-43216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43216"
},
{
"name": "CVE-2026-53158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
},
{
"name": "CVE-2026-64299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64299"
},
{
"name": "CVE-2026-64374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64374"
},
{
"name": "CVE-2026-64488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64488"
},
{
"name": "CVE-2026-64345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64345"
},
{
"name": "CVE-2026-53329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53329"
},
{
"name": "CVE-2026-53382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53382"
},
{
"name": "CVE-2026-64504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64504"
},
{
"name": "CVE-2026-64398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64398"
},
{
"name": "CVE-2026-64297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64297"
},
{
"name": "CVE-2026-64343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64343"
},
{
"name": "CVE-2026-64397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64397"
},
{
"name": "CVE-2026-64371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64371"
},
{
"name": "CVE-2026-64471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64471"
},
{
"name": "CVE-2026-64468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64468"
},
{
"name": "CVE-2026-64449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64449"
},
{
"name": "CVE-2026-64539",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64539"
},
{
"name": "CVE-2026-64551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64551"
},
{
"name": "CVE-2026-53403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53403"
},
{
"name": "CVE-2026-63797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63797"
},
{
"name": "CVE-2026-64456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64456"
},
{
"name": "CVE-2026-64306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64306"
},
{
"name": "CVE-2026-64465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64465"
},
{
"name": "CVE-2026-64313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64313"
},
{
"name": "CVE-2026-53157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53157"
},
{
"name": "CVE-2026-64442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64442"
},
{
"name": "CVE-2026-64554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64554"
},
{
"name": "CVE-2026-64401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64401"
},
{
"name": "CVE-2026-64248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64248"
},
{
"name": "CVE-2026-64533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64533"
},
{
"name": "CVE-2026-53392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53392"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-64332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64332"
},
{
"name": "CVE-2026-53167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
},
{
"name": "CVE-2026-64191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
},
{
"name": "CVE-2026-64458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64458"
},
{
"name": "CVE-2026-64476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64476"
},
{
"name": "CVE-2026-64378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64378"
},
{
"name": "CVE-2026-64549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64549"
},
{
"name": "CVE-2026-64318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64318"
},
{
"name": "CVE-2026-63794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63794"
},
{
"name": "CVE-2026-64394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64394"
},
{
"name": "CVE-2026-53177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53177"
},
{
"name": "CVE-2026-63824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63824"
},
{
"name": "CVE-2026-64435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64435"
},
{
"name": "CVE-2026-64544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64544"
},
{
"name": "CVE-2026-64336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64336"
},
{
"name": "CVE-2026-64352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64352"
},
{
"name": "CVE-2026-64346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64346"
},
{
"name": "CVE-2026-31610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31610"
},
{
"name": "CVE-2026-63822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63822"
},
{
"name": "CVE-2026-64187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64187"
},
{
"name": "CVE-2026-64342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64342"
},
{
"name": "CVE-2026-64360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64360"
},
{
"name": "CVE-2022-50114",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-50114"
},
{
"name": "CVE-2026-64478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64478"
},
{
"name": "CVE-2026-64472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64472"
},
{
"name": "CVE-2026-64437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64437"
},
{
"name": "CVE-2026-64335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64335"
},
{
"name": "CVE-2026-64301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64301"
},
{
"name": "CVE-2026-64315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64315"
},
{
"name": "CVE-2026-64395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64395"
},
{
"name": "CVE-2026-64273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64273"
},
{
"name": "CVE-2026-63828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63828"
},
{
"name": "CVE-2024-36013",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36013"
},
{
"name": "CVE-2025-40196",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40196"
},
{
"name": "CVE-2026-64545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64545"
},
{
"name": "CVE-2026-46135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46135"
},
{
"name": "CVE-2026-64529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64529"
},
{
"name": "CVE-2026-64381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64381"
},
{
"name": "CVE-2026-53393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53393"
},
{
"name": "CVE-2026-64496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64496"
},
{
"name": "CVE-2026-64408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64408"
},
{
"name": "CVE-2026-64316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64316"
},
{
"name": "CVE-2026-64417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64417"
},
{
"name": "CVE-2026-64423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64423"
},
{
"name": "CVE-2026-64443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64443"
},
{
"name": "CVE-2026-53159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53159"
},
{
"name": "CVE-2026-64269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64269"
},
{
"name": "CVE-2026-64540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64540"
},
{
"name": "CVE-2026-64482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64482"
},
{
"name": "CVE-2026-64495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64495"
},
{
"name": "CVE-2026-64396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64396"
},
{
"name": "CVE-2026-64324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64324"
},
{
"name": "CVE-2026-64329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64329"
},
{
"name": "CVE-2026-64373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64373"
},
{
"name": "CVE-2026-64277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64277"
},
{
"name": "CVE-2026-64503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64503"
},
{
"name": "CVE-2026-31755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31755"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-63809",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63809"
},
{
"name": "CVE-2026-64436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64436"
},
{
"name": "CVE-2026-64403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64403"
},
{
"name": "CVE-2026-63836",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63836"
},
{
"name": "CVE-2026-63814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63814"
},
{
"name": "CVE-2026-64412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64412"
},
{
"name": "CVE-2026-64188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64188"
},
{
"name": "CVE-2026-64487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64487"
},
{
"name": "CVE-2026-64303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64303"
},
{
"name": "CVE-2026-64429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64429"
},
{
"name": "CVE-2026-64344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64344"
},
{
"name": "CVE-2026-63831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63831"
},
{
"name": "CVE-2026-63834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63834"
},
{
"name": "CVE-2026-64350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64350"
},
{
"name": "CVE-2026-64250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64250"
},
{
"name": "CVE-2026-64411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64411"
},
{
"name": "CVE-2026-64537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64537"
},
{
"name": "CVE-2026-64334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64334"
},
{
"name": "CVE-2026-64448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64448"
},
{
"name": "CVE-2026-64347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64347"
},
{
"name": "CVE-2025-39931",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39931"
},
{
"name": "CVE-2026-64393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64393"
},
{
"name": "CVE-2026-64419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64419"
},
{
"name": "CVE-2026-64372",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64372"
},
{
"name": "CVE-2026-64444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64444"
},
{
"name": "CVE-2022-49803",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-49803"
},
{
"name": "CVE-2026-64331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64331"
},
{
"name": "CVE-2026-64361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64361"
},
{
"name": "CVE-2026-64547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64547"
},
{
"name": "CVE-2026-64494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64494"
},
{
"name": "CVE-2026-53385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53385"
},
{
"name": "CVE-2026-63823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63823"
},
{
"name": "CVE-2026-53325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53325"
},
{
"name": "CVE-2026-64206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64206"
},
{
"name": "CVE-2026-64530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64530"
},
{
"name": "CVE-2026-64560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64560"
},
{
"name": "CVE-2026-63808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63808"
},
{
"name": "CVE-2026-64535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64535"
},
{
"name": "CVE-2026-64379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64379"
},
{
"name": "CVE-2026-64420",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64420"
},
{
"name": "CVE-2026-64548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64548"
},
{
"name": "CVE-2026-64406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64406"
},
{
"name": "CVE-2026-64425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64425"
},
{
"name": "CVE-2026-64600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64600"
},
{
"name": "CVE-2026-64312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64312"
},
{
"name": "CVE-2026-64532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64532"
},
{
"name": "CVE-2026-64428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64428"
},
{
"name": "CVE-2026-64505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64505"
},
{
"name": "CVE-2026-64355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64355"
},
{
"name": "CVE-2026-64422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64422"
},
{
"name": "CVE-2026-64340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64340"
},
{
"name": "CVE-2026-64450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64450"
},
{
"name": "CVE-2026-64484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64484"
},
{
"name": "CVE-2026-64298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64298"
},
{
"name": "CVE-2026-64390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64390"
},
{
"name": "CVE-2023-52494",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52494"
},
{
"name": "CVE-2026-64266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64266"
},
{
"name": "CVE-2026-64441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64441"
},
{
"name": "CVE-2026-63829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63829"
},
{
"name": "CVE-2026-64440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64440"
},
{
"name": "CVE-2026-63803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63803"
},
{
"name": "CVE-2026-64359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64359"
},
{
"name": "CVE-2026-43219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43219"
},
{
"name": "CVE-2026-64317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64317"
}
],
"initial_release_date": "2026-08-07T00:00:00",
"last_revision_date": "2026-08-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0982",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-07T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
"vendor_advisories": [
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00007",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00007.html"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00008",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00008.html"
}
]
}
CVE-2026-64486 (GCVE-0-2026-64486)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
ALSA: cmipci: check snd_ctl_new1() return value
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: cmipci: check snd_ctl_new1() return value
snd_ctl_new1() can return NULL when memory allocation fails.
snd_cmipci_spdif_controls() does not check the return value before
dereferencing kctl->id.device, which can lead to a NULL pointer
dereference.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
fails.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3454490e0396191f8f9c215fccf5deef76abffb5 , < b44888c33c4f11277d0e5e023338f2740232a4ed
(git)
Affected: f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 , < 8825a06bfa7932a7a74dec01669d405df0b47286 (git) Affected: f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 , < 4dd5b0b1a52a8d6e59a3f217204817228ce0238b (git) Affected: f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 , < af2b009b773bc42995546507963e5e78970dc3ed (git) Affected: f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 , < 67e9ea92cd598cba1783ff701553c776a6cedee9 (git) Affected: f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 , < c205bd1b28fb7e5f1061a4e78813fad7d315cb3e (git) Affected: 7bf12707fa3db4c14fbe8ab93efb421d8ca93bf8 (git) Affected: 6.1.34 , < 6.1.178 (semver) Affected: 6.3.8 , < 6.4 (semver) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/pci/cmipci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b44888c33c4f11277d0e5e023338f2740232a4ed",
"status": "affected",
"version": "3454490e0396191f8f9c215fccf5deef76abffb5",
"versionType": "git"
},
{
"lessThan": "8825a06bfa7932a7a74dec01669d405df0b47286",
"status": "affected",
"version": "f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9",
"versionType": "git"
},
{
"lessThan": "4dd5b0b1a52a8d6e59a3f217204817228ce0238b",
"status": "affected",
"version": "f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9",
"versionType": "git"
},
{
"lessThan": "af2b009b773bc42995546507963e5e78970dc3ed",
"status": "affected",
"version": "f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9",
"versionType": "git"
},
{
"lessThan": "67e9ea92cd598cba1783ff701553c776a6cedee9",
"status": "affected",
"version": "f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9",
"versionType": "git"
},
{
"lessThan": "c205bd1b28fb7e5f1061a4e78813fad7d315cb3e",
"status": "affected",
"version": "f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9",
"versionType": "git"
},
{
"status": "affected",
"version": "7bf12707fa3db4c14fbe8ab93efb421d8ca93bf8",
"versionType": "git"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.34",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/pci/cmipci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: cmipci: check snd_ctl_new1() return value\n\nsnd_ctl_new1() can return NULL when memory allocation fails.\nsnd_cmipci_spdif_controls() does not check the return value before\ndereferencing kctl-\u003eid.device, which can lead to a NULL pointer\ndereference.\n\nAdd NULL checks after snd_ctl_new1() calls and return -ENOMEM if any\nfails."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:45.982Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b44888c33c4f11277d0e5e023338f2740232a4ed"
},
{
"url": "https://git.kernel.org/stable/c/8825a06bfa7932a7a74dec01669d405df0b47286"
},
{
"url": "https://git.kernel.org/stable/c/4dd5b0b1a52a8d6e59a3f217204817228ce0238b"
},
{
"url": "https://git.kernel.org/stable/c/af2b009b773bc42995546507963e5e78970dc3ed"
},
{
"url": "https://git.kernel.org/stable/c/67e9ea92cd598cba1783ff701553c776a6cedee9"
},
{
"url": "https://git.kernel.org/stable/c/c205bd1b28fb7e5f1061a4e78813fad7d315cb3e"
}
],
"title": "ALSA: cmipci: check snd_ctl_new1() return value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64486",
"datePublished": "2026-07-25T08:51:45.982Z",
"dateReserved": "2026-07-19T15:36:31.792Z",
"dateUpdated": "2026-07-25T08:51:45.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64487 (GCVE-0-2026-64487)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input
stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every
iteration it advances buf and subtracts the block size while looping on
"while (len)".
len is urb->actual_length. That value is supplied by the device and is
not guaranteed to be a multiple of 16. When a final short block leaves
len between 1 and 15, the loop runs once more, reads up to buf[15], and
then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows
to a huge value. The loop then keeps iterating and walking buf far past
the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus
block id happens to be hit.
Iterate only while a full message block is available. This stops the
unsigned underflow and silently drops any trailing partial block, which
carries no complete control value anyway.
The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1
and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor
urb->actual_length before dispatching.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
15c5ab607045e278ebf4d2ca4aea2250617d50ca , < de5f9edc705497b1b2c6b173b22f283486d2fd91
(git)
Affected: 15c5ab607045e278ebf4d2ca4aea2250617d50ca , < 70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334 (git) Affected: 15c5ab607045e278ebf4d2ca4aea2250617d50ca , < 884f575cc6acb136eb4a161d925147f85b59c27e (git) Affected: 15c5ab607045e278ebf4d2ca4aea2250617d50ca , < 05df59b9a61f7ca66548df079d306c41da23845d (git) Affected: 15c5ab607045e278ebf4d2ca4aea2250617d50ca , < 3cad86197c7bf8b45bb1d8adc1099d0913e80469 (git) Affected: 15c5ab607045e278ebf4d2ca4aea2250617d50ca , < a5fd3122283bf75c04f6414bf610100beb0565b0 (git) Affected: 15c5ab607045e278ebf4d2ca4aea2250617d50ca , < 0680413f2f10aab43878dd3db711a6a9e45bab7c (git) Affected: 15c5ab607045e278ebf4d2ca4aea2250617d50ca , < f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd (git) |
|
| Linux | Linux |
Affected:
2.6.37
Unaffected: 0 , < 2.6.37 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/caiaq/input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "de5f9edc705497b1b2c6b173b22f283486d2fd91",
"status": "affected",
"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca",
"versionType": "git"
},
{
"lessThan": "70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334",
"status": "affected",
"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca",
"versionType": "git"
},
{
"lessThan": "884f575cc6acb136eb4a161d925147f85b59c27e",
"status": "affected",
"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca",
"versionType": "git"
},
{
"lessThan": "05df59b9a61f7ca66548df079d306c41da23845d",
"status": "affected",
"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca",
"versionType": "git"
},
{
"lessThan": "3cad86197c7bf8b45bb1d8adc1099d0913e80469",
"status": "affected",
"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca",
"versionType": "git"
},
{
"lessThan": "a5fd3122283bf75c04f6414bf610100beb0565b0",
"status": "affected",
"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca",
"versionType": "git"
},
{
"lessThan": "0680413f2f10aab43878dd3db711a6a9e45bab7c",
"status": "affected",
"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca",
"versionType": "git"
},
{
"lessThan": "f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd",
"status": "affected",
"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/caiaq/input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser\n\nsnd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input\nstream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every\niteration it advances buf and subtracts the block size while looping on\n\"while (len)\".\n\nlen is urb-\u003eactual_length. That value is supplied by the device and is\nnot guaranteed to be a multiple of 16. When a final short block leaves\nlen between 1 and 15, the loop runs once more, reads up to buf[15], and\nthen does \"len -= TKS4_MSGBLOCK_SIZE\". As len is unsigned this underflows\nto a huge value. The loop then keeps iterating and walking buf far past\nthe end of the 512-byte ep4_in_buf, reading out of bounds until a bogus\nblock id happens to be hit.\n\nIterate only while a full message block is available. This stops the\nunsigned underflow and silently drops any trailing partial block, which\ncarries no complete control value anyway.\n\nThe sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1\nand Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor\nurb-\u003eactual_length before dispatching."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:46.711Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/de5f9edc705497b1b2c6b173b22f283486d2fd91"
},
{
"url": "https://git.kernel.org/stable/c/70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334"
},
{
"url": "https://git.kernel.org/stable/c/884f575cc6acb136eb4a161d925147f85b59c27e"
},
{
"url": "https://git.kernel.org/stable/c/05df59b9a61f7ca66548df079d306c41da23845d"
},
{
"url": "https://git.kernel.org/stable/c/3cad86197c7bf8b45bb1d8adc1099d0913e80469"
},
{
"url": "https://git.kernel.org/stable/c/a5fd3122283bf75c04f6414bf610100beb0565b0"
},
{
"url": "https://git.kernel.org/stable/c/0680413f2f10aab43878dd3db711a6a9e45bab7c"
},
{
"url": "https://git.kernel.org/stable/c/f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd"
}
],
"title": "ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64487",
"datePublished": "2026-07-25T08:51:46.711Z",
"dateReserved": "2026-07-19T15:36:31.792Z",
"dateUpdated": "2026-07-25T08:51:46.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64488 (GCVE-0-2026-64488)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
ALSA: aoa: check snd_ctl_new1() return value
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: aoa: check snd_ctl_new1() return value
snd_ctl_new1() can return NULL when memory allocation fails. In
layout.c, the function does not check the return value before
dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can
lead to a NULL pointer dereference.
Add NULL checks after snd_ctl_new1() calls and return early if any
fails.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f3d9478b2ce468c3115b02ecae7e975990697f15 , < b0154ebc6dc552c389a574b1e221d728e10346e7
(git)
Affected: f3d9478b2ce468c3115b02ecae7e975990697f15 , < d62624fe256b2d0d13454c78cbfc70ff5d954dc7 (git) Affected: f3d9478b2ce468c3115b02ecae7e975990697f15 , < e5e8c4508d95af82f9b4d065f658e5476a8e9bc8 (git) Affected: f3d9478b2ce468c3115b02ecae7e975990697f15 , < 2ee9c46fd2dcd529cef18e37636ee12f5c3dbedd (git) Affected: f3d9478b2ce468c3115b02ecae7e975990697f15 , < d73067e2bbf3775a495d9f38e38d0a3cf53ee790 (git) Affected: f3d9478b2ce468c3115b02ecae7e975990697f15 , < fd786466889e4a6e6de0f4462bd0068edea63960 (git) Affected: f3d9478b2ce468c3115b02ecae7e975990697f15 , < e47f2a341adbac001b6f5d0211b0cd1c1668637b (git) Affected: f3d9478b2ce468c3115b02ecae7e975990697f15 , < 8df560fefe6fed6a20b7e06720eeaeccec349ac0 (git) |
|
| Linux | Linux |
Affected:
2.6.18
Unaffected: 0 , < 2.6.18 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/aoa/fabrics/layout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b0154ebc6dc552c389a574b1e221d728e10346e7",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "d62624fe256b2d0d13454c78cbfc70ff5d954dc7",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "e5e8c4508d95af82f9b4d065f658e5476a8e9bc8",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "2ee9c46fd2dcd529cef18e37636ee12f5c3dbedd",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "d73067e2bbf3775a495d9f38e38d0a3cf53ee790",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "fd786466889e4a6e6de0f4462bd0068edea63960",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "e47f2a341adbac001b6f5d0211b0cd1c1668637b",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "8df560fefe6fed6a20b7e06720eeaeccec349ac0",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/aoa/fabrics/layout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: aoa: check snd_ctl_new1() return value\n\nsnd_ctl_new1() can return NULL when memory allocation fails. In\nlayout.c, the function does not check the return value before\ndereferencing ctl-\u003eid.name or passing to aoa_snd_ctl_add(), which can\nlead to a NULL pointer dereference.\n\nAdd NULL checks after snd_ctl_new1() calls and return early if any\nfails."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:47.436Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b0154ebc6dc552c389a574b1e221d728e10346e7"
},
{
"url": "https://git.kernel.org/stable/c/d62624fe256b2d0d13454c78cbfc70ff5d954dc7"
},
{
"url": "https://git.kernel.org/stable/c/e5e8c4508d95af82f9b4d065f658e5476a8e9bc8"
},
{
"url": "https://git.kernel.org/stable/c/2ee9c46fd2dcd529cef18e37636ee12f5c3dbedd"
},
{
"url": "https://git.kernel.org/stable/c/d73067e2bbf3775a495d9f38e38d0a3cf53ee790"
},
{
"url": "https://git.kernel.org/stable/c/fd786466889e4a6e6de0f4462bd0068edea63960"
},
{
"url": "https://git.kernel.org/stable/c/e47f2a341adbac001b6f5d0211b0cd1c1668637b"
},
{
"url": "https://git.kernel.org/stable/c/8df560fefe6fed6a20b7e06720eeaeccec349ac0"
}
],
"title": "ALSA: aoa: check snd_ctl_new1() return value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64488",
"datePublished": "2026-07-25T08:51:47.436Z",
"dateReserved": "2026-07-19T15:36:31.792Z",
"dateUpdated": "2026-07-25T08:51:47.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64489 (GCVE-0-2026-64489)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
ALSA: ymfpci: check snd_ctl_new1() return value
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ymfpci: check snd_ctl_new1() return value
snd_ctl_new1() can return NULL when memory allocation fails.
snd_ymfpci_create_spdif_controls() does not check the return value
before dereferencing kctl->id.device, which can lead to a NULL pointer
dereference.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
fails.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1f6c520932bca5be9e8dec137fccb2fc094a80fe , < d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1
(git)
Affected: c9b83ae4a1609b1914ba7fc70826a3f3a8b234db , < 91095474eea29b95c9a8bceb9b501a2702b6c55f (git) Affected: c9b83ae4a1609b1914ba7fc70826a3f3a8b234db , < 02f33c2062c75e28abc7ad58ce86451cf3140455 (git) Affected: c9b83ae4a1609b1914ba7fc70826a3f3a8b234db , < f6538a318947b627710b08a268bc80a48c23bde7 (git) Affected: c9b83ae4a1609b1914ba7fc70826a3f3a8b234db , < 18ec7d7785be7a4ee8ea11e355122282caad4267 (git) Affected: c9b83ae4a1609b1914ba7fc70826a3f3a8b234db , < e64d170346d00b580c0043de3e5ccb3e331c47d4 (git) Affected: cf671d2462d9af50c328bcc185d2c7b9726f8093 (git) Affected: 6.1.34 , < 6.1.178 (semver) Affected: 6.3.8 , < 6.4 (semver) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/pci/ymfpci/ymfpci_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1",
"status": "affected",
"version": "1f6c520932bca5be9e8dec137fccb2fc094a80fe",
"versionType": "git"
},
{
"lessThan": "91095474eea29b95c9a8bceb9b501a2702b6c55f",
"status": "affected",
"version": "c9b83ae4a1609b1914ba7fc70826a3f3a8b234db",
"versionType": "git"
},
{
"lessThan": "02f33c2062c75e28abc7ad58ce86451cf3140455",
"status": "affected",
"version": "c9b83ae4a1609b1914ba7fc70826a3f3a8b234db",
"versionType": "git"
},
{
"lessThan": "f6538a318947b627710b08a268bc80a48c23bde7",
"status": "affected",
"version": "c9b83ae4a1609b1914ba7fc70826a3f3a8b234db",
"versionType": "git"
},
{
"lessThan": "18ec7d7785be7a4ee8ea11e355122282caad4267",
"status": "affected",
"version": "c9b83ae4a1609b1914ba7fc70826a3f3a8b234db",
"versionType": "git"
},
{
"lessThan": "e64d170346d00b580c0043de3e5ccb3e331c47d4",
"status": "affected",
"version": "c9b83ae4a1609b1914ba7fc70826a3f3a8b234db",
"versionType": "git"
},
{
"status": "affected",
"version": "cf671d2462d9af50c328bcc185d2c7b9726f8093",
"versionType": "git"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.34",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/pci/ymfpci/ymfpci_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ymfpci: check snd_ctl_new1() return value\n\nsnd_ctl_new1() can return NULL when memory allocation fails.\nsnd_ymfpci_create_spdif_controls() does not check the return value\nbefore dereferencing kctl-\u003eid.device, which can lead to a NULL pointer\ndereference.\n\nAdd NULL checks after snd_ctl_new1() calls and return -ENOMEM if any\nfails."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:48.161Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1"
},
{
"url": "https://git.kernel.org/stable/c/91095474eea29b95c9a8bceb9b501a2702b6c55f"
},
{
"url": "https://git.kernel.org/stable/c/02f33c2062c75e28abc7ad58ce86451cf3140455"
},
{
"url": "https://git.kernel.org/stable/c/f6538a318947b627710b08a268bc80a48c23bde7"
},
{
"url": "https://git.kernel.org/stable/c/18ec7d7785be7a4ee8ea11e355122282caad4267"
},
{
"url": "https://git.kernel.org/stable/c/e64d170346d00b580c0043de3e5ccb3e331c47d4"
}
],
"title": "ALSA: ymfpci: check snd_ctl_new1() return value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64489",
"datePublished": "2026-07-25T08:51:48.161Z",
"dateReserved": "2026-07-19T15:36:31.792Z",
"dateUpdated": "2026-07-25T08:51:48.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64494 (GCVE-0-2026-64494)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
iio: light: gp2ap002: fix runtime PM leak on read error
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: light: gp2ap002: fix runtime PM leak on read error
gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the
lux value, but if gp2ap002_get_lux() fails, it returns directly. This
skips the pm_runtime_put_autosuspend() call at the "out" label,
permanently leaking a runtime PM reference and preventing the device
from autosuspending.
Replace the direct return with a "goto out" to ensure the reference
is properly dropped on the error path.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 , < 62e0d74821a02f0e0c5c79b99ae64dc83a9a90f5
(git)
Affected: f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 , < 7110201c6b21455240c63388f30113f3baafacfc (git) Affected: f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 , < 2593f0c6ea37df168975694a3b17e7086f11453e (git) Affected: f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 , < f350883989ced96d6da7f582f9a6f9c6ffc94e34 (git) Affected: f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 , < 29137052c4485c74bc2d1b0717f69ca4de14274f (git) Affected: f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 , < 0c655d067ac69ee24e2e9d706c54179ea58a43db (git) Affected: f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 , < 2ebaea7f3089decb01a8294d89d7e0cf288146c4 (git) Affected: f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 , < 38b72267b7e22768a1f26d9935de4e1752a1dc85 (git) Affected: f3e84bf3f86bb3b7bd50666bb8ef7a203a656ca3 (git) Affected: 5.7.6 , < 5.8 (semver) |
|
| Linux | Linux |
Affected:
5.8
Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/light/gp2ap002.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "62e0d74821a02f0e0c5c79b99ae64dc83a9a90f5",
"status": "affected",
"version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
"versionType": "git"
},
{
"lessThan": "7110201c6b21455240c63388f30113f3baafacfc",
"status": "affected",
"version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
"versionType": "git"
},
{
"lessThan": "2593f0c6ea37df168975694a3b17e7086f11453e",
"status": "affected",
"version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
"versionType": "git"
},
{
"lessThan": "f350883989ced96d6da7f582f9a6f9c6ffc94e34",
"status": "affected",
"version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
"versionType": "git"
},
{
"lessThan": "29137052c4485c74bc2d1b0717f69ca4de14274f",
"status": "affected",
"version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
"versionType": "git"
},
{
"lessThan": "0c655d067ac69ee24e2e9d706c54179ea58a43db",
"status": "affected",
"version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
"versionType": "git"
},
{
"lessThan": "2ebaea7f3089decb01a8294d89d7e0cf288146c4",
"status": "affected",
"version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
"versionType": "git"
},
{
"lessThan": "38b72267b7e22768a1f26d9935de4e1752a1dc85",
"status": "affected",
"version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
"versionType": "git"
},
{
"status": "affected",
"version": "f3e84bf3f86bb3b7bd50666bb8ef7a203a656ca3",
"versionType": "git"
},
{
"lessThan": "5.8",
"status": "affected",
"version": "5.7.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/light/gp2ap002.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.7.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: gp2ap002: fix runtime PM leak on read error\n\ngp2ap002_read_raw() calls pm_runtime_get_sync() before reading the\nlux value, but if gp2ap002_get_lux() fails, it returns directly. This\nskips the pm_runtime_put_autosuspend() call at the \"out\" label,\npermanently leaking a runtime PM reference and preventing the device\nfrom autosuspending.\n\nReplace the direct return with a \"goto out\" to ensure the reference\nis properly dropped on the error path."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:51.747Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/62e0d74821a02f0e0c5c79b99ae64dc83a9a90f5"
},
{
"url": "https://git.kernel.org/stable/c/7110201c6b21455240c63388f30113f3baafacfc"
},
{
"url": "https://git.kernel.org/stable/c/2593f0c6ea37df168975694a3b17e7086f11453e"
},
{
"url": "https://git.kernel.org/stable/c/f350883989ced96d6da7f582f9a6f9c6ffc94e34"
},
{
"url": "https://git.kernel.org/stable/c/29137052c4485c74bc2d1b0717f69ca4de14274f"
},
{
"url": "https://git.kernel.org/stable/c/0c655d067ac69ee24e2e9d706c54179ea58a43db"
},
{
"url": "https://git.kernel.org/stable/c/2ebaea7f3089decb01a8294d89d7e0cf288146c4"
},
{
"url": "https://git.kernel.org/stable/c/38b72267b7e22768a1f26d9935de4e1752a1dc85"
}
],
"title": "iio: light: gp2ap002: fix runtime PM leak on read error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64494",
"datePublished": "2026-07-25T08:51:51.747Z",
"dateReserved": "2026-07-19T15:36:31.792Z",
"dateUpdated": "2026-07-25T08:51:51.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64495 (GCVE-0-2026-64495)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry
matching the bw_bits value read from the chip:
for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) {
if (bmg160_samp_freq_table[i].bw_bits == bw_bits)
break;
}
*val = bmg160_samp_freq_table[i].filter;
If no entry matches, i ends up equal to the array size and the next line
reads one slot past the end. bmg160_set_filter() has the same shape, driven
by 'val' instead of bw_bits.
smatch flags both:
drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:
buffer overflow 'bmg160_samp_freq_table' 7 <= 7
drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error:
buffer overflow 'bmg160_samp_freq_table' 7 <= 7
Return -EINVAL when no entry matches.
The set_filter() path is reachable from userspace via the sysfs
in_anglvel_filter_low_pass_3db_frequency interface, so userspace can
trivially trigger the out-of-bounds read with a value that is not in
bmg160_samp_freq_table[].filter.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc , < 1dc3a833be11e5d503038e3c701745fd0e03903c
(git)
Affected: 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc , < 77e56ebb1786f4296afd5fa46975a989b285ae65 (git) Affected: 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc , < 029481cddb98697716f4bf3021d035eaf2ca0e1f (git) Affected: 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc , < 8d202515baea4e2e3be448d1590099af28f2346d (git) Affected: 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc , < d85ee50f58dd83fe74f6d0bf8bd345c657b216e8 (git) Affected: 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc , < 7bbf02b63961fc1768c9c654392c11f2077d4c59 (git) Affected: 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc , < 6c8675468862161d1c59130266852b66867d3861 (git) Affected: 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc , < 8320c77e67382d5d55d77043a5f60a867d408a2b (git) |
|
| Linux | Linux |
Affected:
3.18
Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/gyro/bmg160_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1dc3a833be11e5d503038e3c701745fd0e03903c",
"status": "affected",
"version": "22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc",
"versionType": "git"
},
{
"lessThan": "77e56ebb1786f4296afd5fa46975a989b285ae65",
"status": "affected",
"version": "22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc",
"versionType": "git"
},
{
"lessThan": "029481cddb98697716f4bf3021d035eaf2ca0e1f",
"status": "affected",
"version": "22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc",
"versionType": "git"
},
{
"lessThan": "8d202515baea4e2e3be448d1590099af28f2346d",
"status": "affected",
"version": "22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc",
"versionType": "git"
},
{
"lessThan": "d85ee50f58dd83fe74f6d0bf8bd345c657b216e8",
"status": "affected",
"version": "22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc",
"versionType": "git"
},
{
"lessThan": "7bbf02b63961fc1768c9c654392c11f2077d4c59",
"status": "affected",
"version": "22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc",
"versionType": "git"
},
{
"lessThan": "6c8675468862161d1c59130266852b66867d3861",
"status": "affected",
"version": "22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc",
"versionType": "git"
},
{
"lessThan": "8320c77e67382d5d55d77043a5f60a867d408a2b",
"status": "affected",
"version": "22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/gyro/bmg160_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: bmg160: bail out when bandwidth/filter is not in table\n\nbmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry\nmatching the bw_bits value read from the chip:\n\n\tfor (i = 0; i \u003c ARRAY_SIZE(bmg160_samp_freq_table); ++i) {\n\t\tif (bmg160_samp_freq_table[i].bw_bits == bw_bits)\n\t\t\tbreak;\n\t}\n\t*val = bmg160_samp_freq_table[i].filter;\n\nIf no entry matches, i ends up equal to the array size and the next line\nreads one slot past the end. bmg160_set_filter() has the same shape, driven\nby \u0027val\u0027 instead of bw_bits.\n\nsmatch flags both:\n\n drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:\n buffer overflow \u0027bmg160_samp_freq_table\u0027 7 \u003c= 7\n drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error:\n buffer overflow \u0027bmg160_samp_freq_table\u0027 7 \u003c= 7\n\nReturn -EINVAL when no entry matches.\n\nThe set_filter() path is reachable from userspace via the sysfs\nin_anglvel_filter_low_pass_3db_frequency interface, so userspace can\ntrivially trigger the out-of-bounds read with a value that is not in\nbmg160_samp_freq_table[].filter."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:52.468Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1dc3a833be11e5d503038e3c701745fd0e03903c"
},
{
"url": "https://git.kernel.org/stable/c/77e56ebb1786f4296afd5fa46975a989b285ae65"
},
{
"url": "https://git.kernel.org/stable/c/029481cddb98697716f4bf3021d035eaf2ca0e1f"
},
{
"url": "https://git.kernel.org/stable/c/8d202515baea4e2e3be448d1590099af28f2346d"
},
{
"url": "https://git.kernel.org/stable/c/d85ee50f58dd83fe74f6d0bf8bd345c657b216e8"
},
{
"url": "https://git.kernel.org/stable/c/7bbf02b63961fc1768c9c654392c11f2077d4c59"
},
{
"url": "https://git.kernel.org/stable/c/6c8675468862161d1c59130266852b66867d3861"
},
{
"url": "https://git.kernel.org/stable/c/8320c77e67382d5d55d77043a5f60a867d408a2b"
}
],
"title": "iio: gyro: bmg160: bail out when bandwidth/filter is not in table",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64495",
"datePublished": "2026-07-25T08:51:52.468Z",
"dateReserved": "2026-07-19T15:36:31.792Z",
"dateUpdated": "2026-07-25T08:51:52.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64496 (GCVE-0-2026-64496)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
iio: event: Fix event FIFO reset race
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: event: Fix event FIFO reset race
`iio_event_getfd()` creates the event file descriptor with
`anon_inode_getfd()`, which allocates a new fd, creates the anonymous
file and installs it in the process fd table before returning to the
caller.
The IIO code resets the event FIFO after `anon_inode_getfd()` has returned,
but before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace.
But since fd tables are shared between threads, another thread can guess
the newly allocated fd number and issue a `read()` on it as soon as the fd
has been installed.
This means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in
parallel with the `kfifo_reset_out()` in `iio_event_getfd()`.
The kfifo documentation says that `kfifo_reset_out()` is only safe when it
is called from the reader thread and there is only one concurrent reader.
Otherwise it is dangerous and must be handled in the same way as
`kfifo_reset()`.
If that happens, `kfifo_to_user()` can advance the FIFO `out` index based
on state from before the reset, after the reset has already moved the `out`
index to the current `in` index. That can leave the FIFO with an `out`
index past the `in` index. A later `read()` can then see an underflowed
FIFO length and copy more data than the event FIFO buffer contains. This
can result in an out-of-bounds read and leak adjacent kernel memory to
userspace.
Move the FIFO reset before `anon_inode_getfd()`. At that point the event fd is
marked busy, but the new fd has not been installed yet, so userspace cannot
access it while the FIFO is reset.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b91accafbb1031b80d22ad83576877ff2f8b4774 , < 9dc84ba4be5bbeb29ee49efe6cea2cb32c461424
(git)
Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < d16a702ca7d29c0b7a9b509339d1b044a1cadb32 (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < a13ef1adbc62085b21b546b07b0be7e2fbf52150 (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < 0d4a646d7f87ea3625fafe387043fddc6a2f5e7f (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < 72c6aa8e0d74eab91b8694cde97dec088c248fee (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < 9edefd4c56bee3fe331e0355d1f10a533134999d (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < f187dc5a4c4846ffa07d9bda6e760837ed005574 (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < af791d295737ea6b6ff2c8d8488462a49c14af01 (git) |
|
| Linux | Linux |
Affected:
3.15
Unaffected: 0 , < 3.15 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/industrialio-event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9dc84ba4be5bbeb29ee49efe6cea2cb32c461424",
"status": "affected",
"version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
"versionType": "git"
},
{
"lessThan": "d16a702ca7d29c0b7a9b509339d1b044a1cadb32",
"status": "affected",
"version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
"versionType": "git"
},
{
"lessThan": "a13ef1adbc62085b21b546b07b0be7e2fbf52150",
"status": "affected",
"version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
"versionType": "git"
},
{
"lessThan": "0d4a646d7f87ea3625fafe387043fddc6a2f5e7f",
"status": "affected",
"version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
"versionType": "git"
},
{
"lessThan": "72c6aa8e0d74eab91b8694cde97dec088c248fee",
"status": "affected",
"version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
"versionType": "git"
},
{
"lessThan": "9edefd4c56bee3fe331e0355d1f10a533134999d",
"status": "affected",
"version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
"versionType": "git"
},
{
"lessThan": "f187dc5a4c4846ffa07d9bda6e760837ed005574",
"status": "affected",
"version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
"versionType": "git"
},
{
"lessThan": "af791d295737ea6b6ff2c8d8488462a49c14af01",
"status": "affected",
"version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/industrialio-event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: event: Fix event FIFO reset race\n\n`iio_event_getfd()` creates the event file descriptor with\n`anon_inode_getfd()`, which allocates a new fd, creates the anonymous\nfile and installs it in the process fd table before returning to the\ncaller.\n\nThe IIO code resets the event FIFO after `anon_inode_getfd()` has returned,\nbut before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace.\nBut since fd tables are shared between threads, another thread can guess\nthe newly allocated fd number and issue a `read()` on it as soon as the fd\nhas been installed.\n\nThis means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in\nparallel with the `kfifo_reset_out()` in `iio_event_getfd()`.\n\nThe kfifo documentation says that `kfifo_reset_out()` is only safe when it\nis called from the reader thread and there is only one concurrent reader.\nOtherwise it is dangerous and must be handled in the same way as\n`kfifo_reset()`.\n\nIf that happens, `kfifo_to_user()` can advance the FIFO `out` index based\non state from before the reset, after the reset has already moved the `out`\nindex to the current `in` index. That can leave the FIFO with an `out`\nindex past the `in` index. A later `read()` can then see an underflowed\nFIFO length and copy more data than the event FIFO buffer contains. This\ncan result in an out-of-bounds read and leak adjacent kernel memory to\nuserspace.\n\nMove the FIFO reset before `anon_inode_getfd()`. At that point the event fd is\nmarked busy, but the new fd has not been installed yet, so userspace cannot\naccess it while the FIFO is reset."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation uses local open(), ioctl(), and read() operations on /dev/iio:deviceX; no network-reachable path exists.\nAC:L - The attacker controls both racing threads and can predict the lowest available event fd, repeatedly race its installation, and stall the read using a userspace page fault.\nPR:L - The kernel path has no capability or authentication check; an ordinary user granted device-node access can invoke the vulnerable ioctl and read operations.\nUI:N - No victim action is required, and supported IIO drivers can generate events automatically through sensor interrupts.\nS:U - The vulnerability affects the kernel hosting the attacking process and does not inherently cross a VM, IOMMU, or separate security-authority boundary.\nC:H - The underflowed FIFO length permits an attacker-sized out-of-bounds read beyond the 256-byte event buffer, exposing adjacent kernel heap memory and potentially sensitive pointers or data.\nI:N - The path copies kernel data to userspace and corrupts only the FIFO read index; masked FIFO accesses provide no out-of-bounds write or control-flow modification primitive.\nA:H - An oversized read crossing the containing slab object triggers BUG() with hardened usercopy, causing a kernel oops or panic and allowing repeated denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:28.071Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9dc84ba4be5bbeb29ee49efe6cea2cb32c461424"
},
{
"url": "https://git.kernel.org/stable/c/d16a702ca7d29c0b7a9b509339d1b044a1cadb32"
},
{
"url": "https://git.kernel.org/stable/c/a13ef1adbc62085b21b546b07b0be7e2fbf52150"
},
{
"url": "https://git.kernel.org/stable/c/0d4a646d7f87ea3625fafe387043fddc6a2f5e7f"
},
{
"url": "https://git.kernel.org/stable/c/72c6aa8e0d74eab91b8694cde97dec088c248fee"
},
{
"url": "https://git.kernel.org/stable/c/9edefd4c56bee3fe331e0355d1f10a533134999d"
},
{
"url": "https://git.kernel.org/stable/c/f187dc5a4c4846ffa07d9bda6e760837ed005574"
},
{
"url": "https://git.kernel.org/stable/c/af791d295737ea6b6ff2c8d8488462a49c14af01"
}
],
"title": "iio: event: Fix event FIFO reset race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64496",
"datePublished": "2026-07-25T08:51:53.194Z",
"dateReserved": "2026-07-19T15:36:31.792Z",
"dateUpdated": "2026-08-05T12:42:28.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64497 (GCVE-0-2026-64497)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
Include linux/bitfield.h for FIELD_GET().
Create new macros for bit manipulation in combination with manual bit
manipulation being replaced with FIELD_GET().
The current variable declaration and initializations are barely readable
and use comma separations across multiple lines. Refactor the
initializations so that mantissa and exp have separate declarations and
sign gets initialized later.
In addition (and due to the nature of the cleanup), fix a sign-extension
bug where, float32 would get bitwise anded with ~BIT(31)
(which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
64b3d8b1b0f5c16c19045785e4da8391ae35ec99 , < 0ccff849bde90973e6c13a666f6ceab5c55b30d4
(git)
Affected: 64b3d8b1b0f5c16c19045785e4da8391ae35ec99 , < 1821bcacd8ac5b214c53be16cbb8172bf193f0b6 (git) Affected: 64b3d8b1b0f5c16c19045785e4da8391ae35ec99 , < 40bb0fdb37f441c9c9f52bf58bbd8a0ca3cc9598 (git) Affected: 64b3d8b1b0f5c16c19045785e4da8391ae35ec99 , < b131f0011dfef72350f4e3f11df94dc3e6b46065 (git) Affected: 64b3d8b1b0f5c16c19045785e4da8391ae35ec99 , < 8d4a46e971cf846bda98b20d4cabfa21c1276e5f (git) Affected: 64b3d8b1b0f5c16c19045785e4da8391ae35ec99 , < 82accdd57404399eddf3d56fd9beda7c61307388 (git) Affected: 64b3d8b1b0f5c16c19045785e4da8391ae35ec99 , < d49ff54b2784aa56a7c97982de713604de89d23a (git) Affected: 64b3d8b1b0f5c16c19045785e4da8391ae35ec99 , < 60d877910a43c305b5165131b258a17b1d772d57 (git) |
|
| Linux | Linux |
Affected:
5.9
Unaffected: 0 , < 5.9 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/chemical/scd30_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ccff849bde90973e6c13a666f6ceab5c55b30d4",
"status": "affected",
"version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
"versionType": "git"
},
{
"lessThan": "1821bcacd8ac5b214c53be16cbb8172bf193f0b6",
"status": "affected",
"version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
"versionType": "git"
},
{
"lessThan": "40bb0fdb37f441c9c9f52bf58bbd8a0ca3cc9598",
"status": "affected",
"version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
"versionType": "git"
},
{
"lessThan": "b131f0011dfef72350f4e3f11df94dc3e6b46065",
"status": "affected",
"version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
"versionType": "git"
},
{
"lessThan": "8d4a46e971cf846bda98b20d4cabfa21c1276e5f",
"status": "affected",
"version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
"versionType": "git"
},
{
"lessThan": "82accdd57404399eddf3d56fd9beda7c61307388",
"status": "affected",
"version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
"versionType": "git"
},
{
"lessThan": "d49ff54b2784aa56a7c97982de713604de89d23a",
"status": "affected",
"version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
"versionType": "git"
},
{
"lessThan": "60d877910a43c305b5165131b258a17b1d772d57",
"status": "affected",
"version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/chemical/scd30_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: chemical: scd30: Cleanup initializations and fix sign-extension bug\n\nInclude linux/bitfield.h for FIELD_GET().\n\nCreate new macros for bit manipulation in combination with manual bit\nmanipulation being replaced with FIELD_GET().\n\nThe current variable declaration and initializations are barely readable\nand use comma separations across multiple lines. Refactor the\ninitializations so that mantissa and exp have separate declarations and\nsign gets initialized later.\n\nIn addition (and due to the nature of the cleanup), fix a sign-extension\nbug where, float32 would get bitwise anded with ~BIT(31)\n(which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:53.917Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ccff849bde90973e6c13a666f6ceab5c55b30d4"
},
{
"url": "https://git.kernel.org/stable/c/1821bcacd8ac5b214c53be16cbb8172bf193f0b6"
},
{
"url": "https://git.kernel.org/stable/c/40bb0fdb37f441c9c9f52bf58bbd8a0ca3cc9598"
},
{
"url": "https://git.kernel.org/stable/c/b131f0011dfef72350f4e3f11df94dc3e6b46065"
},
{
"url": "https://git.kernel.org/stable/c/8d4a46e971cf846bda98b20d4cabfa21c1276e5f"
},
{
"url": "https://git.kernel.org/stable/c/82accdd57404399eddf3d56fd9beda7c61307388"
},
{
"url": "https://git.kernel.org/stable/c/d49ff54b2784aa56a7c97982de713604de89d23a"
},
{
"url": "https://git.kernel.org/stable/c/60d877910a43c305b5165131b258a17b1d772d57"
}
],
"title": "iio: chemical: scd30: Cleanup initializations and fix sign-extension bug",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64497",
"datePublished": "2026-07-25T08:51:53.917Z",
"dateReserved": "2026-07-19T15:36:31.792Z",
"dateUpdated": "2026-07-25T08:51:53.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64500 (GCVE-0-2026-64500)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
iio: adc: lpc32xx: Initialize completion before requesting IRQ
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: lpc32xx: Initialize completion before requesting IRQ
In the report from Jaeyoung Chung:
"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its
interrupt handler with devm_request_irq() before it initializes
st->completion with init_completion(). If an interrupt arrives after
devm_request_irq() and before init_completion(), the handler calls
complete() on an uninitialized completion, causing a kernel panic.
The probe path, in lpc32xx_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
...
retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,
LPC32XXAD_NAME, st); /* register handler */
...
init_completion(&st->completion); /* initialize completion */
lpc32xx_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs,
complete() acquires the uninitialized wait.lock and walks the zeroed
task_list in swake_up_locked(). The zeroed task_list makes list_empty()
return false, so swake_up_locked() dereferences a NULL list entry,
triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer
dereference by moving init_completion() above devm_request_irq().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 7090c0d29708ee305022d0ea7b37612b33242fa2
(git)
Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 0e33587967b356519aa6f220b5b43c6976320397 (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 820c4f15353efe9a9429ae86ccceeaf4e0e4e585 (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 48eccc6caed4e62c0f199ab3a3772fa969cd3b2d (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4 (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 2f18c5551aa97ca7f39dbb151c67c9053ccadc17 (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < e561b35633f450ee607e87a6401d97f156a0cd54 (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/lpc32xx_adc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7090c0d29708ee305022d0ea7b37612b33242fa2",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "0e33587967b356519aa6f220b5b43c6976320397",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "820c4f15353efe9a9429ae86ccceeaf4e0e4e585",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "48eccc6caed4e62c0f199ab3a3772fa969cd3b2d",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "2f18c5551aa97ca7f39dbb151c67c9053ccadc17",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "e561b35633f450ee607e87a6401d97f156a0cd54",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/lpc32xx_adc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: lpc32xx: Initialize completion before requesting IRQ\n\nIn the report from Jaeyoung Chung:\n\n\"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its\ninterrupt handler with devm_request_irq() before it initializes\nst-\u003ecompletion with init_completion(). If an interrupt arrives after\ndevm_request_irq() and before init_completion(), the handler calls\ncomplete() on an uninitialized completion, causing a kernel panic.\n\nThe probe path, in lpc32xx_adc_probe():\n\n iodev = devm_iio_device_alloc(\u0026pdev-\u003edev, sizeof(*st)); /* st kzalloc-zeroed */\n ...\n retval = devm_request_irq(\u0026pdev-\u003edev, irq, lpc32xx_adc_isr, 0,\n LPC32XXAD_NAME, st); /* register handler */\n ...\n init_completion(\u0026st-\u003ecompletion); /* initialize completion */\n\nlpc32xx_adc_isr() calls complete():\n\n complete(\u0026st-\u003ecompletion);\n\nIf the device raises an interrupt before init_completion() runs,\ncomplete() acquires the uninitialized wait.lock and walks the zeroed\ntask_list in swake_up_locked(). The zeroed task_list makes list_empty()\nreturn false, so swake_up_locked() dereferences a NULL list entry,\ntriggering a KASAN wild-memory-access.\"\n\nFix the chance of a spurious IRQ causing an uninitialized pointer\ndereference by moving init_completion() above devm_request_irq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:56.053Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7090c0d29708ee305022d0ea7b37612b33242fa2"
},
{
"url": "https://git.kernel.org/stable/c/0e33587967b356519aa6f220b5b43c6976320397"
},
{
"url": "https://git.kernel.org/stable/c/1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd"
},
{
"url": "https://git.kernel.org/stable/c/820c4f15353efe9a9429ae86ccceeaf4e0e4e585"
},
{
"url": "https://git.kernel.org/stable/c/48eccc6caed4e62c0f199ab3a3772fa969cd3b2d"
},
{
"url": "https://git.kernel.org/stable/c/9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4"
},
{
"url": "https://git.kernel.org/stable/c/2f18c5551aa97ca7f39dbb151c67c9053ccadc17"
},
{
"url": "https://git.kernel.org/stable/c/e561b35633f450ee607e87a6401d97f156a0cd54"
}
],
"title": "iio: adc: lpc32xx: Initialize completion before requesting IRQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64500",
"datePublished": "2026-07-25T08:51:56.053Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:51:56.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64503 (GCVE-0-2026-64503)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync()
but returns -EINVAL directly when a scale with a non-zero integer part is
requested, skipping the matching pm_runtime_put_autosuspend(). This leaks
a runtime PM usage-counter reference on every such write, after which the
device can no longer autosuspend.
Set the error code and fall through to the existing put instead of
returning early.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < a93fd69c1ab0854ac4f5b8439c26dfadb25dfd20
(git)
Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < eeece4a85ece6f3837c75ef26a9b2bf5a1d0fcfc (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 191fcfeb729ededd8dd2a999c6bf351ddfa0cec7 (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 36154171385a8a2444a4b3c6eaa0c5294cb02478 (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 223703d6e8bed50b6a0b47e160877909518d94b9 (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 6293211d142605bec435229ef0aa3668b8964164 (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 13a91e8631cfeb68e5b7fd6687f194f5a86e83fe (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 44a5fd874bb6873bdaec59f722c1d57832fbc9df (git) |
|
| Linux | Linux |
Affected:
4.9
Unaffected: 0 , < 4.9 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/accel/kxsd9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a93fd69c1ab0854ac4f5b8439c26dfadb25dfd20",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "eeece4a85ece6f3837c75ef26a9b2bf5a1d0fcfc",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "191fcfeb729ededd8dd2a999c6bf351ddfa0cec7",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "36154171385a8a2444a4b3c6eaa0c5294cb02478",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "223703d6e8bed50b6a0b47e160877909518d94b9",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "6293211d142605bec435229ef0aa3668b8964164",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "13a91e8631cfeb68e5b7fd6687f194f5a86e83fe",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "44a5fd874bb6873bdaec59f722c1d57832fbc9df",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/accel/kxsd9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: kxsd9: fix runtime PM imbalance on write_raw() error\n\nkxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync()\nbut returns -EINVAL directly when a scale with a non-zero integer part is\nrequested, skipping the matching pm_runtime_put_autosuspend(). This leaks\na runtime PM usage-counter reference on every such write, after which the\ndevice can no longer autosuspend.\n\nSet the error code and fall through to the existing put instead of\nreturning early."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:58.186Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a93fd69c1ab0854ac4f5b8439c26dfadb25dfd20"
},
{
"url": "https://git.kernel.org/stable/c/eeece4a85ece6f3837c75ef26a9b2bf5a1d0fcfc"
},
{
"url": "https://git.kernel.org/stable/c/191fcfeb729ededd8dd2a999c6bf351ddfa0cec7"
},
{
"url": "https://git.kernel.org/stable/c/36154171385a8a2444a4b3c6eaa0c5294cb02478"
},
{
"url": "https://git.kernel.org/stable/c/223703d6e8bed50b6a0b47e160877909518d94b9"
},
{
"url": "https://git.kernel.org/stable/c/6293211d142605bec435229ef0aa3668b8964164"
},
{
"url": "https://git.kernel.org/stable/c/13a91e8631cfeb68e5b7fd6687f194f5a86e83fe"
},
{
"url": "https://git.kernel.org/stable/c/44a5fd874bb6873bdaec59f722c1d57832fbc9df"
}
],
"title": "iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64503",
"datePublished": "2026-07-25T08:51:58.186Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:51:58.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…