CVE-2026-53306None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8. This is the number of entries in: static struct hvc_i…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
tty: hvc_iucv: fix off-by-one in number of supported devices
MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8. This is the number of entries in: static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES];
Sometimes hvc_iucv_table[] is limited by: (a) if (num > hvc_iucv_devices) // for error detection or (b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places (so these 2 don't agree; second one appears to be correct to me.)
hvc_iucv_devices can be 0..8. This is a counter. (c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES)
If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8]. Oops.
Linux >= 44a01d5ba8a4d543694461cd3e178cfa6b3f221b < 3d3b89e6ab93bdd0efd45828bda6b0e61cc46dffLinux >= 44a01d5ba8a4d543694461cd3e178cfa6b3f221b < 484357dff256c816d9466bda35eb765685e4dc86Linux >= 44a01d5ba8a4d543694461cd3e178cfa6b3f221b < 11207e42a332eb8bbcb9fe74df9edd2a807c5607Linux >= 44a01d5ba8a4d543694461cd3e178cfa6b3f221b < fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4Linux >= 44a01d5ba8a4d543694461cd3e178cfa6b3f221b < a76511bc654819425d3b15e77b523d7f9d81f064Linux >= 44a01d5ba8a4d543694461cd3e178cfa6b3f221b < 3104a3f40feb107f77d7116ad9bf6c210ab7babfLinux >= 44a01d5ba8a4d543694461cd3e178cfa6b3f221b < f1dc8e72de9aabe5d96767a4e97219ac26b79fe5Linux >= 44a01d5ba8a4d543694461cd3e178cfa6b3f221b < f2a880e802ad12d1e38039d1334fb1475d0f5241Linux 2.6.29Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses