Tagged “vex”
CVEs tagged vex, newest first.
7401 CVEsRSS
CVE-2026-98740Medium· 4.1kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety (CVE-2026-98740)
A flaw was found in the Linux kernel's Altera Error Detection and Correction (EDAC) driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device r…
CVE-2026-98738Medium· 5.1Bluetooth: Serialize SMP remote OOB data access
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build_pairing_cmd() looks up remote OOB data and copies its contents without holding hdev->lock, which serializes the l…
CVE-2026-98737Medium· 4.7Bluetooth: hci_sync: Fix inquiry cache use-after-free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix inquiry cache use-after-free The sync command worker holds hdev->req_lock, but inquiry-cache updates and flushes use hdev->lock. Both hci_acl_…
CVE-2026-98743Medium· 5.5kernel: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (CVE-2026-98743)
A flaw was found in the Linux kernel's rt1017 SDCA audio codec driver. The driver fails to initialize stream configuration data before passing it to the sound subsystem, leaving configuration fields populated with uninitialized memory. A l…
CVE-2026-98742Medium· 4.7ALSA: seq: Serialize compat port-info ioctls
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client->ioctl_mutex, but the translated port-info compat pat…
CVE-2026-98741High· 7.8ALSA: ua101: reject mismatched capture/playback packet sizes
In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detect_usb_format() cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playba…
CVE-2026-98747Medium· 4.4kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() (CVE-2026-98747)
A flaw was found in the Linux kernel's serial core subsystem. This flaw allows a local user with administrative access to cause a Denial of Service (DoS) by crashing the system. The issue occurs during the unregistration of a serial port t…
CVE-2026-98746Low· 2.3kernel: serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (CVE-2026-98746)
A flaw was found in the Linux kernel's ma35d1 serial driver. This flaw allows a local user to cause a Denial of Service (DoS) through resource exhaustion. The driver fails to release clock references during probe error handling or when the…
CVE-2026-98745Medium· 5.5arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When system_supports_sme() is true but system_supports_sve() is false, restoring a specifica…
CVE-2026-98744Medium· 5.5kernel: ASoC: codecs: max98363: fix uninitialized stream_config->type (CVE-2026-98744)
A flaw was found in the Linux kernel's MAX98363 audio codec driver. A local user could trigger this vulnerability during audio stream configuration because internal stream parameters are left uninitialized in memory. This issue allows unin…
CVE-2026-98750Medium· 4.7tty: fix saved termios reset race
In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device an…
CVE-2026-98749Medium· 4.7tty: serial: max3100: shut down timer before freeing port
In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbo…
CVE-2026-98748Medium· 4.1serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardw…
CVE-2026-98754High· 7.0tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callback…
CVE-2026-98753Medium· 4.7tty: tty_port: restore TTY_IO_ERROR on activation failure
In the Linux kernel, the following vulnerability has been resolved: tty: tty_port: restore TTY_IO_ERROR on activation failure Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone…
CVE-2026-98751Medium· 5.5tty: abort break signalling on hangup
In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Dr…
CVE-2026-98757Medium· 4.1usb: cdns3: fix use-after-free in cdns3_gadget_exit()
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage a…
CVE-2026-98752Medium· 4.7tty: port: fix tty_port_tty_vhangup() race
In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty_port_tty_vhangup() race Drivers rely on tty_port_tty_vhangup() to synchronously hang up their ports before tearing down resources as part of deregis…
CVE-2026-98759Medium· 6.8kernel: usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() (CVE-2026-98759)
A flaw was found in the Linux kernel's USB Type-C TI Power Delivery (tipd) driver. The driver fails to initialize memory for descriptor structures when handling partner device connections. An attacker connecting a USB device can cause the …
CVE-2026-98758Medium· 4.1kernel: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (CVE-2026-98758)
A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) GLINK driver. A local attacker with administrative privileges could trigger this flaw during device removal, leading to a Denial of Service (DoS) …
CVE-2026-98756Medium· 4.1usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver d…
CVE-2026-98755Low· 3.3tty: vcc: zero-initialize control packet in vcc_send_ctl()
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc_send_ctl() The stack-allocated struct vio_vcc pkt was partially initialized, leaving the tag.stype_env field uninitiali…
CVE-2026-98765Medium· 4.1USB: gadget: dummy-hcd: Fix wait for outstanding request completions
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronize_irq() by waiting until its private callback_usage counte…
CVE-2026-98761Medium· 4.0usb: typec: tcpm: recover after failure to start the frs ams
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FAST_ROLE_SWAP AMS by initiating error recovery on it. This…
CVE-2026-98760Medium· 6.1usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner()…
CVE-2026-98766Medium· 4.1usb: gadget: aspeed-vhub: cancel wake work on device removal
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wake_work is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never …
CVE-2026-98763Medium· 6.2usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep_in and ep_out for non-ep0 control endpoints In usb_enable_endpoint(), non-zero control endpoints (where usb_endpoint_xfer_control(&ep->desc) i…
CVE-2026-98762Medium· 4.7USB: dwc2: shut down wakeup timer before freeing HCD state
In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() current…
CVE-2026-98768Medium· 4.7usb: typec: anx7411 - stop the IRQ before destroying the workqueue
In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat->work while remove() is tearing the queue down. …
CVE-2026-98767Medium· 5.1usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd…