p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de linux-azure · Page n° 197

Vulnérabilités publiées pour linux-azure au cours des 30 derniers jours : 635. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 10261

  1. CVE-2026-63958

    Élevée · CVSS 7EPSS 0,16%Correctif disponible

    usb: typec: ucsi: validate connector number in ucsi_connector_change()

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencin

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-63957

    Élevée · CVSS 7.8EPSS 0,17%Correctif disponible

    USB: serial: safe_serial: fix memory corruption with small endpoint

    In the Linux kernel, the following vulnerability has been resolved: USB: serial: safe_serial: fix memory corruption with small endpoint Make sure that the bulk-out buffer size is at least eight bytes to avoid user-controlled slab corruption in "safe" mode should a malicious device report a smaller size.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-63956

    Élevée · CVSS 7.8EPSS 0,17%Correctif disponible

    USB: serial: cypress_m8: fix memory corruption with small endpoint

    In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress_m8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a malicious device report a smaller size.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2026-63954

    Élevée · CVSS 7.8EPSS 0,17%Correctif disponible

    hpfs: fix a crash if hpfs_map_dnode_bitmap fails

    In the Linux kernel, the following vulnerability has been resolved: hpfs: fix a crash if hpfs_map_dnode_bitmap fails If hpfs_map_dnode_bitmap fails, the code would call hpfs_brelse4 on uninitialized quad buffer head, causing a crash.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2026-63952

    Élevée · CVSS 8.4EPSS 0,13%Correctif disponible

    memfd: deny writeable mappings when implying SEAL_WRITE

    In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means one can use SEAL_EXEC to apply SEAL_WRITE while having writeable mappings. This breaks the contract that SEAL_WRITE provides and can be used by an attacker to pass a memfd that appears to be write sealed but can still be modified arbitrarily. Fix this by adding the implied seals before the call for mapping_deny_writable() is done.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2026-63949

    Élevée · CVSS 7.1EPSS 0,13%Correctif disponible

    auxdisplay: line-display: fix OOB read on zero-length message_store()

    In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length message_store() linedisp_display() unconditionally reads msg[count - 1] before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg[-1]: write(fd, "", 0); -> message_store(..., buf, count=0) -> linedisp_display(linedisp, buf, count=0) -> msg[count - 1] == '\n' ; OOB read The kernfs write buffer for that store is a 1-byte allocation (kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0), so msg[-1] is a 1-byte read before the slab object. On a KASAN-enabl

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2026-63948

    Moyenne · CVSS 5.5EPSS 0,16%Correctif disponible

    Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the end, but the early return when chan->conn is NULL skips the put, leaking the reference. Add the missing l2cap_chan_put() before the early return.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2026-63947

    Élevée · CVSS 8.8EPSS 0,35%Correctif disponible

    Bluetooth: HIDP: fix missing length checks in hidp_input_report()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data. hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching to hidp_input_report(). If a paired device sends a truncated packet, the handler reads beyond the valid skb data, resulting in an out-of-bounds read of skb data. The OOB bytes may be interpreted as phantom key presses or spurious mouse movement. Replace the open-coded length tracking and pointer arithmetic wit

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2026-63946

    Élevée · CVSS 8.8EPSS 0,26%Correctif disponible

    Bluetooth: ISO: fix UAF in iso_recv_frame

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb(). Fix by replacing the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop_put label so sock_put() is called on all exit paths where the hold succeeded.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2026-63945

    Élevée · CVSS 7.8EPSS 0,13%Correctif disponible

    Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk). iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the socket lock held: if (!iso_pi(sk)->conn) return; cancel_delayed_work(&iso_pi(sk)->conn->timeout_work); Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in the final reference to the connection being dropped: CPU0 CPU1 ----

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2026-63944

    Élevée · CVSS 8.8EPSS 0,33%Correctif disponible

    Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL: hci

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2026-63943

    Élevée · CVSS 7.1EPSS 0,16%Correctif disponible

    Input: xpad - fix out-of-bounds access for Share button

    In the Linux kernel, the following vulnerability has been resolved: Input: xpad - fix out-of-bounds access for Share button xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array. Fix this by calculating the offset and checking bounds against the packet length.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2026-63942

    Élevée · CVSS 7.8EPSS 0,13%Correctif disponible

    parport: Fix race between port and client registration

    In the Linux kernel, the following vulnerability has been resolved: parport: Fix race between port and client registration The parport subsystem registers port devices before they are fully initialised, resulting in a race condition where client drivers such as lp can attach to ports that are not completely initialised or even being torn down. When the port and client drivers are built as modules and loaded around the same time during boot, this occasionally results in a crash. I was able to make this happen reliably in a VM with a PC-style parallel port by patching parport_pc to fail probing: > --- a/drivers/parport/parport_pc.c > +++ b

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2026-63940

    Critique · CVSS 9.3EPSS 0,19%Correctif disponible

    KVM: SEV: Ignore Port I/O requests of length '0'

    In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1071.79
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2026-63934

    Élevée · CVSS 7.1EPSS 0,16%Correctif disponible

    iio: gyro: itg3200: fix i2c read into the wrong stack location

    In the Linux kernel, the following vulnerability has been resolved: iio: gyro: itg3200: fix i2c read into the wrong stack location itg3200_read_all_channels() takes `__be16 *buf' as a parameter and fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the parameter (a pointer), `&buf' is the address of the local pointer slot on the stack of itg3200_read_all_channels(), not the address of the caller's scan buffer. The (char *) cast hides the type mismatch. i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16) = 8 bytes into the parameter's stack slot, which is discarded when the function returns. The caller's scan bu

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2026-63933

    Moyenne · CVSS 5.5EPSS 0,16%Correctif disponible

    iio: gyro: adis16260: fix division by zero in write_raw

    In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16260: fix division by zero in write_raw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero to the sampling_frequency sysfs attribute triggers a division by zero in the kernel.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2026-63931

    Moyenne · CVSS 5.5EPSS 0,16%Correctif disponible

    iio: chemical: scd30: fix division by zero in write_raw

    In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: fix division by zero in write_raw Add a zero check for val2 before using it as a divisor when setting the sampling frequency. A user writing a zero fractional part to the sampling_frequency sysfs attribute triggers a division by zero in the kernel.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2026-63930

    Élevée · CVSS 7.8EPSS 0,16%Correctif disponible

    iio: buffer: hw-consumer: fix use-after-free in error path

    In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe().

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2026-63928

    Élevée · CVSS 7.8EPSS 0,17%Correctif disponible

    USB: serial: omninet: fix memory corruption with small endpoint

    In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a smaller endpoint max packet size than expected.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2026-63927

    Élevée · CVSS 7.8EPSS 0,16%Correctif disponible

    usb: dwc2: Fix use after free in debug code

    In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usb_hcd_giveback_urb() so save the urb->status ahead of time.

    linux-azureSystèmes d’exploitation
    • Mettez à jour vers 6.8.0-1070.78
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →