https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:53:05 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-89466 <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-89466 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1253 certfr-2026-avi-1253 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1253 https://cve.radiocsirt.org/vuln/euvd-2026-367580 EUVD-2026-367580 https://cve.radiocsirt.org/vuln/euvd-2026-367580 https://cve.radiocsirt.org/vuln/fkie_cve-2026-89466 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>power: supply: qcom_battmgr: terminate the strings from firmware</p> <p>The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator.</p> <p>Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val-&gt;strval, which power_supply_format_property() prints with &#34;%s&#34;, so a firmware string that fills the whole field makes that read run into the following members.</p> <p>Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>power: supply: qcom_battmgr: terminate the strings from firmware</p> <p>The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator.</p> <p>Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val-&gt;strval, which power_supply_format_property() prints with &#34;%s&#34;, so a firmware string that fills the whole field makes that read run into the following members.</p> <p>Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-89466 https://cve.radiocsirt.org/vuln/ghsa-g9cw-qg44-9g2q <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>power: supply: qcom_battmgr: terminate the strings from firmware</p> <p>The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator.</p> <p>Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val-&gt;strval, which power_supply_format_property() prints with &#34;%s&#34;, so a firmware string that fills the whole field makes that read run into the following members.</p> <p>Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>power: supply: qcom_battmgr: terminate the strings from firmware</p> <p>The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator.</p> <p>Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val-&gt;strval, which power_supply_format_property() prints with &#34;%s&#34;, so a firmware string that fills the whole field makes that read run into the following members.</p> <p>Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.</p> https://cve.radiocsirt.org/vuln/ghsa-g9cw-qg44-9g2q https://cve.radiocsirt.org/vuln/msrc_cve-2026-89466 msrc_CVE-2026-89466 https://cve.radiocsirt.org/vuln/msrc_cve-2026-89466 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11880-1 <p>kernel-devel-7.2.7-1.1 on GA media</p> <p>kernel-devel-7.2.7-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11880-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-89466 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 154 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator. Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val-&gt;strval, which power_supply_format_property() prints with &#34;%s&#34;, so a firmware string that fills the whole field makes that read run into the following members. Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 154 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator. Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val-&gt;strval, which power_supply_format_property() prints with &#34;%s&#34;, so a firmware string that fills the whole field makes that read run into the following members. Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-89466 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3321 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten oder den Systemzustand zu manipulieren, Denial-of-Service-Zustände herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten oder den Systemzustand zu manipulieren, Denial-of-Service-Zustände herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3321