The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In the Linux kernel, the following vulnerability has been resolved:
HID: hyperv: validate initial device info bounds
The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges.
A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet.
Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade perfUpgrade kernel-livepatch-5.10.268-266.1092Upgrade kernel-headersUpgrade kernel-livepatch-5.15.220-153.252Upgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade python-perfUpgrade bpftool | Oct 19, 2026 | Oct 19, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Sep 21, 2026 | Sep 4, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 21, 2026 | Sep 4, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub