EUVD-2026-67446

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWERSUPPLYPROPSTATUS to a supplier power supply. If no supplier is registered,...

CVE-2026-80705 drm/amd/display: check if dml21_add_phantom_plane() is successful

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

CVE-2026-80705

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

CVE-2026-80698 dmaengine: idxd: fix double free of wq, engine, and group structs

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices idxdconfwqrelease, idxdconfenginerelease, idxdconfgrouprelease each call kfree on the enclosing struct. The...

CVE-2026-80687 iommufd/viommu: Release the igroup lock on the vdevice_size error path

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80687

CVE-2026-80687 is a deadlock vulnerability in the Linux kernel 's iommufd/viommu subsystem. The function iommufd_vdevice_alloc_ioctl() acquires idev->igroup->lock, then validates the driver's vdevice_size against the core structure size. On failure, a WARN_ON_ONCE guard jumps to out_put_ide...

EUVD-2026-67563

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80687

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80687 iommufd/viommu: Release the igroup lock on the vdevice_size error path

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80678 i2c: imx: Fix slave registration race and error handling

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

CVE-2026-80678

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

CVE-2026-80678 i2c: imx: Fix slave registration race and error handling

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

CVE-2026-80667

CVE-2026-80667 affects the Linux kernel's mlx5 driver (used by Mellanox/NVIDIA ConnectX network adapters), specifically the LAG (Link Aggregation Group) and MPESW (Multi-Packet Steering) subsystem. The root cause is that mlx5_mpesw_work() could return without calling complete() when mlx5_lag_get_...

CVE-2026-80667

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete on devcom error mlx5mpeswwork returned without calling complete when mlx5laggetdevcomcomp returned NULL. A caller that queued the work and waited on mpesww-comp would block indefinitely...

CVE-2026-80667 net/mlx5: LAG, MPESW, Fix missing complete() on devcom error

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete on devcom error mlx5mpeswwork returned without calling complete when mlx5laggetdevcomcomp returned NULL. A caller that queued the work and waited on mpesww-comp would block indefinitely...

EUVD-2026-67541

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

EUVD-2026-67533

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmtchann has already been destroyed. Add NULL checks to...

CVE-2026-80657 accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmtchann has already been destroyed. Add NULL checks to...

CVE-2026-80650 media: atomisp: gc2235: fix UAF and memory leak

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: gc2235: fix UAF and memory leak gc2235probe handles its error paths incorrectly. If mediaentitypadsinit fails, gc2235remove is called, which tears down the subdev and frees dev, but then still falls through to...

CVE-2026-80650 media: atomisp: gc2235: fix UAF and memory leak

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: gc2235: fix UAF and memory leak gc2235probe handles its error paths incorrectly. If mediaentitypadsinit fails, gc2235remove is called, which tears down the subdev and frees dev, but then still falls through to...