EUVD-2026-76257

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MTTXD7MACTXD, set in mt7996macwritetxwi80211, but are otherwise FW-TXP devices. On tx free...

CVE-2026-80934 wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MTTXD7MACTXD, set in mt7996macwritetxwi80211, but are otherwise FW-TXP devices. On tx free...

CVE-2026-80934

CVE-2026-80934 affects the Linux kernel WiFi driver mt76 mt7996 (and mt7992). The root cause is a TX DMA mapping leak on AddBA request action frames: these frames use a HW MAC-TXP layout, but the TX-free path incorrectly decodes them as FW-TXP, causing the unmap loop to run zero times and the DMA...

CVE-2026-80934 wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MTTXD7MACTXD, set in mt7996macwritetxwi80211, but are otherwise FW-TXP devices. On tx free...

CVE-2026-80933 wifi: mt76: mt7996: validate default EEPROM firmware size

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80933

This Linux kernel vulnerability affects the mt76: mt7996 Wi-Fi driver . The driver parses and copies the default EEPROM firmware without validating its length, so a truncated firmware file can cause the driver to read beyond the allocated buffer during variant validation or the fallback copy. Red...

EUVD-2026-76256

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80932

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

EUVD-2026-76255

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

CVE-2026-80932

A use-after-free vulnerability in the Linux kernel's vsock/virtio component is triggered during virtio_vsock_remove(). The function flushes work items before freeing the virtio_vsock object, but the flush order ignores dependencies: send_pkt_work can queue rx_work after the remove path has alread...

CVE-2026-80932 vsock/virtio: flush works in dependency order

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

CVE-2026-80933 wifi: mt76: mt7996: validate default EEPROM firmware size

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80932 vsock/virtio: flush works in dependency order

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

CVE-2026-80933

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80931 w1: ds28e17: reject an oversize length on an I2C block read

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

CVE-2026-80931

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

EUVD-2026-76254

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

CVE-2026-80931 w1: ds28e17: reject an oversize length on an I2C block read

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

CVE-2026-80931

CVE-2026-80931 is an out-of-bounds read in the Linux kernel's DS28E17 1-Wire to I2C bridge driver (w1: ds28e17). During an I2C_M_RECV_LEN read, the device-controlled length byte (buf[0]) is not validated against the caller buffer size (34 bytes), allowing a read up to ~222 bytes out of bounds . P...

CVE-2026-80930

CVE-2026-80930 affects the Linux kernel 's tpm_i2c_nuvoton driver (Nuvoton TPM over I2C). The root cause is in i2c_nuvoton_wait_for_stat(), which enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out or is interrupted before the handler runs, th...