CVE-2026-80661

In the Linux kernel, the following vulnerability has been resolved: ufs: core: tracing: Do not dereference pointers in TPprintk The trace events in drivers/ufs/core/ufstrace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TPprintk the printing...

CVE-2026-80663

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...

CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80664

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtnat: reject unsupported target families xtnat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nftcompa...

CVE-2026-80667

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete on devcom error mlx5mpeswwork returned without calling complete when mlx5laggetdevcomcomp returned NULL. A caller that queued the work and waited on mpesww-comp would block indefinitely...

CVE-2026-80659

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

CVE-2026-80666

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

CVE-2026-80651

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...

CVE-2026-80653

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Add slavedestroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at...

CVE-2026-80654

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

AZL-98069 CVE-2026-80653 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Add slavedestroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at...

CVE-2026-80650

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: gc2235: fix UAF and memory leak gc2235probe handles its error paths incorrectly. If mediaentitypadsinit fails, gc2235remove is called, which tears down the subdev and frees dev, but then still falls through to...

CVE-2026-80652

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80655

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent. However, the work structures zynqmppminitsuspendwork and...

CVE-2026-80657

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmtchann has already been destroyed. Add NULL checks to...

CVE-2026-80658

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Fix null-ptr-deref in dwdpremove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

CVE-2026-80656

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted nodesize value of ...

CVE-2026-80641

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: enable the right set of ciphers The firmware version number check for IGTK introduced in commit c34dbc5900b0 "wifi: wlcore: Add support for IGTK key" lets the amount of ciphers decrease on every boot of a too old...

CVE-2026-80644

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

CVE-2026-80647

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix warning in poll cq direct mode CQs allocated by iballoccq always have a comphandler. Though in direct mode this handler is never expected to be called, it is still called when the driver is reset, triggering the...