EUVD-2026-76326

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-81003 net/iucv: filter frames in afiucv_hs_rcv() by ingress device

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-80995

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

CVE-2026-80995 net: mctp: hold a reference to the route device in mctp_route_lookup()

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

EUVD-2026-76318

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

CVE-2026-80974 mfd: sm501: Fix potential memory leaks during remove

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix potential memory leaks during remove The memory allocated for struct sm501devdata in sm501pciprobe and sm501platprobe is not freed by the corresponding remove functions sm501pciremove and sm501platremove. Fix that...

CVE-2026-80974

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix potential memory leaks during remove The memory allocated for struct sm501devdata in sm501pciprobe and sm501platprobe is not freed by the corresponding remove functions sm501pciremove and sm501platremove. Fix that...

EUVD-2026-76296

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

EUVD-2026-76286

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

CVE-2026-80962

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cacheinfo cachesegsinit iterates cacheinfo-nsegs times indexing cache-segments, which is sized to the cache device geometry, and getsegid takes each segment id from the on-media...

CVE-2026-80956

CVE-2026-80956 affects the Linux kernel's dm-pcache (device mapper persistent cache) subsystem. The root cause is a bounds mismatch: get_cache_segment() scans the segment map up to cache->n_segs (the physical device segment count), while cache_segs_init() only initializes the first cache_info-...

CVE-2026-80952

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

EUVD-2026-76275

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

CVE-2026-80952

CVE-2026-80952 affects the Linux kernel i3c master component. The root cause is a race condition in i3c_master_unregister_i3c_devs(), which clears the device descriptor (i3cdev->dev->desc) before device_unregister() completes. During the unbind process, i3c_device_uevent() and a racing moda...

CVE-2026-80952 i3c: master: Fix info leak and UAF in device unregister path

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

CVE-2026-80952 i3c: master: Fix info leak and UAF in device unregister path

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

CVE-2026-80937 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...