CVE-2026-80597

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...

UBUNTU-CVE-2026-80677

In the Linux kernel, the following vulnerability has been resolved: driver core: use READONCE for dev-driver in devhassyncstate devhassyncstate reads dev-driver twice without holding devicelock -- once for the NULL check and once to dereference -syncstate. Some callers only hold...

UBUNTU-CVE-2026-80653

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Add slavedestroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at...

CVE-2026-80597

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...

CVE-2026-80677

In the Linux kernel, the following vulnerability has been resolved: driver core: use READONCE for dev-driver in devhassyncstate devhassyncstate reads dev-driver twice without holding devicelock -- once for the NULL check and once to dereference -syncstate. Some callers only hold...

UBUNTU-CVE-2026-80597

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...

UBUNTU-CVE-2026-80690

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

UBUNTU-CVE-2026-80613

In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path During XDP enablement in veth, if xdprxqinforeg or xdprxqinforegmemmodel fails, the driver rolls back the changes. However, the rollback loop: for i--; i = start; i-- decrements the lo...

CVE-2026-80723

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

CVE-2026-80690

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

CVE-2026-80653

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Add slavedestroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at...

CVE-2026-80646

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

UBUNTU-CVE-2026-80608

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix iommu domain lifetime race during device removal When forceiova mode is enabled, amdxdnaremove frees xdna-domain. If amdxdnagemobjfree is called after device removal, it may attempt to access xdna-domain,...

CVE-2026-80608

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix iommu domain lifetime race during device removal When forceiova mode is enabled, amdxdnaremove frees xdna-domain. If amdxdnagemobjfree is called after device removal, it may attempt to access xdna-domain,...

UBUNTU-CVE-2026-80723

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

UBUNTU-CVE-2026-80646

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

EUVD-2026-67458

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

CVE-2026-80723 of: reserved_mem: prevent OOB when too many dynamic regions are defined

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

CVE-2026-80723

CVE-2026-80723 affects the Linux kernel in the of: reserved_mem subsystem. During boot, the function fdt_scan_reserved_mem() stores each dynamically-placed /reserved-memory subnode into a local array of fixed size MAX_RESERVED_REGIONS. When the device tree defines more dynamically-placed regions ...

CVE-2026-80723 of: reserved_mem: prevent OOB when too many dynamic regions are defined

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...