CVE-2026-80741

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drmlogdrawkmsgrecord accesses slen - 1 to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINTMAX, causing an out-of-bounds read...

kernel: af_unix: Set gc_in_progress to true in unix_gc()

A flaw was found in the Linux kernel's afunix component. A race condition exists within the unixgc garbage collection function where the gcinprogress flag may not be correctly set. This could lead to unixpeekfpl misinterpreting garbage collection status when handling MSGPEEK operations, potential...

bad_garbage

BADGARBAGE.c CVE-2026-53361 — an unprivileged, container-escapable use-after-free in the AFUNIX socket garbage collector. This is the single-vector MSGPEEK only version. The Bug The AFUNIX GC reclaims "in-flight" sockets that form unreachable reference cycles. A concurrent MSGPEEK on an in-flight...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the buffereventsocketsetconnaddress function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AFUNIX listener, an attacker can overwrite critical heap data, leading to memory...

CVE-2026-63388

A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the buffereventsocketsetconnaddress function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AFUNIX listener, an attacker can overwrite critical heap data, leading to memory...

CVE-2026-80521

A flaw was found in the Linux kernel's afunix component. A race condition during concurrent send and close operations can lead to the garbage collector GC partially freeing a Strongly Connected Component SCC. This inconsistent state may cause subsequent GC operations to iterate over a partially...

EUVD-2026-66587

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

AZL-97814 CVE-2026-80521 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-80521

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

UBUNTU-CVE-2026-80521

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-80574

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

CVE-2026-80521

CVE-2026-80521 is a use-after-free in the Linux kernel's af_unix subsystem, specifically in the garbage collection (GC) logic for strongly connected components (SCC). A race in unix_del_edge() allows the GC to free a dead SCC partially when a concurrent send() of a socket and close() of other soc...

CVE-2026-80521 af_unix: Unlink scc_entry in unix_del_edge().

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-80521 af_unix: Unlink scc_entry in unix_del_edge().

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-74738

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...