CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

AZL-99539 CVE-2026-80789 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

AZL-99503 CVE-2026-80788 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

CVE-2026-80853 KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

CVE-2026-80853

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

CVE-2026-80853 KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

CVE-2026-80837

CVE-2026-80837 is a use-after-free vulnerability in the Linux kernel's nf_tables subsystem, confirmed on version 7.2.0-rc6 via KASAN. The root cause is a race in nft_quota_obj_eval(), which enqueues a packet-path notification onto nft_net->notify_list via an unlocked list_add_tail(), while nft...

CVE-2026-80815 ALSA: scarlett2: Use a private URB for the notification endpoint

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2initnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that...

CVE-2026-80789 nvmet-tcp: bound SGL data length before allocating command buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-80789 nvmet-tcp: bound SGL data length before allocating command buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-80789

In the Linux kernel nvmet-tcp component (NVMe/TCP target), a host-controlled 32-bit sgl->length field is only validated for in-capsule SGL descriptors. Non-inline transport SGL data-block descriptors—those used for out-of-capsule writes—skip the check entirely, causing an unbounded sgl_alloc()...

EUVD-2026-71432

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-80788

CVE-2026-80788 affects the Linux kernel NVMe-over-TCP target subsystem (nvmet-tcp ). A remote NVMe initiator can send a command with an oversized SGL (Scatter Gather List) field, causing nvmet_tcp_map_data() to allocate over one million scatterlist/iovec entries. This exceeds MAX_PAGE_ORDER , tri...

CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

EUVD-2026-71431

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

CVE-2026-80788 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

CVE-2026-80788 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

CVE-2026-80781

CVE-2026-80781 is an out-of-bounds read in the Linux kernel's HID core subsystem. The function hid_set_field() passes field->usage + offset to hid_dump_input() before validating that the offset is within field->report_count. When CONFIG_DEBUG_FS is enabled, hid_dump_input() dereferences the...