CVE-2026-80959 dm-pcache: bound the persisted tail-position offset

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...

CVE-2026-80959

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...

EUVD-2026-76281

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-80958 dm-pcache: clamp the tail kset read to the segment data region

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-80958 dm-pcache: clamp the tail kset read to the segment data region

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-80958

CVE-2026-80958 is a buffer over-read in the Linux kernel's dm-pcache (Device Mapper Persistent Cache) component. The tail-kset read performed by cache_replay(), the writeback worker, and the garbage collection (GC) worker incorrectly bounds its length by PCACHE_SEG_SIZE - seg_off (the raw segment...

CVE-2026-80958

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951 i3c: master: svc: bound IBI payload to the requested max_payload_len

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951

CVE-2026-80951 is an out-of-bounds write in the Linux kernel's i3c master svc driver. The function svc_i3c_master_handle_ibi() reads IBI payloads from the RX FIFO, but its loop is bounded by the hardware FIFO size rather than the per-slot max_payload_len . When a device sends more bytes than the ...

EUVD-2026-76274

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951 i3c: master: svc: bound IBI payload to the requested max_payload_len

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80943 wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

CVE-2026-80943 wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

CVE-2026-80943

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

EUVD-2026-76266

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

CVE-2026-80943

CVE-2026-80943 is an out-of-bounds array access in the Linux kernel's rtlwifi driver (rtl8192du). The function rtl92du_tx_fill_desc() uses a QoS TID value (range 0–15) as an index into sta_entry->tids[], which only allocates 9 entries (MAX_TID_COUNT). A TID greater than 8 therefore reads past ...

CVE-2026-80937 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

EUVD-2026-76260

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...