CVE-2026-81002 xdp: fix zero-copy frame layout

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

CVE-2026-81002

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

CVE-2026-81002 xdp: fix zero-copy frame layout

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

CVE-2026-81002

CVE-2026-81002 is a critical (CVSS 9.8) memory corruption flaw in the Linux kernel's XDP component. The xdp_convert_zc_to_xdp_frame() function clones an AF_XDP zero-copy packet into an order-0 page but incorrectly advertises PAGE_SIZE as the frame size, allowing the frame to overlap skb_shared_in...

CVE-2026-80937 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937

CVE-2026-80937 is an out-of-bounds write in the Linux kernel's mt76 Wi-Fi driver for mt7915 chipsets. The function mt7915_mcu_get_eeprom() copies a 16-byte EFUSE block into the driver's eeprom.data buffer at an offset supplied by the device MCU (res->addr), a device-controlled __le32, without ...

CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935

CVE-2026-80935 affects the Linux kernel mt76 Wi-Fi driver for MediaTek MT7996 devices. The function mt7996_mcu_get_eeprom() uses a device-controlled 32-bit address (event->addr) as a destination offset into dev->mt76.eeprom.data without bounds-checking it, only clamping the copy length. A m...

EUVD-2026-75946

In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...

PT-2026-96373

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp convert zc to xdp frame clones an XSK packet into an order-0 page and advertises PAGE SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb shared info and...

PT-2026-90132

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xdp convert zc to xdp frame function where an XSK packet is cloned into an order-0 page and incorrectly advertises PAGE SIZE as its frame size. This allows the...

CVE-2026-89675: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

PT-2026-90428

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the nfsd4 ssc expire umount function when iterating through the nn-nfsd ssc mount list. The function drops the nfsd ssc lock to execute mntput on the source...

PT-2026-90379

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free flaw exists in the nfsd copy-notify stateids. The issue occurs because free cpntf state locked only unlinks an entry when its reference count reaches zero. If a revoke...

PT-2026-96439

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd file leak on inter-server COPY setup failure When nfsd4 setup inter ssc fails, nfsd4 copy returns nfserr offload denied directly, bypassing the out: label where release copy files would drop the nf dst reference...

PT-2026-96581

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsd copy file range samples dst-f wb err into "since" after the copy loop, then uses it to detect writeback errors via filemap check wb err once vfs fsync range returns...

PT-2026-96597

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CB OFFLOAD after the worker kthread completes. When the post-copy vfs fsync range or...