CVE-2026-80666

CVE-2026-80666 affects the Linux kernel Bluetooth SCO (synchronous connection-oriented) socket implementation in net/bluetooth/sco.c. The root cause is a race condition between sco_sock_close() and the asynchronous sco_sock_timeout() work item: both attempt to hold lock_sock(sk) simultaneously, r...

CVE-2026-80666 Bluetooth: sco: Fix a race condition in sco_sock_timeout()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

EUVD-2026-67542

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

CVE-2026-80660

CVE-2026-80660 is a lock-ordering deadlock in the Linux kernel's hwmon (occ) driver . The functions occ_active(false) and occ_shutdown() unregister sysfs-backed devices while holding occ->lock, but hwmon_device_unregister() and sysfs_remove_group() may wait for active sysfs callbacks to drain,...

CVE-2026-80659 mmc: vub300: defer reset until cmd_mutex is unlocked

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

EUVD-2026-67535

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

CVE-2026-80660 hwmon: (occ) unregister sysfs devices outside occ lock

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ unregister sysfs devices outside occ lock occactivefalse and occshutdown unregister sysfs-backed devices while occ-lock is held. hwmondeviceunregister and sysfsremovegroup can wait for active sysfs callbacks to drain,...

EUVD-2026-67536

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ unregister sysfs devices outside occ lock occactivefalse and occshutdown unregister sysfs-backed devices while occ-lock is held. hwmondeviceunregister and sysfsremovegroup can wait for active sysfs callbacks to drain,...

CVE-2026-80659

CVE-2026-80659 is a deadlock in the Linux kernel's vub300 MMC/USB driver. When a command response times out, __vub300_command_response() synchronously resets the USB device while vub300_cmndwork_thread() still holds cmd_mutex; the reset path re-enters the driver via vub300_pre_reset() and attempt...

CVE-2026-74745

A flaw was found in the Linux kernel's bnxt Ethernet driver. This vulnerability could allow a local attacker to cause a system deadlock. The deadlock occurs when the driver attempts to unregister an IRQ affinity notifier while holding a lock that is also required by the notifier's callback, leadi...

CVE-2026-80549

A flaw was found in the Linux kernel's s390/vfioccw component. When a device is lost, the fsmnotoper routine performs cleanup while potentially holding other locks, such as the cio subchannel lock. This improper handling of resource cleanup in an asynchronous context could lead to a deadlock,...

EUVD-2026-66575

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...

TencentOS Server 3: osbuild-composer (TSSA-2026:0911)

"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0911 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilitie...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

CVE-2026-74745

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...

UBUNTU-CVE-2026-74745

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...

CVE-2026-74745

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...

CVE-2026-80549 s390/vfio_ccw: Move cp cleanup out of not operational

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Move cp cleanup out of not operational The fsmnotoper routine is called when the device has been lost, and is by definition no longer operational. Since this can happen asynchronously from the normal behavior of the...

CVE-2026-74745 eth: bnxt: avoid deadlock when canceling IRQ affinity notifier

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...

CVE-2026-74745 eth: bnxt: avoid deadlock when canceling IRQ affinity notifier

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...