CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

UBUNTU-CVE-2026-81017

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...

DEBIAN-CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

AZL-100136 CVE-2026-80951 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

UBUNTU-CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-81017 platform/chrome: sensorhub: Bound the EC-reported sensor number

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...

CVE-2026-80951 i3c: master: svc: bound IBI payload to the requested max_payload_len

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951 i3c: master: svc: bound IBI payload to the requested max_payload_len

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

EUVD-2026-76274

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951

CVE-2026-80951 is an out-of-bounds write in the Linux kernel's i3c master svc driver. The function svc_i3c_master_handle_ibi() reads IBI payloads from the RX FIFO, but its loop is bounded by the hardware FIFO size rather than the per-slot max_payload_len . When a device sends more bytes than the ...

CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

PT-2026-90147

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the platform/chrome sensorhub where the cros ec sensorhub ring handler function fails to validate the 8-bit sensor number in-sensor num carried by each EC FIFO event...

PT-2026-90081

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An out-of-bounds write exists in the IBI pool within the i3c master svc. The function svc i3c master handle ibi reads the IBI payload from the RX FIFO into the IBI slot using a loop bounded ...

CVE-2026-48496: Allocation of Resources Without Limits or Throttling

OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block...

CVE-2026-42804: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPIC-Library in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage in bhi360parse.c line...

CVE-2026-85201

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...

CVE-2026-85201

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...

CVE-2026-85201: Memory Allocation with Excessive Size Value

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...

Panic-safety unsoundness in `Stack::pop`, `Fifo::pop_front` and `Value::replace_stable` (use-after-free / double-free)

Three removal and replacement paths destroy an initialized value before committing the metadata change that removes it. Destruction runs T::drop, which is user code and may panic. If it does, the commit is skipped and the container still claims ownership of the already-destroyed value, so its own...