UBUNTU-CVE-2026-80576

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

CVE-2026-80572

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byddisconnect uses timerdelete before freeing the driver's private data. This does not wait for a running bydcleartouch callback, which dereferences the private...

CVE-2026-80574

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

UBUNTU-CVE-2026-80574

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

CVE-2026-80576

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

UBUNTU-CVE-2026-80572

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byddisconnect uses timerdelete before freeing the driver's private data. This does not wait for a running bydcleartouch callback, which dereferences the private...

CVE-2026-80546

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrbmsgtotype6cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could...

UBUNTU-CVE-2026-80568

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

UBUNTU-CVE-2026-80575

In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50add copies the custom data of an FFPERIODIC/FFCUSTOM effect straight from the ffeffect the user passed to EVIOCSFF, without requiring it to hold anything:...

CVE-2026-80567

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Previously, rmif54bufferqueue waited for the worker thread to finish but ignored whether it succeeded. If the worker failed e.g., due to a timeout or register read...

CVE-2026-80586

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some...

UBUNTU-CVE-2026-80573

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

UBUNTU-CVE-2026-80566

In the Linux kernel, the following vulnerability has been resolved: Input: hynitroncstxxx - validate touch count and finger IDs The driver allocates maxtouchnum input slots, which are indexed from zero through maxtouchnum - 1. The current check allows a finger ID equal to maxtouchnum to reach...

UBUNTU-CVE-2026-80545

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrbmsgtotype6ep11cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11cprb structure and...

UBUNTU-CVE-2026-80586

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some...

CVE-2026-80568

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

CVE-2026-80559

In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40probe, inputregisterdevice was previously called early before the V4L2 video device and vb2queue components were fully initialized. If userspace opened the input devic...

UBUNTU-CVE-2026-80559

In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40probe, inputregisterdevice was previously called early before the V4L2 video device and vb2queue components were fully initialized. If userspace opened the input devic...

AZL-97761 CVE-2026-74752 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-54553

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...