UBUNTU-CVE-2026-80861

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhcigensetup locates the operational registers using the capability length read from the very first register: xhci-opregs = hcd-regs +...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-500247)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500247 advisory. - inet: frags: strip GSO state from fragments before reassembly Xinyang Ge Orabug: 39974845 CVE-2026-80590 - x86/bugs: Make Safe-RET robust against...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500249)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500249 advisory. - inet: frags: strip GSO state from fragments before reassembly Xinyang Ge Orabug: 39974835 CVE-2026-80590 - KVM: x86/mmu: Stop needlessly making...

CVE-2026-80757

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread takes that nprim verbatim...

CVE-2026-80753

In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point tha...

CVE-2026-80749

In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination a generic target, sized to accept many different data blocks...

CVE-2026-80741

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drmlogdrawkmsgrecord accesses slen - 1 to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINTMAX, causing an out-of-bounds read...

CVE-2026-80742

In the Linux kernel, the following vulnerability has been resolved: afpacket: Don't send zero-byte data in tpacketsnd. syzbot reported a WARNING in devqueuexmit triggered via tpacketsnd: skbassertlen WARNING: at include/linux/skbuff.h:2753 skbassertlen WARNING: at devqueuexmit+0x21bc/0x4970...

CVE-2026-80740

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scale is large enough that scaledfont exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in...

CVE-2026-80736

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAXGROUPS, while Group ID 0 is reserved. tbconsumeddpbandwidth uses the Group ID directly to index its local groupreserved array...

CVE-2026-80734

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: dropcaches: 3 assertion...

CVE-2026-80733

In the Linux kernel, the following vulnerability has been resolved: net: remove WARNONONCE from skmcloop skmcloop can be called for sockets that are neither AFINET nor AFINET6 e.g. AFPACKET sockets when sending packets via raw/packet socket over virtual devices such as VRF or ipvlan. In such case...

CVE-2026-80732

In the Linux kernel, the following vulnerability has been resolved: ata: patasl82c105: fix bridge revision use-after-free pcigetslot returns a referenced PCI device. Commit 44c10138fd4b "PCI: Change all drivers to use pcidevice-revision" replaced a configuration-space read with direct access to t...

CVE-2026-80727

In the Linux kernel, the following vulnerability has been resolved: x86/mce: Set up the polling timer before CMCI discovery I hit the following on one of my machines: mce: CPU0 BANK15 CMCI inherited storm ------------ cut here ------------ ODEBUG: assertinit not available active state 0 object:...

CVE-2026-80726

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's...

CVE-2026-68086

creationtimestamp| type| source ---|---|--- 2026-09-02 04:45:17+00:00| seen| https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities20260902...

Vulnerability of components of the Linux operating system’s kernel, net/mlx5, which allows a hacker to cause a service failure

The vulnerability of the net/mlx5 components in the Linux operating system’s kernel is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-80589

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk diskrelease undoes blkmqinitallocatedqueue for a disk whose probe failed before adddisk, but it only calls blkmqexitqueue. Nothing there stops q-timeout, and that...

CVE-2026-80580

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-80579

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...