CVE-2026-89780 net: qualcomm: rmnet: restore skb->dev on deaggregated frames

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub-frame with allocskb and leaves skb-dev NULL. rmnetmapingresshandler assigns skb-dev = ep-egressdev only on the data path, but a M...

CVE-2026-89778 isofs: fix out-of-bounds page array access on empty zisofs block

In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofsuncompressblock's empty-block fast path returns pcount 17, so a crafted "ZF" Rock Ridge record can set it below PAGESHIFT; the bug is reached by an ordinary...

CVE-2026-89778 isofs: fix out-of-bounds page array access on empty zisofs block

In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofsuncompressblock's empty-block fast path returns pcount 17, so a crafted "ZF" Rock Ridge record can set it below PAGESHIFT; the bug is reached by an ordinary...

EUVD-2026-80299

In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofsuncompressblock's empty-block fast path returns pcount 17, so a crafted "ZF" Rock Ridge record can set it below PAGESHIFT; the bug is reached by an ordinary...

CVE-2026-89776 vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla accepts a payload shorter th...

EUVD-2026-80298

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

CVE-2026-89776

CVE-2026-89776 affects the Linux kernel VXLAN VNI filter (vxlan: vnifilter). The root cause is that GROUP/GROUP6 address attributes were declared with NLA_BINARY and only a maximum length, allowing validate_nla() to accept payloads shorter than the address. The consumer then performs an unconditi...

CVE-2026-89776 vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla accepts a payload shorter th...

CVE-2026-89777

A use-after-free vulnerability in the Linux kernel's VFIO/PCI subsystem (drivers/vfio/pci/vfio_pci_config.c) occurs when vdev->msi_perm is freed via kfree() on an init failure path but not NULLed , leaving a dangling pointer that persists across device open/close cycles. On the next vfio_confi...

CVE-2026-89777 vfio/pci: clear vdev->msi_perm after freeing it on init failure

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

EUVD-2026-80297

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla accepts a payload shorter th...

CVE-2026-31431

CVE-2026-31431（复制失败）检查器 检查 Linux 主机是否存在 CVE-2026-31431 漏洞并应用缓解措施。 文件 checkcve202631431.yml - 用于验证和修补的 Ansible Playbook revertcve202631431.yml - 用于撤销缓解措施的 Ansible Playbook runcheck.sh - 用于在本地或远程执行验证的脚本 runrevert.sh - 用于在本地或远程撤销更改的脚本 执行示例 1. 验证漏洞（runcheck.sh） root@kitploit: ./runcheck.sh 选择 'l'...

CVE-2026-89775 KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

CVE-2026-89775

CVE-2026-89775 affects the Linux kernel in the KVM arm64 subsystem. When the S1 MMU is disabled, the page-table walk level is set to −127 (S1_MMU_DISABLED), but pgshift_level_to_ttl() casts it to an unsigned 8-bit value, yielding an invalidation size of 0 during VNCR TLB evaluation. This can leav...

EUVD-2026-80296

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

CVE-2026-89774 Bluetooth: SCO: hold sk properly in sco_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

CVE-2026-89774 Bluetooth: SCO: hold sk properly in sco_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

EUVD-2026-80255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

CVE-2026-89774

CVE-2026-89774 is a Use-After-Free (UAF) in the Linux kernel's Bluetooth SCO subsystem, specifically in sco_conn_ready(). The socket (conn->sk) and its parent are dereferenced without holding a refcount or under conn->lock, allowing a concurrent sco_sock_release() to free the socket before ...

CVE-2026-31431

CVE-2026-31431 — Copy Fail 732 字节，通杀主流 Linux 发行版，直达 root CVE-2026-31431（Copy Fail）是 Linux 内核 authencesn 加密模板中的一个逻辑漏洞。它允许非特权本地用户对系统上任意可读文件的页缓存（page cache）进行确定性的、可控的 4 字节写入。 概述 CVE 编号: CVE-2026-31431 类型: 本地提权 / 容器逃逸 影响范围: 启用 CONFIGCRYPTOAUTHENC 的 Linux 内核（2017 年以来几乎所有主流发行版） 发现者: Xint Code 研究团队，Theo...