CVE-2026-80717

CVE-2026-80717 is an information disclosure vulnerability in the Linux kernel SCTP subsystem. The root cause is that sctp_verify_param() accepts a header-only Adaptation Layer Indication parameter because the generic parameter walker only checks for header presence. sctp_process_param() then read...

CVE-2026-80716 ALSA: pcm: wake linked drain waiters on unlink

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink sndpcmdrain on a linked stream parks an on-stack wait entry on the drained peer's runtime-sleep, and after scheduletimeout removes it only if that peer is still found in the caller's...

EUVD-2026-67450

In the Linux kernel, the following vulnerability has been resolved: igc: remove napisynchronize in igcdown When an AFXDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igccleanrxirqzc then returns the full budget on every poll, so napicompletedone neve...

CVE-2026-80714 ipvs: do not propagate one-packet flag to synced conns

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ipvsbinddest copies connection flags from the destination into cp-flag...

CVE-2026-80714

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ipvsbinddest copies connection flags from the destination into cp-flag...

CVE-2026-80714

CVE-2026-80714 is a use-after-free in the Linux kernel's IPVS (IP Virtual Server) subsystem. The root cause is that ip_vs_bind_dest() propagates the IP_VS_CONN_F_ONE_PACKET flag from a destination to a synced connection that is already hashed. During expiry, the kernel then treats the synced conn...

EUVD-2026-67449

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ipvsbinddest copies connection flags from the destination into cp-flag...

CVE-2026-80715

In the Linux kernel, the following vulnerability has been resolved: igc: remove napisynchronize in igcdown When an AFXDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igccleanrxirqzc then returns the full budget on every poll, so napicompletedone neve...

CVE-2026-80715

In the Linux kernel igc (Intel Gigabit Ethernet controller) driver, an AF_XDP zero-copy application killed abruptly leaves NAPI polling in a stuck state: napi_complete_done() never clears NAPI_STATE_SCHED. Because igc_down() calls napi_synchronize() before napi_disable(), it spins indefinitely, c...

CVE-2026-80714 ipvs: do not propagate one-packet flag to synced conns

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ipvsbinddest copies connection flags from the destination into cp-flag...

CVE-2026-80715 igc: remove napi_synchronize() in igc_down()

In the Linux kernel, the following vulnerability has been resolved: igc: remove napisynchronize in igcdown When an AFXDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igccleanrxirqzc then returns the full budget on every poll, so napicompletedone neve...

CVE-2026-80713 io_uring: preserve task restrictions across exec

In the Linux kernel, the following vulnerability has been resolved: iouring: preserve task restrictions across exec Per-task restrictions apply to all rings created by a task. Once installed, they should not be dropped across exec. For a task that has used iouring, the exec cancellation path call...

CVE-2026-80713 io_uring: preserve task restrictions across exec

In the Linux kernel, the following vulnerability has been resolved: iouring: preserve task restrictions across exec Per-task restrictions apply to all rings created by a task. Once installed, they should not be dropped across exec. For a task that has used iouring, the exec cancellation path call...

CVE-2026-80713

In the Linux kernel, the following vulnerability has been resolved: iouring: preserve task restrictions across exec Per-task restrictions apply to all rings created by a task. Once installed, they should not be dropped across exec. For a task that has used iouring, the exec cancellation path call...

EUVD-2026-67448

In the Linux kernel, the following vulnerability has been resolved: iouring: preserve task restrictions across exec Per-task restrictions apply to all rings created by a task. Once installed, they should not be dropped across exec. For a task that has used iouring, the exec cancellation path call...

CVE-2026-80713

CVE-2026-80713 is a Linux kernel vulnerability in the io_uring subsystem. The root cause is that per-task io_uring restrictions are incorrectly released during the exec cancellation path : the function __io_uring_free() frees both the task context and the per-task restriction, so any ring created...

CVE-2026-80712

This vulnerability affects the Linux kernel's spi-qpic-snand driver (Qualcomm QPIC SPI-NAND controller). The root cause is an off-by-one in SET_FEATURE command handling : qcom_spi_send_cmdaddr() submits and executes the command immediately, but the feature value is only written to NAND_FLASH_FEAT...

CVE-2026-80712 spi: spi-qpic-snand: write the feature value before executing SET_FEATURE

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...

CVE-2026-80712

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...

CVE-2026-80712 spi: spi-qpic-snand: write the feature value before executing SET_FEATURE

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...