CVE-2026-80647

CVE-2026-80647 affects the Linux kernel's RDMA/hns driver (specifically the hns_roce_hw_v2 module). The root cause is that Completion Queues (CQs) allocated via ib_alloc_cq() always carry a comp_handler, which is never expected to be invoked in direct mode . However, when the driver is reset, the...

CVE-2026-80647

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix warning in poll cq direct mode CQs allocated by iballoccq always have a comphandler. Though in direct mode this handler is never expected to be called, it is still called when the driver is reset, triggering the...

EUVD-2026-67523

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix warning in poll cq direct mode CQs allocated by iballoccq always have a comphandler. Though in direct mode this handler is never expected to be called, it is still called when the driver is reset, triggering the...

CVE-2026-80608 accel/amdxdna: Fix iommu domain lifetime race during device removal

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix iommu domain lifetime race during device removal When forceiova mode is enabled, amdxdnaremove frees xdna-domain. If amdxdnagemobjfree is called after device removal, it may attempt to access xdna-domain,...

CVE-2026-80606 drm/xe/userptr: Hold notifier_lock for write on inject test path

In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifierlock for write on inject test path When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit runs vmacheckuserptr with the svm notifierlock taken for read. The test injection causes vmacheckuserpt...

CVE-2026-80606

This Linux kernel vulnerability affects the DRM/xe userptr subsystem. When built with CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y (a test/debug option), xe_pt_svm_userptr_pre_commit() acquires the SVM notifier_lock for read, but the injection path eventually calls drm_gpusvm_unmap_pages() which asserts ...

CVE-2026-80606 drm/xe/userptr: Hold notifier_lock for write on inject test path

In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifierlock for write on inject test path When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit runs vmacheckuserptr with the svm notifierlock taken for read. The test injection causes vmacheckuserpt...

CVE-2026-80712: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...

PT-2026-82906

In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifier lock for write on inject test path When CONFIG DRM XE USERPTR INVAL INJECT=y, xe pt svm userptr pre commit runs vma check userptr with the svm notifier lock taken for read. The test injection causes...

PT-2026-82947

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix warning in poll cq direct mode CQs allocated by ib alloc cq always have a comp handler. Though in direct mode this handler is never expected to be called, it is still called when the driver is reset, triggering the...

The vulnerability of the User-Mode Power Service (UMPS) in Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the User-Mode Power Service UMPS in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2026-83012

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SET FEATURE qcom spi send cmdaddr programs NAND FLASH CMD/NAND EXEC CMD and submits the descriptors, which makes the controller execute the command immediately. For...

CVE-2026-18374

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

AZL-98042 CVE-2026-18374 affecting package glibc 2.38-21

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

CVE-2026-18374

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

UBUNTU-CVE-2026-18374

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

CVE-2026-18374

CVE-2026-18374 affects the GNU C Library (glibc) version 2.45 or earlier . The vulnerability is a heap buffer overflow in the fopen function triggered by passing an effectively empty string to the ,ccs= syntax extension of the mode argument, when that input is attacker-controlled. The CVSS 3.1 sc...

CVE-2026-18374

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

EUVD-2026-67222

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

CVE-2026-18374

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...