CVE-2026-80648

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

CVE-2026-80689

In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmiotracearray in logging functions mmiotracerw and mmiotracemapping retrieve mmiotracearray into tr and pass it to tracemmiotracerw and tracemmiotracemap. If these functions are invoked whil...

UBUNTU-CVE-2026-80655

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent. However, the work structures zynqmppminitsuspendwork and...

UBUNTU-CVE-2026-80697

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid fpath for page cache sharing Previously, backing files for page cache sharing were set up with fpath left as NULL only finode was valid. It worked, but a recent mincore fix relies on fpath.mnt and crashes foun...

UBUNTU-CVE-2026-80658

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Fix null-ptr-deref in dwdpremove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

UBUNTU-CVE-2026-80648

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

CVE-2026-80651

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...

CVE-2026-80614

In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emacprobe Move devmrequestirq after devmplatformioremapresource so that dev-emacp is mapped before the interrupt handler can fire. An early interrupt hitting emacirq would dereference th...

CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

CVE-2026-80701

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

CVE-2026-80691

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

CVE-2026-80697

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid fpath for page cache sharing Previously, backing files for page cache sharing were set up with fpath left as NULL only finode was valid. It worked, but a recent mincore fix relies on fpath.mnt and crashes foun...

CVE-2026-80684

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...

UBUNTU-CVE-2026-80651

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...

UBUNTU-CVE-2026-80679

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasdreleasespace checks the implementation of the isese discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND...

UBUNTU-CVE-2026-80689

In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmiotracearray in logging functions mmiotracerw and mmiotracemapping retrieve mmiotracearray into tr and pass it to tracemmiotracerw and tracemmiotracemap. If these functions are invoked whil...

UBUNTU-CVE-2026-80690

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

UBUNTU-CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

UBUNTU-CVE-2026-80678

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

CVE-2026-80704

CVE-2026-80704 is a NULL pointer dereference in the Linux kernel's DRM AMD display driver. The function get_ss_info_from_atombios() accessed calc_pll_cs->ctx->logger before calc_pll_cs->ctx was initialized in calc_pll_max_vco_construct(), causing a crash during early driver construction....