CVE-2026-80862

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of pagefragcache nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe...

CVE-2026-80860

In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 "fuse: clear intrentry in fuseresend and fuseremovependingreq" the WARNON!listempty&req-intrentry in fuserequestfree still triggers due to the following race: ...

CVE-2026-80835

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Remove cryptorng interface qcom-rng.c exposes the same hardware through two completely separate interfaces, cryptorng and hwrng. However, the implementation of this is buggy because it permits generation...

CVE-2026-80792

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...

CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-80854

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: keep port count until LUN teardown completes tcmusbgdropnexus permits session removal once tpgportcount reaches zero. However, usbgportunlink currently decrements that count from the fabricpreunlink callback,...

CVE-2026-80764

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80858

In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuseuringcreatequeue initializes a fuseringqueue and then publishes the pointer into ring-queuesqid with WRITEONCE under the fch-lock. There are several readers that may...

UBUNTU-CVE-2026-80773

In the Linux kernel, the following vulnerability has been resolved: HID: huawei: fix missing hidisusb check tousbinterface can only be used on a hiddevice whose parent is really USB; uhid can create devices that identify as being on BUSUSB, but don't actually have a USB parent. Fix the use of...

CVE-2026-80826

In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00addisourb When TD creation fails for the last packet of an isochronous URB, c67x00addisourb gives the URB back before updating the endpoint scheduling state. c67x00givebackurb frees the UR...

CVE-2026-80811

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

CVE-2026-80799

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlvarraylen is u16. When TLV data...

CVE-2026-80840

In the Linux kernel, the following vulnerability has been resolved: ipv6: seg6: clear IPv4 control block on IPIP decapsulation End.DX4 and End.DT4 decapsulate an IPv4 packet through decapandvalidate and send it directly to IPv4 routing. The inner packet therefore bypasses iprcvcore, which normall...

CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80842

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. That is the teardown handshake:...

CVE-2026-80786

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

CVE-2026-80864

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IBQPMAXDESTRDATOMIC modifyqp rxeqpfromattr handles IBQPMAXDESTRDATOMIC outside the IBQPSTATE path, so it holds no statelock and runs while the responder task rxereceiver recvtask on rxewq is live. A...

CVE-2026-80770

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO before hidhwstop on probe failure nintendohidprobe calls hiddeviceiostart before joyconinit and joyconledscreate. If either fails, the error path jumps to errclose which calls hidhwclose/hidhwstop...

UBUNTU-CVE-2026-80837

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: don't queue packet path object notifications All file:line references below are against v7.2-rc4 ac5b0e5651b1. The trace was captured on 7.2.0-rc6-kasan72rc6 075b74841bd0, where the same lines apply...

CVE-2026-80844

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6rearrangerthdr assumes that segmentsleft is not larger than the number of addresses described by t...