CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...

CVE-2026-80537

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

CVE-2026-80537 xfs: fix off-by-one in rtrefcount btree root level validation

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

CVE-2026-80537 xfs: fix off-by-one in rtrefcount btree root level validation

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

CVE-2026-74743 macvlan: inherit needed_headroom and needed_tailroom from lowerdev

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit neededheadroom and neededtailroom from lowerdev macvlan devices inherit hardheaderlen from lowerdev during macvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying lowerdev requires...

CVE-2026-74744 ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit neededheadroom and neededtailroom from phydev ipvlan devices inherit hardheaderlen from phydev during ipvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying phydev or stacked lower...

CVE-2026-74739

CVE-2026-74739 is a slab-out-of-bounds read in the Linux kernel's net/sched cls_u32 traffic classification module. The root cause is in u32_bind_class(), which unconditionally casts a handle to tc_u_knode and dereferences &n->res; when the handle is actually a tc_u_hnode (hash table node with ...

CVE-2026-74739 net/sched: cls_u32: skip hash tables in u32_bind_class()

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: skip hash tables in u32bindclass u32walk enumerates both struct tcuhnode and struct tcuknode through the walker callback. u32bindclass unconditionally casts the passed fh to tcuknode and accesses &n-res, so whe...

CVE-2026-74739 net/sched: cls_u32: skip hash tables in u32_bind_class()

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: skip hash tables in u32bindclass u32walk enumerates both struct tcuhnode and struct tcuknode through the walker callback. u32bindclass unconditionally casts the passed fh to tcuknode and accesses &n-res, so whe...

kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. The rmif3amapgpios function incorrectly allocates memory for the gpiokeymap, making it smaller than required. This allows a device reporting a specific gpiocount value to trigger an out-of-bounds read, leading to information...

kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. The rmif3amapgpios function incorrectly allocates memory for the gpiokeymap, making it smaller than required. This allows a device reporting a specific gpiocount value to trigger an out-of-bounds read, leading to information...

K000163099: Linux kernel vulnerability CVE-2026-53253

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately and, for control packets, reads the control opcode and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098998)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098998 advisory. In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix middle attribute validation in pushnsh action The pushnsh action structure...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098763)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098763 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: use skbheaderpointercareful skbheaderpointer does not fully validate negative...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098939)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098939 advisory. In the Linux kernel, the following vulnerability has been resolved: hfs: validate record offset in hfsplusbmapalloc hfsplusbmapalloc can trigger a crash if a record...

PT-2026-82152

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system where the xlog recover do reg buffer function fails to properly validate the bounds of a buffer log item's dirty bitmap. During mount-time log...

PT-2026-82119

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-out-of-bounds read occurs in the tc cls bind class function. This happens because u32 bind class unconditionally casts a passed fh to tc u knode and accesses &n-res. When fh is...

PT-2026-82177

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the decode locker function within cls lock client.c contains three unsafe decode operations. A malicious or compromised OSD Object Storage Device in a multi-tenant...

PT-2026-82153

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the root level validation of the rtrefcount btree within the XFS file system. The functions xfs rtrefcountbt verify and xfs iformat rtrefcount incorrectly u...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099013)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099013 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete KASAN reproduces a slab-use-after-fr...