CVE-2026-80981

CVE-2026-80981 is a use-after-free in the Linux kernel's net/smc (Scalable Multiconnect) networking component, specifically in smc_llc_srv_add_link(). The function retains a pointer (add_llc) into an LLC queue entry, then frees that entry via smc_llc_flow_qentry_del(), and subsequently dereferenc...

EUVD-2026-76304

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink smcllcsrvaddlink keeps addllc pointing into the queue entry: addllc = &qentry-msg.addlink; smcllc.c:1482 ... smcllcsaveaddlinkinfolinknew, addllc; smcllc.c:1494...

CVE-2026-80976

CVE-2026-80976 is a Linux kernel vulnerability in the seg6 (SRv6) decapsulation path . After decap_and_validate() strips outer Segment Routing headers, the IPv6 control block (IP6CB) retains a stale nhoff offset from the outer packet. When the inner IPv6 packet is delivered via ip6_protocol_deliv...

CVE-2026-80976 seg6: reset IP6CB after IPv6 decapsulation

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decapandvalidate pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet,...

EUVD-2026-76299

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decapandvalidate pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet,...

CVE-2026-80973

CVE-2026-80973 affects the Linux kernel's ALSA snd_usb_6fire driver. In usb6fire_comm_receiver_handler(), a MIDI event length byte supplied by the USB device is used without bounding it or checking urb->actual_length. The receiver_buffer is a 64-byte allocation (2-byte header + 62 usable bytes...

CVE-2026-80973 ALSA: 6fire: bound the MIDI event length from the device

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

CVE-2026-80946 fuse: copy request headers via a stack buffer for io-uring

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

EUVD-2026-76269

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

CVE-2026-80946

This Linux kernel vulnerability affects the FUSE-io-uring transport. The fuse_request slab cache (fuse_req_cachep) is created without a usercopy whitelist , so directly copying req->in.h to the ring or req->out.h back from the ring trips CONFIG_HARDENED_USERCOPY , triggering a kernel panic ...

CVE-2026-80946 fuse: copy request headers via a stack buffer for io-uring

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

PT-2026-90368

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get name ceph get name copies the MDS-supplied name into the caller's NAME MAX-sized buffer with memcpyname, rinfo-dname, rinfo-dname len and then writes namerinfo-dname len = 0...

PT-2026-90204

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs mutex. The CT limit pointer was neither removed from readers nor protected by a...

PT-2026-90470

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walk pmd range If -pmd entry sets walk-action = ACTION AGAIN, the pmd none check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk-ops-install pte is...

PT-2026-90138

In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix use after free in icc get and of icc get by index In of icc get by index and icc get, if the dynamic allocation for path-name fails via kasprintf, the error handling path directly calls kfreepath to free the pat...

PT-2026-90240

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl cfg80211 connect event subtracts fixed IE offsets from assoc req len -= 4 and assoc resp len -= 6, both u8, with no lower bound. The aggregat...

PT-2026-90116

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has max recv sge == 1 there is no shared v2 receive buffer, and smc llc save add link rkeys takes the v2 extension from 44 bytes past the start of...

PT-2026-90372

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush decode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucke...

PT-2026-90384

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsd debugfs init after nfsd4 init slabs in init nfsd nfsd debugfs init runs before nfsd4 init slabs in init nfsd. If the slab allocation fails, the bare "return retval" bypasses nfsd debugfs exit, leaving orphan debug...

PT-2026-90285

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm security cfm looks up a session on session list and then walks its DLC list without holding rfcomm mutex. Since RFCOMM session teardown uses rfcomm mutex, krfcomm...