CVE-2026-81007 ipmi: ipmb: validate write message length

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

CVE-2026-81006

In the Linux kernel, the following vulnerability has been resolved: ipmi: Remove all sysfs files on registration failure ipmiaddsmi creates the nrusers and nrmsgs files before trying to create the maintenancemode file. If that last creation fails, the error path removes only nrusers before droppi...

CVE-2026-80983 net/smc: fix socket refcount leak in smc_switch_conns()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-80974

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix potential memory leaks during remove The memory allocated for struct sm501devdata in sm501pciprobe and sm501platprobe is not freed by the corresponding remove functions sm501pciremove and sm501platremove. Fix that...

CVE-2026-80954

In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev-desc in i3cdevicegetsupportedxfermode i3cdevicegetsupportedxfermode uses dev-desc to obtain the master controller. However, dev-desc must not be dereferenced unless bus-lock is held, and this...

CVE-2026-80954

CVE-2026-80954 affects the Linux kernel's i3c subsystem . The function i3c_device_get_supported_xfer_mode() dereferences dev->desc to obtain the master controller without holding bus->lock, creating a race condition that can lead to memory corruption , system instability, or denial of servi...

EUVD-2026-76277

In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev-desc in i3cdevicegetsupportedxfermode i3cdevicegetsupportedxfermode uses dev-desc to obtain the master controller. However, dev-desc must not be dereferenced unless bus-lock is held, and this...

PT-2026-90300

In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate use...

PT-2026-90462

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named data. Both are added to tr-hist vars by save hist...

PT-2026-90138

In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix use after free in icc get and of icc get by index In of icc get by index and icc get, if the dynamic allocation for path-name fails via kasprintf, the error handling path directly calls kfreepath to free the pat...

PT-2026-90464

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple ring buffer swap reader page starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful...

PT-2026-90136

In the Linux kernel, the following vulnerability has been resolved: ipmi: Remove all sysfs files on registration failure ipmi add smi creates the nr users and nr msgs files before trying to create the maintenance mode file. If that last creation fails, the error path removes only nr users before...

PT-2026-90359

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit del rule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree referenc...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107328)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107328 advisory. In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consistent use-after-fre...

kernel: net: guard timestamp cmsgs to real error queue skbs

A flaw was found in the Linux kernel's networking component. This vulnerability allows a remote attacker to potentially access sensitive information or cause system instability. By sending specially crafted network packets, an attacker can exploit an issue in how the kernel handles timestamping f...

kernel: tcp: call sk_data_ready() after listener migration

A flaw was found in the Linux kernel's TCP networking subsystem. When an established network connection is migrated between listener sockets within the same SOREUSEPORT group, applications waiting for new connections may not be properly notified. This can cause poll, epollwait, and blocking accep...

Oracle Linux 10 : ELSA-2026-64775-0: / kernel (ELSA-2026-647750)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-647750 advisory. - dm-verity: fix buffer overflow in FEC calculation Benjamin Marzinski RHEL-244969 CVE-2026-72098 - nvmet-rdma: handle inline data with a nonzero...

CVE-2026-80916

In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and race conditions on PREEMPTRT syzbot is reporting KCOV state corruption on PREEMPTRT kernels, for the temporary storage used for saving/restoring remote KCOV state is currently allocated as the per-CP...

CVE-2026-80915

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix DPT allocation paths. Remove the fallback for VRAM to system memory, I tested it and that doesn't work at all, only a black screen with pipe fault errors were observed. On systems with media GT, extra latency is added...

CVE-2026-80920

In the Linux kernel, the following vulnerability has been resolved: iouring: defer eventfd signaling when queued from a wakeup handler ioreqlocalworkadd signals the CQ ring eventfd inline when it is the one to push the first entry onto -worklist. For DEFERTASKRUN rings that add is frequently done...