CVE-2026-80866

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipcexitnet Blamed commit introduced a busy-wait loop in tipcexitnet to wait for pending UDP bearer cleanup works to complete: while atomicread&tn-wqcount condresched; This loop can busy-wait for a lon...

CVE-2026-80891

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a...

CVE-2026-80878 afs: Fix leak of ungot volume

In the Linux kernel, the following vulnerability has been resolved: afs: Fix leak of ungot volume Fix afslookupvolumercu so that it doesn't leak a dying volume if afstrygetvolume fails...

CVE-2026-80866 tipc: avoid busy looping in tipc_exit_net()

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipcexitnet Blamed commit introduced a busy-wait loop in tipcexitnet to wait for pending UDP bearer cleanup works to complete: while atomicread&tn-wqcount condresched; This loop can busy-wait for a lon...

EUVD-2026-71495

In the Linux kernel, the following vulnerability has been resolved: bpf: Add missing accessok call to copyusersyms As reported by sashiko we use getuser without prior accessok call on the user space pointer. Adding the missing call for the whole pointer array. Plus removing the err check in the...

CVE-2026-80855

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on open OTRUNC DAX failure fuseopen takes filemapinvalidatelock for a DAX truncate daxtruncate = true and releases it before the outinodeunlock label. But when fusedaxbreaklayouts fails, the goto...

AZL-99564 CVE-2026-80848 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race condition during close for espintcp sockets: espintcpclose frees emsg-skb via kfreeskb without holding any socket lock. Concurrently, the xfrmtransreinject wor...

CVE-2026-80824

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs, but that drain path reads back through the same object:...

CVE-2026-80837

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: don't queue packet path object notifications All file:line references below are against v7.2-rc4 ac5b0e5651b1. The trace was captured on 7.2.0-rc6-kasan72rc6 075b74841bd0, where the same lines apply...

CVE-2026-80833

In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Remove cryptorng interface Since the cryptorng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go...

CVE-2026-80817

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix NULL pointer deref in iommufdioaschangeprocess when racing with ioptmapfilepages iommufdioaschangeprocess iterates every IOAS area while only holding every IOAS iovarwsem, so it assumes every area has a non-NUL...

CVE-2026-80829

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput sndusbmidinovationoutput lays out a two-byte header at transferbuffer0..1 and passes &transferbuffer2 together with a length of ep-maxtransfer - 2 to sndrawmiditransmit:...

CVE-2026-80857

In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FRFINISHED on abortonkill to prevent use-after-free The abortonkill path in requestwaitanswer calls fuseabortconn and returns without waiting for FRFINISHED. If fusedevdowrite is concurrently processing the same...

CVE-2026-80821

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on createcq mapping failure nvmetpciepfcreatecq calls nvmetcqcreate, which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or...

CVE-2026-80863

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in freerdatomicresources freerdatomicresources iterates using qp-attr.maxdestrdatomic. Updating maxdestrdatomic before freeing the old array can make the free path walk past the old allocation and trigger a slab...

UBUNTU-CVE-2026-80760

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

CVE-2026-80856

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on setattr writeback failure fusedosetattr takes filemapinvalidatelock for a DAX truncate faultblocked = true and releases it at the out:/error: labels. But when a writeback flush is also needed, a...

CVE-2026-80813

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmetexecuteidentifynslist is called with matchcss set...

CVE-2026-80835

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Remove cryptorng interface qcom-rng.c exposes the same hardware through two completely separate interfaces, cryptorng and hwrng. However, the implementation of this is buggy because it permits generation...

CVE-2026-80809

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix missing metadata reservation for large xattrs BUG lsetxattr panics the kernel when setting a large xattr value on a fragmented filesystem where the file already has an external xattr block. CAUSE ocfs2calcxattrsetneed...