PT-2026-90117

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTB transport layer where the ntb process tx function handles oversized buffers by calling tx handler with a NULL data pointer and returning success. This behavior...

AZL-99948 CVE-2026-80925 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vlan: fix skbunderpanic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload NETIFFHWVLANCTAGTX or NETIFFHWVLANSTAGTX on a lower device invokes vlantransferfeatures, which dynamically changed...

DEBIAN-CVE-2026-80925

In the Linux kernel, the following vulnerability has been resolved: vlan: fix skbunderpanic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload NETIFFHWVLANCTAGTX or NETIFFHWVLANSTAGTX on a lower device invokes vlantransferfeatures, which dynamically changed...

CVE-2026-80925

In the Linux kernel, the following vulnerability has been resolved: vlan: fix skbunderpanic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload NETIFFHWVLANCTAGTX or NETIFFHWVLANSTAGTX on a lower device invokes vlantransferfeatures, which dynamically changed...

EUVD-2026-75102

In the Linux kernel, the following vulnerability has been resolved: vlan: fix skbunderpanic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload NETIFFHWVLANCTAGTX or NETIFFHWVLANSTAGTX on a lower device invokes vlantransferfeatures, which dynamically changed...

CVE-2026-80925

CVE-2026-80925 affects the Linux kernel VLAN subsystem. Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(), which dynamically mutates vlandev->hard_header_len. Lockless TX paths (e.g., packet_snd, ip6_finish...

CVE-2026-80925 vlan: fix skb_under_panic and races when toggling HW VLAN offload

In the Linux kernel, the following vulnerability has been resolved: vlan: fix skbunderpanic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload NETIFFHWVLANCTAGTX or NETIFFHWVLANSTAGTX on a lower device invokes vlantransferfeatures, which dynamically changed...

PT-2026-89095

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A data race occurs when toggling hardware VLAN TX offload specifically NETIF F HW VLAN CTAG TX or NETIF F HW VLAN STAG TX on a lower device. This process invokes the vlan transfer featur...

SUSE CVE-2026-80779

In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...

EUVD-2026-71639

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix timer drain order, wakeup handling and txgen ordering This patch is a follow-up to commit cf070fe33bfb "can: isotp: serialize TX state transitions under so-rxlock" which addresses following sashiko-bot findings: -...

CVE-2026-80779

In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...

CVE-2026-80825 wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated...

EUVD-2026-71275

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated...

CVE-2026-80825

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated...

CVE-2026-80779

In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...

CVE-2026-80779 net/ionic: avoid OOB TX partner lookup for hwstamp RXQ

In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...

CVE-2026-80779 net/ionic: avoid OOB TX partner lookup for hwstamp RXQ

In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q-index equal to lif-ionic-nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using th...

PT-2026-86180

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ISO Transport ISOTP implementation for CAN bus. The problem involves incorrect timer drain order, improper wakeup handling, and issues with tx gen ordering...

Linux Distros Unpatched Vulnerability : CVE-2026-80737

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running callback, so the TX callback can still touch the TX buffer after ...

PT-2026-91303

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX RING free until skbs finish AF PACKET TX RING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pg vec is freed, but they do not preserve a...