4366 matches found
UBUNTU-CVE-2026-80950
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...
CVE-2026-80975
In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...
CVE-2026-80950
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...
AZL-100532 CVE-2026-80930 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...
DEBIAN-CVE-2026-80930
In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...
CVE-2026-80930
In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...
CVE-2026-80930
In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...
UBUNTU-CVE-2026-80930
In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...
CVE-2026-80975 mfd: qnap-mcu: keep the reply buffer alive past a command timeout
In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...
CVE-2026-80975
In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...
CVE-2026-80975
CVE-2026-80975 is a use-after-free vulnerability in the Linux kernel's qnap-mcu MFD driver. When a command times out or a write fails, qnap_mcu_exec() returns while reply->data still points to its own stack frame. A late MCU reply or unsolicited message written by the serdev receive path then ...
CVE-2026-80975 mfd: qnap-mcu: keep the reply buffer alive past a command timeout
In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...
EUVD-2026-76298
In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...
EUVD-2026-76273
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...
CVE-2026-80950
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...
CVE-2026-80950
A use-after-free vulnerability exists in the Linux kernel's Renesas I3C driver . The driver uses an asynchronous data-transfer model: it enqueues a transfer struct and waits for completion. If a transfer times out , the waiting thread frees the struct. If an interrupt then fires, the interrupt ha...
CVE-2026-80930 tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...
EUVD-2026-76253
In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...
CVE-2026-80930
CVE-2026-80930 affects the Linux kernel 's tpm_i2c_nuvoton driver (Nuvoton TPM over I2C). The root cause is in i2c_nuvoton_wait_for_stat(), which enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out or is interrupted before the handler runs, th...
CVE-2026-80930 tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...