CVE-2026-80562

In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use rawspinlockt for the register lock iohirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger -...

CVE-2026-80555

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Free all memory if cpinit fails The routine cpfree is called to unpin/free any memory once an I/O is completed successfully, or if cpprefetch fails. But if cpinit fails, and cp-initialized is not enabled, the same...

CVE-2026-80552

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing...

CVE-2026-80550

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Fix out of bounds check on CCW array The routine ccwchaincalclength counts the number of channel command words CCWs that are chained together in a single channel program, and rejects anything larger than...

CVE-2026-80542

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpudmcrtcsetvblank amdgpudmcrtcsetvblank dereferences acrtcstate-stream when vblank is enabled/queried from DRMIOCTLMODECRTCGETSEQUENCE before a stream is attached to it. BUG:...

CVE-2026-80522

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx-cryptlen calculation in tegragcmdoonereq Perform rctx-cryptlen calculation in tegragcmdoonereq the same way it is done in tegraccmcryptinit. The current formulae may lead to a crash if a caller does not...

CVE-2026-74751

In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop loads one word ahead before checking the aligned boundary: REGL t1, SZREGt0 // load next word addi t0, t0, SZREG // advance orc.b t1, t1 bgeu...

CVE-2026-74749

In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension exittousermodeloop invokes rseqgranttimesliceextension with interrupts enabled. If the extension is granted it invokes hrtimerrearmdeferredtif to ensure that a pending...

CVE-2026-74744

In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit neededheadroom and neededtailroom from phydev ipvlan devices inherit hardheaderlen from phydev during ipvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying phydev or stacked lower...

CVE-2026-74736

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: reject dev-bound programs bound to a different device clsbpfprogfromefd obtained a SCHEDCLS program via bpfproggettypedev but never verified that a device-bound offloaded program's bound netdev matches the TC...

CVE-2026-58090

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

CVE-2026-58090 Use-after-free in unix SOCK_STREAM message handling

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

EUVD-2026-66235

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

CVE-2026-58090 Use-after-free in unix SOCK_STREAM message handling

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

CVE-2026-58090

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

CVE-2026-58090

The SOCK_STREAM receive path in the FreeBSD unix socket implementation contains a use-after-free vulnerability. The flaw occurs because the system fails to fully detach control messages from the socket buffer before processing them; specific error paths free these messages while leaving freed dat...

CVE-2026-58090: Use After Free

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

FreeBSD -- Use-after-free in unix SOCK_STREAM message handling

Problem Description: The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. Impact: An unprivileged loca...

EulerOS Virtualization 2.13.1 : haveged (EulerOS-SA-2026-3174)

According to the versions of the haveged packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In src/havegecmd.c, the sockethandler function performs a credential check on the abstract UNIX socket \0/sys/entropy/haveged...

FreeBSD Security Advisory - FreeBSD-SA-26:57.unix

FreeBSD Security Advisory - The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer...