CVE-2026-80553 s390/vfio_ccw: Cancel existing workqueues

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Cancel existing workqueues The initialization of the iowork and crwwork workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in releasedev to ensure work isn't...

CVE-2026-80553 s390/vfio_ccw: Cancel existing workqueues

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Cancel existing workqueues The initialization of the iowork and crwwork workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in releasedev to ensure work isn't...

CVE-2026-80531

CVE-2026-80531 is a Use-After-Free (UAF) in the XFS filesystem component of the Linux kernel, specifically in xrep_tempfile_create on the sc->tempip pointer. The UAF occurs when temporary file creation code fails after sc->tempip has been assigned, leading to a use of freed memory. Red Hat ...

CVE-2026-80531 xfs: avoid UAF on sc->tempip in xrep_tempfile_create

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

CVE-2026-80531 xfs: avoid UAF on sc->tempip in xrep_tempfile_create

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

CVE-2026-80521

CVE-2026-80521 is a use-after-free in the Linux kernel's af_unix subsystem, specifically in the garbage collection (GC) logic for strongly connected components (SCC). A race in unix_del_edge() allows the GC to free a dead SCC partially when a concurrent send() of a socket and close() of other soc...

CVE-2026-80521 af_unix: Unlink scc_entry in unix_del_edge().

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-80519 ovpn: finish crypto callback cleanup before peer release

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration a...

CVE-2026-80519 ovpn: finish crypto callback cleanup before peer release

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration a...

CVE-2026-80519

CVE-2026-80519 affects the Linux kernel OpenVPN module (ovpn) due to an incorrect ordering of reference cleanup in crypto completion callbacks. Specifically, the peer reference (which pins the netdev) is dropped before the callback finishes its own cleanup, allowing ovpn_crypto_key_slot_put to sc...

CVE-2026-74753 perf: Reject exited events as group leaders

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perfeventopen...

CVE-2026-74753 perf: Reject exited events as group leaders

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perfeventopen...

CVE-2026-74753

This use-after-free vulnerability in the Linux kernel's perf subsystem occurs because perf_event_open() accepts events in the EXIT state as group leaders, rejecting only REVOKED and DEAD events. After perf_event_remove_on_exec() detaches group relationships, a new sibling can be linked to the det...

CVE-2026-74746 netfilter: flowtable: publish GC-visible tuple last

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd is still...

CVE-2026-74746

CVE-2026-74746 is a slab-use-after-free vulnerability in the Linux kernel netfilter flowtable subsystem. The root cause lies in nf_flow_table_iterate(), which treats only original-direction tuple nodes as owning entries. When the original node is published first, the garbage collector can observe...

CVE-2026-74746 netfilter: flowtable: publish GC-visible tuple last

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd is still...

CVE-2026-74743 macvlan: inherit needed_headroom and needed_tailroom from lowerdev

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit neededheadroom and neededtailroom from lowerdev macvlan devices inherit hardheaderlen from lowerdev during macvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying lowerdev requires...

CVE-2026-74743

CVE-2026-74743 affects the Linux kernel's macvlan network driver. Macvlan devices inherit hard_header_len from the underlying device during initialization but leave needed_headroom and needed_tailroom set to zero. When the lower device requires extra headroom or tailroom (e.g., macsec , ipsec , w...

CVE-2026-74744 ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit neededheadroom and neededtailroom from phydev ipvlan devices inherit hardheaderlen from phydev during ipvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying phydev or stacked lower...

CVE-2026-74744

CVE-2026-74744 affects the Linux kernel ipvlan subsystem. During ipvlan_init(), ipvlan devices inherit hard_header_len from the physical device but leave needed_headroom and needed_tailroom set to zero. When the underlying device requires extra space for headers or trailers (e.g., macsec, ipsec, ...