CVE-2026-80826 USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00addisourb When TD creation fails for the last packet of an isochronous URB, c67x00addisourb gives the URB back before updating the endpoint scheduling state. c67x00givebackurb frees the UR...

CVE-2026-80826

CVE-2026-80826 is a use-after-free in the Linux kernel's c67x00 USB driver , specifically in c67x00_add_iso_urb(). When TD creation fails for the last packet of an isochronous URB, the driver gives the URB back before updating the endpoint scheduling state. Since c67x00_giveback_urb() frees the U...

CVE-2026-80824 usb: usbfs: fix use-after-free of usb_device in usbdev_release()

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs, but that drain path reads back through the same object:...

CVE-2026-80824 usb: usbfs: fix use-after-free of usb_device in usbdev_release()

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs, but that drain path reads back through the same object:...

CVE-2026-80824

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs, but that drain path reads back through the same object:...

CVE-2026-80824

CVE-2026-80824 is a use-after-free in the Linux kernel's usbfs subsystem. In usbdev_release(), the reference to struct usb_device is dropped before draining completed async URBs; the drain path then dereferences the already-freed device via bus_to_hcd(ps->dev->bus) in dec_usb_memory_use_cou...

EUVD-2026-71274

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs, but that drain path reads back through the same object:...

CVE-2026-80818 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

CVE-2026-80818

CVE-2026-80818 is a use-after-free in the Linux kernel's iommu/tegra241-cmdqv driver. During a devres unwind (failed probe or unbind), the SMMU command queue is freed before arm_smmu_impl_remove() invokes tegra241_cmdqv_remove_vintf(), which issues a CMD_SYNC on the already-freed queue memory. Th...

CVE-2026-80818

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

EUVD-2026-71253

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

CVE-2026-80818 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

CVE-2026-80792 ipv6: fix use-after-free in ip6_finish_output2()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...

CVE-2026-80792

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...

CVE-2026-80792

CVE-2026-80792 is a use-after-free vulnerability in the Linux kernel 's IPv6 output path. In ip6_finish_output2(), a pointer to the IPv6 destination address (daddr ) is cached before calling lwtunnel_xmit(). Because the LWT-BPF transmit path or other encapsulation operations can reallocate the sk...

EUVD-2026-71435

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...

CVE-2026-80792 ipv6: fix use-after-free in ip6_finish_output2()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...

CVE-2026-80787

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: fix use-after-free in nvmetpciepfexeciodwork nvmetpciepfexeciodwork submits an I/O command with req-execute and then waits for the command to complete and transfers the data back to the host. This wait is not need...

CVE-2026-80787 nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: fix use-after-free in nvmetpciepfexeciodwork nvmetpciepfexeciodwork submits an I/O command with req-execute and then waits for the command to complete and transfers the data back to the host. This wait is not need...

CVE-2026-80787

CVE-2026-80787 is a use-after-free in the Linux kernel's nvmet_pci_epf module (NVMe Target over PCI Endpoint Function). After submitting an I/O command via req->execute(), the function nvmet_pci_epf_exec_iod_work() reads iod->data_len and iod->dma_dir to decide whether to wait for comple...