CVE-2026-80681

CVE-2026-80681 is a use-after-free vulnerability in the Linux kernel's VXLAN driver (vxlan_xmit). Before calling route_shortcircuit(), the ethernet header pointer is cached via eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() may reallocate skb->head, leaving the cached pointer refer...

CVE-2026-80680 i2c: amd-mp2: Unregister callback on adapter add failure

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amdmp2registercb stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2caddadapter fails, probe returns and devres...

CVE-2026-80680

CVE-2026-80680 is a use-after-free in the Linux kernel's amd-mp2 I2C platform driver. The function amd_mp2_register_cb() stores the platform I2C context pointer in the MP2 PCI driver's callback table before the I2C adapter is registered. If i2c_add_adapter() subsequently fails, the probe function...

CVE-2026-80681 vxlan: re-fetch eth header after route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80681 vxlan: re-fetch eth header after route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80680 i2c: amd-mp2: Unregister callback on adapter add failure

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amdmp2registercb stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2caddadapter fails, probe returns and devres...

EUVD-2026-67556

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amdmp2registercb stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2caddadapter fails, probe returns and devres...

EUVD-2026-67557

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80676

CVE-2026-80676 affects the Linux kernel Hyper-V vmbus driver. When a driver is probed via __driver_attach(), the bus match() callback is invoked without the device lock held, allowing an unlocked access to the driver_override field that can lead to a Use-After-Free (UAF) condition. The fix migrat...

EUVD-2026-67552

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: use generic driveroverride infrastructure When a driver is probed through driverattach, the bus' match callback is called without the device lock held, thus accessing the driveroverride field without a lock,...

CVE-2026-80676 Drivers: hv: vmbus: use generic driver_override infrastructure

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: use generic driveroverride infrastructure When a driver is probed through driverattach, the bus' match callback is called without the device lock held, thus accessing the driveroverride field without a lock,...

CVE-2026-80668 netfilter: nf_conntrack_expect: use conntrack GC to reap expectations

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker t...

EUVD-2026-67544

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker t...

CVE-2026-80668

A race condition in the Linux kernel's netfilter nf_conntrack_expect subsystem allows an expectation to access a stale exp->master pointer when expectation removal loses a race with an expiring timer (timer_del() reporting false). The fix replaces the timer-based expiration with the existing c...

CVE-2026-80661 ufs: core: tracing: Do not dereference pointers in TP_printk()

In the Linux kernel, the following vulnerability has been resolved: ufs: core: tracing: Do not dereference pointers in TPprintk The trace events in drivers/ufs/core/ufstrace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TPprintk the printing...

EUVD-2026-67537

In the Linux kernel, the following vulnerability has been resolved: ufs: core: tracing: Do not dereference pointers in TPprintk The trace events in drivers/ufs/core/ufstrace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TPprintk the printing...

CVE-2026-80661

CVE-2026-80661 affects the Linux kernel UFS tracing subsystem (drivers/ufs/core/ufs_trace.h). The root cause is an illegal pointer dereference in TP_printk(): the function reads the dev_name by dereferencing a saved hba pointer from the ring buffer, but TP_printk() executes when /sys/kernel/traci...

CVE-2026-80661 ufs: core: tracing: Do not dereference pointers in TP_printk()

In the Linux kernel, the following vulnerability has been resolved: ufs: core: tracing: Do not dereference pointers in TPprintk The trace events in drivers/ufs/core/ufstrace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TPprintk the printing...

EUVD-2026-67530

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

CVE-2026-80654 soc: xilinx: Shutdown and free rx mailbox channel

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...