EUVD-2026-76261

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615suspend acquired the mt76 mutex and then called canceldelayedworksync on macwork. mt7615macwork acquires the same mutex via mt7615mutexacquire at the top o...

CVE-2026-80938

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615suspend acquired the mt76 mutex and then called canceldelayedworksync on macwork. mt7615macwork acquires the same mutex via mt7615mutexacquire at the top o...

CVE-2026-80938 wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615suspend acquired the mt76 mutex and then called canceldelayedworksync on macwork. mt7615macwork acquires the same mutex via mt7615mutexacquire at the top o...

CVE-2026-80936

CVE-2026-80936 affects the mt7925 Wi-Fi driver in the Linux kernel (part of the mt76 subsystem). During multi-link power-save setup, the driver queues mlo_pm_work with a 5-second delay but never cancels it on the stop path. If the device is torn down within that window, the timer fires after tear...

CVE-2026-80936 wifi: mt76: mt7925: cancel mlo_pm_work on stop

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlopmwork on stop mt7925 queues mlopmwork with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives...

CVE-2026-80935

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935

CVE-2026-80935 affects the Linux kernel mt76 Wi-Fi driver for MediaTek MT7996 devices. The function mt7996_mcu_get_eeprom() uses a device-controlled 32-bit address (event->addr) as a destination offset into dev->mt76.eeprom.data without bounds-checking it, only clamping the copy length. A m...

AlmaLinux 10 : kernel (ALSA-2026:65334)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:65334 advisory. kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation CVE-2026-43133 kernel: Bluetooth: SMP: force responder MITM requirements before building...

PT-2026-90066

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlo pm work on stop mt7925 queues mlo pm work with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work...

PT-2026-90068

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615 suspend acquired the mt76 mutex and then called cancel delayed work sync on mac work. mt7615 mac work acquires the same mutex via mt7615 mutex acquire at...

PT-2026-90239

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlo pm work If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

RockyLinux 10 : kernel (RLSA-2026:65334)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65334 advisory. kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation CVE-2026-43133 kernel: Bluetooth: SMP: force responder MITM requirements before buildin...

Oracle Linux 10 : ELSA-2026-64775-0: / kernel (ELSA-2026-647750)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-647750 advisory. - dm-verity: fix buffer overflow in FEC calculation Benjamin Marzinski RHEL-244969 CVE-2026-72098 - nvmet-rdma: handle inline data with a nonzero...

CVE-2026-9216 Insufficient input validation vulnerability exists in certain NETGEAR RAX Models

An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access such as WiFi credentials to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does...

RHEL 10 : kernel (RHSA-2026:65334)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65334 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: nSVM: Always use vmcb01...

ALSA-2026:65334 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation CVE-2026-43133 kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response CVE-2026-43334 kernel...

CVE-2026-80825

CVE-2026-80825 affects the Linux kernel mt76 WiFi driver for mt7925 USB/SDIO devices (mt7925u). The function mt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and USB header onto every skb, assuming sufficient headroom is already present. This assumption holds for locally generated traffic ...

CVE-2026-80825

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated...

CVE-2026-80825 wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated...

Ubuntu 18.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-8715-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8715-1 advisory. Siebe Devroe, Hlose Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in...