CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

EUVD-2026-75946

In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...

The vulnerability of the gf_isom_copy_sample_info() function in the isomedia/isom_write.c file of the GPAC multimedia platform allows a hacker to cause a service failure.

The vulnerability of the gfisomcopysampleinfo function in the isomedia/isomwrite.c file of the GPAC multimedia platform is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-81002: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

PT-2026-90132

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xdp convert zc to xdp frame function where an XSK packet is cloned into an order-0 page and incorrectly advertises PAGE SIZE as its frame size. This allows the...

PT-2026-96581

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsd copy file range samples dst-f wb err into "since" after the copy loop, then uses it to detect writeback errors via filemap check wb err once vfs fsync range returns...

PT-2026-96366

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD CANCEL path clp != NULL, manage cpntf state freed the target cpntf state without checking ownership. The lookup key st-si opaque.so id is allocated...

PT-2026-96406

In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copy file range' within the same filesystem: unreferenced object 0xffff88812192c980 size 32: com...

PT-2026-96439

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd file leak on inter-server COPY setup failure When nfsd4 setup inter ssc fails, nfsd4 copy returns nfserr offload denied directly, bypassing the out: label where release copy files would drop the nf dst reference...

PT-2026-90212

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.94 Description A memory leak exists in the ocfs2 component of the Linux kernel. This issue is triggered when performing a copy file range operation within the same filesystem. The leak occurs during copy-on-write...

PT-2026-90318

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the erofs component during the resizing of global buffers. The variable z erofs gbuf nrpages is only advanced after all global buffers have been grown. If a resize...

PT-2026-90203

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the openvswitch module where the queue userspace packet function incorrectly handles packet socket buffers skb. When an error occurs, the do execute actions function...

PT-2026-90428

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the nfsd4 ssc expire umount function when iterating through the nn-nfsd ssc mount list. The function drops the nfsd ssc lock to execute mntput on the source...

PT-2026-96597

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CB OFFLOAD after the worker kthread completes. When the post-copy vfs fsync range or...

PT-2026-90422

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd component where the write verifier is not rotated when an asynchronous COPY writeback fails. During an async COPY operation, the system captures the...

PT-2026-96373

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp convert zc to xdp frame clones an XSK packet into an order-0 page and advertises PAGE SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb shared info and...

CVE-2026-89706: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CBOFFLOAD after the worker kthread completes. When the post-copy vfsfsyncrange or...

CVE-2026-89680: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: label where releasecopyfiles would drop the nfdst reference taken by...

CVE-2026-89694: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...