PT-2026-90384

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the init nfsd function where nfsd debugfs init is executed before nfsd4 init slabs. If the slab allocation fails, the system returns a value that bypasses nfsd debugfs exi...

PT-2026-90461

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in debugfs where the lockdown check was not updated to include the mmap prepare file operation. This occurs because the relayfs was updated to use mmap prepare instead of...

CVE-2026-89668: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

PT-2026-90437

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rockchip-samsung-dcphy PHY driver where the max register is incorrectly defined as 0x10000. Since the PHY register block is 64KB with a register stride of 4, the...

CVE-2026-89721: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range maxregister The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. maxregister names 0x10000, one register past the end of...

PT-2026-90344

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the picolcd debug eeprom read function where it trusts a length byte provided by a device in its REPORT EE DATA reply. The function fails to verify this length against...

CVE-2026-89628: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

PT-2026-96388

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd debug eeprom read trusts resp-raw data2 -- a length byte supplied by the device in its REPORT EE DATA reply -- clamped only to the caller's read count: re...

SUSE CVE-2026-80764

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

AZL-99575 CVE-2026-80764 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80764 Bluetooth: hci_event: fix LE list UAF on reset

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

EUVD-2026-71407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80764

CVE-2026-80764 affects the Linux kernel Bluetooth subsystem. The vulnerability is a use-after-free (UAF) in the HCI event handler: hci_cc_reset() clears the LE accept and resolving lists without acquiring hdev->lock , while debugfs readers (e.g., white_list_show) hold that lock while traversin...

Linux Distros Unpatched Vulnerability : CVE-2026-80764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers...

Direct Rendering Infrastructure AMD Graphics Buffer Overflow

The vulnerability of the dpsdpmessagedebugfswrite function in the drivers/gpu/drm/amd/display/amdgpudm/amdgpudmdebugfs.c file of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to the copying of buffers without checking the size of the...

PT-2026-85605

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the Bluetooth component where the hci cc reset function clears the Low Energy LE accept and resolving lists without acquiring the hdev-lock. This lac...

PT-2026-91343

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci event: fix LE list UAF on reset hci cc reset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs reade...

CVE-2026-80764: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

SUSE CVE-2026-74348

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for lockingstate debugfs open debuglockresopen copies inode-iprivate into struct debuglockres and debuglockresrelease later drops that pointer with dlmput. That only works if open successfully pins the...

SUSE CVE-2026-74351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in lockingstate The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow. That is fine for the inli...