Exploit for CVE-2026-19914

cve-id Donate Help maintain this project...

CVE-2026-80589 block: stop the timeout timer when releasing a never added disk

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk diskrelease undoes blkmqinitallocatedqueue for a disk whose probe failed before adddisk, but it only calls blkmqexitqueue. Nothing there stops q-timeout, and that...

CVE-2026-80588 mptcp: reclaim forward-allocated memory on RX path errors

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...

CVE-2026-80587 mptcp: avoid combining some incoming suboptions

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's speciall...

CVE-2026-80586 mptcp: options: reset DSS fields in case of unexpected size

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some...

CVE-2026-80584 s390/qeth: validate user buffer length in SNMP and ARP query ioctls

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatalen without checking a lower bound, then set udataoffset to a fixed...

CVE-2026-80585 mptcp: fastopen: only mark MPTFO subflows with SYN data

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty...

CVE-2026-80583 ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but txmacrodecmodeget and txmacrodecmodeput access their value through ucontrol-value.integer.value0 a long instead ...

CVE-2026-80582 drm/shmem_helper: Check VMA boundaries for PMD mappings

In the Linux kernel, the following vulnerability has been resolved: drm/shmemhelper: Check VMA boundaries for PMD mappings In the -hugefault handler do not install a PMD huge page mapping if the huge page exceeds the boundaries of the VMA. All other -hugefault handlers have similar checks and the...

CVE-2026-80581 ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Ignore IPC errors for pipeline state change if the firmware state is crashed or the IPC has timed out. If the firmware has crashed the kernel still needs t...

CVE-2026-80580 fbdev: bound mode sysfs output to the sysfs buffer

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-80579 fbdev: clear fb_info->mode before deleting a videomode

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...

CVE-2026-80577 drm/panthor: skip zero-sized firmware sections

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthorfwloadsectionentry skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section-mem is left as NULL. Later...

CVE-2026-80578 fbdev: core: Fix pointer desynchronization in fb_io_read()

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...

CVE-2026-80576 drm/amdgpu: reject oversized IBs with per-ring packet limits

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

CVE-2026-80574 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

CVE-2026-80575 Input: cs40l50-vibra - validate custom data from user space

In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50add copies the custom data of an FFPERIODIC/FFCUSTOM effect straight from the ffeffect the user passed to EVIOCSFF, without requiring it to hold anything:...

CVE-2026-80573 Input: iforce - validate input packet lengths

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

CVE-2026-80572 Input: byd - synchronize timer deletion before freeing private data

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byddisconnect uses timerdelete before freeing the driver's private data. This does not wait for a running bydcleartouch callback, which dereferences the private...

CVE-2026-80571 powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...