CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

CVE-2026-80869 ntfs: bound the attribute-list entry in ntfs_read_inode_mount()

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the attribute-list entry in ntfsreadinodemount The $MFT attribute-list walk in ntfsreadinodemount validates each entry only with "u8 alentry + 6 alend" and "u8 alentry + le16tocpualentry-length alend", but then reads...

CVE-2026-80868 ntfs3: Allocate iomap inline_data using alloc_page

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Allocate iomap inlinedata using allocpage This fixes a BUG reported in iomapwriteendinline: iomapinlinedatavalid checks that the inlinedata fits within a page. If the inlinedata is allocated with kmemdup there's no guarant...

CVE-2026-80867 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()

In the Linux kernel, the following vulnerability has been resolved: alpha/PCI: Add securitylockeddown check to pcimmapresource Currently, Alpha's pcimmapresource does not check securitylockeddownLOCKDOWNPCIACCESS before allowing userspace to mmap PCI BARs. The generic version has had this check...

CVE-2026-80866 tipc: avoid busy looping in tipc_exit_net()

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipcexitnet Blamed commit introduced a busy-wait loop in tipcexitnet to wait for pending UDP bearer cleanup works to complete: while atomicread&tn-wqcount condresched; This loop can busy-wait for a lon...

CVE-2026-80865 bpf: Add missing access_ok call to copy_user_syms

In the Linux kernel, the following vulnerability has been resolved: bpf: Add missing accessok call to copyusersyms As reported by sashiko we use getuser without prior accessok call on the user space pointer. Adding the missing call for the whole pointer array. Plus removing the err check in the...

CVE-2026-84961

CVE-2026-84961 affects undici , the Node.js HTTP client library. The BalancedPool constructor passes its entire options object through an internal JSON deep-clone , which silently discards any function-valued TLS options (e.g., a custom checkServerIdentity callback or a custom connector in the co...

CVE-2026-84961

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

EUVD-2026-71494

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-84961 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-84961 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-84961 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

Exploit for CVE-2026-11613

CVE-2026-11613 — Divi Ajax Filter RCE | | | |---|---| | Plug...

authelia v4.39.22

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for your applications via a web portal. It acts as a companion for reverse proxies by allowing, denying, or redirecting requests. Documentation is available at...

DEBIAN-CVE-2026-80775

In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm-futex.phash.ref allocation futexhashallocate allocates mm-futex.phash.ref without any locking. Commit d9b05321e21e "futex: Move futexhashfree back to mmput" moved the allocation here and assumed...

CVE-2026-80775

In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm-futex.phash.ref allocation futexhashallocate allocates mm-futex.phash.ref without any locking. Commit d9b05321e21e "futex: Move futexhashfree back to mmput" moved the allocation here and assumed...

CVE-2026-80864 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IBQPMAXDESTRDATOMIC modifyqp rxeqpfromattr handles IBQPMAXDESTRDATOMIC outside the IBQPSTATE path, so it holds no statelock and runs while the responder task rxereceiver recvtask on rxewq is live. A...

CVE-2026-80863 RDMA/rxe: Fix OOB in free_rd_atomic_resources()

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in freerdatomicresources freerdatomicresources iterates using qp-attr.maxdestrdatomic. Updating maxdestrdatomic before freeing the old array can make the free path walk past the old allocation and trigger a slab...

CVE-2026-80862 nvme-tcp: fix usage of page_frag_cache

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of pagefragcache nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe...

CVE-2026-80861 usb: xhci: bail out of setup if the controller is inaccessible

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhcigensetup locates the operational registers using the capability length read from the very first register: xhci-opregs = hcd-regs +...