CVE-2026-80900

CVE-2026-80900 affects the Linux kernel 's ASoC SDCA (ALSA System on Chip, SDCA) component. The root cause is an UMP (Unified Multiplex Protocol) message size check that incorrectly passes when the message offset exceeds the buffer length, allowing invalid sizes to go undetected. The fix refactor...

CVE-2026-80891

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a...

CVE-2026-80891 KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a...

CVE-2026-80882 crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegraccmdoonereq...

CVE-2026-80882 crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegraccmdoonereq...

CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

EUVD-2026-71500

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

CVE-2026-80870

CVE-2026-80870 affects the Linux kernel component drm/amdkfd (AMD Kernel Fusion Driver). The vulnerability exists in the CRIU restore flow, where userspace-provided object IDs are passed to idr_alloc() without validation in kfd_criu_restore_event() and criu_restore_memory_of_gpu() . If a restored...

Exploit for Improper Validation of Consistency within Input in Linux Linux_Kernel

No d...

AZL-99510 CVE-2026-80807 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

AZL-99467 CVE-2026-80802 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdpncii2cread takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2cmasterrecv count into a...

CVE-2026-80782

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc-input if no input is claimed magicmouseinputmapping caches the first hidinput's inputdev in msc-input while the report descriptor is parsed, and the rest of the driver treats a non-NULL...

AZL-99600 CVE-2026-80782 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc-input if no input is claimed magicmouseinputmapping caches the first hidinput's inputdev in msc-input while the report descriptor is parsed, and the rest of the driver treats a non-NULL...

CVE-2026-80772

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses it, guarding the cast only with a 12-byte length check: if size = 12 /...

CVE-2026-80771

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set inputregisterdevice exposes the device to userspace immediately. In joyconinputcreate it was called before joyconconfigrumble configures the FFRUMBLE capability and...

CVE-2026-80844

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6rearrangerthdr assumes that segmentsleft is not larger than the number of addresses described by t...

CVE-2026-80839

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject unrepresentable multicast TVLV offsets The network and transport header fields in struct skbuff are 16-bit offsets from skb-head, and U16MAX is reserved as the unset transport header value. batadvtvlvcallhandle...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730

smol-toml , a lightweight TOML parser and serializer for JavaScript/TypeScript, is vulnerable to a Denial of Service via malformed TOML documents prior to version 1.7.1 . The root cause lies in src/util.ts, where skipUntil() calls indexOfNewline() and receives -1 at end-of-input, causing the curs...