CVE-2026-80918

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item-data.longdata instead of storing a value directly i...

CVE-2026-80906

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

CVE-2026-80883

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1xclientregister function is called just prior to register map initialization loop, making the device available to userspace. This m...

UBUNTU-CVE-2026-80866

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipcexitnet Blamed commit introduced a busy-wait loop in tipcexitnet to wait for pending UDP bearer cleanup works to complete: while atomicread&tn-wqcount condresched; This loop can busy-wait for a lon...

CVE-2026-80797

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: purge fragmented skbs during cleanup pn53xcommonclean purges respq before freeing the common PN533 state, but it leaves fragmentskb untouched. The fragmentation helpers queue transmit fragments there while sending lar...

UBUNTU-CVE-2026-80762

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...

Fedora 43 : kernel (2026-a7b1ccd14c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a7b1ccd14c advisory. The 7.1.13 stable kernel update contains a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: cifs: fixed potential OOPs in cifsoplockbreak With deferred close, there may be situations where closes cause races with lease breaks. Additionally, when checking whether to send the lease response, oplockresponse can lead to ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: fixed the issue with the netdevstartxmit trace event vs skbtransportoffset After the committed code, we must be more careful when using skbtransportoffset, as reminded by syzbot: WARNING: CPU: 0 PID: 10 at...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mlxsw: Minor fix for a potential memory leak in mlxswmlinecardsinit. The line cards array is not freed during the error path of mlxswmlinecardsinit, which could lead to a memory leak. This issue was addressed by freeing the array...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fixed a leak of kobject names for the sub-group spaceinfo. When the createspaceinfosubgroup function allocates elements of spaceinfo-subgroup, the kobjectinitandadd function is called for each element via...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: skmsg: Fixed the incorrect last sg check in skmsgrecvmsg. Also, one instance of a kernel NULL pointer dereferencing was fixed as follows: 224.462334 Call Trace: 224.462394 tcpbpfrecvmsg+0xd3/0x380 224.462441 ? sockhasperm+0x78/0x...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: powerpc/setmemory: Avoid spinlock recursion in changepageattr The commit 1f9ad21c3b38 “powerpc/mm: Implement setmemory routines” included a spinlock call in changepageattr in order to safely perform the three-step operations...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed the signedness bug in sdmav40processtrapirq The “instance” variable needs to be signed for error handling to work properly...

KVM: s390: pci: Fix handling of AIF enable without AISB

...

CVE-2026-68411 wifi: mac80211_hwsim: clamp virtio RX length before skb_put

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: clamp virtio RX length before skbput hwsimvirtiorxwork passes the virtqueue used-ring length reported by the device straight to skbput on a fixed-size receive skb. A backend reporting a length larger than the...

CVE-2026-68399 bpf: Fix UAF in sock clone early bailouts

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

CVE-2026-68391

CVE-2026-68391 affects the Linux kernel Bluetooth management path, specifically the mgmt_pending_cmds handling of hci_conn references. The issue is a Use-After-Free risk from dereferencing RCU-protected pointers outside critical sections and from using hci_conn in hci_sync callbacks without holdi...

EUVD-2026-55572

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68386

The CVE concerns the Linux kernel’s BPF sockmap path. It describes a vulnerability where unhashed UDP sockets accepted by sockmap can have their refcount incremented via a BPF lookup, and if the socket becomes bound, the subsequent bpf_sk_release() may skip decreasing the refcount, leading to a m...