CVE-2026-80724 ptp: vmclock: prevent read-only mappings from becoming writable

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclockmiscdevmmap rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VMMAYWRITE set. Userspace can map the page read-only and then...

CVE-2026-80723 of: reserved_mem: prevent OOB when too many dynamic regions are defined

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

CVE-2026-80723

CVE-2026-80723 affects the Linux kernel in the of: reserved_mem subsystem. During boot, the function fdt_scan_reserved_mem() stores each dynamically-placed /reserved-memory subnode into a local array of fixed size MAX_RESERVED_REGIONS. When the device tree defines more dynamically-placed regions ...

CVE-2026-80723 of: reserved_mem: prevent OOB when too many dynamic regions are defined

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

EUVD-2026-67458

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

CVE-2026-80722

CVE-2026-80722 is a Linux kernel vulnerability in the mac80211 WiFi subsystem's handling of S1G TWT (Target Wake Time) setup frames. The function ieee80211_process_rx_twt_action() only partially validates an incoming frame before queueing it, allowing an individual TWT agreement with a twt->le...

CVE-2026-80721

A dangling pointer vulnerability exists in the Linux kernel Bluetooth ISO (Isochronous) subsystem. After iso_conn_del() is called, ISO sockets may still dereference the hcon (HCI connection) pointer because clearing iso_conn::hcon previously relied on iso_conn_del() releasing the last reference t...

CVE-2026-80722 wifi: mac80211: validate individual TWT params before driver setup

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach...

CVE-2026-80722 wifi: mac80211: validate individual TWT params before driver setup

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach...

EUVD-2026-67457

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach...

CVE-2026-80721 Bluetooth: ISO: ensure no dangling hcon references in iso_conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...

EUVD-2026-67456

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...

CVE-2026-80721 Bluetooth: ISO: ensure no dangling hcon references in iso_conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...

EUVD-2026-67454

In the Linux kernel, the following vulnerability has been resolved: mm: mglru: fix stale batch updates after memcg reparenting The mglru page table walker batches per-generation size deltas in walk-nrpages while walking page tables without holding the lruvec lock. The resetbatchsize later folds...

CVE-2026-80720

CVE-2026-80720 affects the Linux kernel iomap subsystem (file ioend.c). The root cause is that iomap_split_ioend can split block I/O requests (bios) that were already allocated from the shared iomap_ioend_bioset, creating a deadlock when that bioset becomes exhausted. The fix introduces a separat...

CVE-2026-80719

CVE-2026-80719 affects the MGLRU (multi-gen LRU) memory management subsystem in the Linux kernel . A race condition exists between the mglru page table walker, which batches per-generation size deltas without holding the lruvec lock, and the memcg reparenting path. This can cause stale batch upda...

CVE-2026-80719 mm: mglru: fix stale batch updates after memcg reparenting

In the Linux kernel, the following vulnerability has been resolved: mm: mglru: fix stale batch updates after memcg reparenting The mglru page table walker batches per-generation size deltas in walk-nrpages while walking page tables without holding the lruvec lock. The resetbatchsize later folds...

CVE-2026-80720 iomap: add a separate bio_set for iomap_split_ioend

In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bioset for iomapsplitioend iomapsplitioend can split bios that already come from iomapioendbioset and thus deadlock when the bioset is exhausted. Add a separate bioset to avoid this deadlock. Christian Braun...

EUVD-2026-67455

In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bioset for iomapsplitioend iomapsplitioend can split bios that already come from iomapioendbioset and thus deadlock when the bioset is exhausted. Add a separate bioset to avoid this deadlock. Christian Braun...

CVE-2026-80720

In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bioset for iomapsplitioend iomapsplitioend can split bios that already come from iomapioendbioset and thus deadlock when the bioset is exhausted. Add a separate bioset to avoid this deadlock. Christian Braun...