CVE-2026-80656 hfsplus: Add a sanity check for btree node size

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted nodesize value of ...

EUVD-2026-67532

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted nodesize value of ...

CVE-2026-80656

CVE-2026-80656 is an uninitialized value vulnerability in the Linux kernel's hfsplus (HFS+) filesystem driver. During mounting of a crafted HFS+ image, a corrupted node_size value of 1 causes an excessively large rec_off argument to be passed to hfs_bnode_read_u16() within hfs_bnode_find(), leavi...

CVE-2026-80655

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent. However, the work structures zynqmppminitsuspendwork and...

CVE-2026-80655

In the Linux kernel , the zynqmp_power driver (Xilinx ZynqMP SoC) contained a race condition in event registration. The work structures used by suspend and subsystem-restart callbacks were allocated and initialized after the call to register_event(). If firmware triggered an event during this win...

CVE-2026-80655 soc: xilinx: Fix race condition in event registration

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent. However, the work structures zynqmppminitsuspendwork and...

CVE-2026-80654

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

EUVD-2026-67530

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

CVE-2026-80654

CVE-2026-80654 affects the soc: xilinx driver in the Linux kernel . A use-after-free occurs in the rx mailbox channel handling: an incorrect condition check in the remove callback prevents proper cleanup when rx_chan is non-NULL, leaving the mailbox channel active after device removal. The channe...

EUVD-2026-67531

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent. However, the work structures zynqmppminitsuspendwork and...

CVE-2026-80654 soc: xilinx: Shutdown and free rx mailbox channel

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

CVE-2026-80653

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Add slavedestroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at...

CVE-2026-80653 scsi: hisi_sas: Add slave_destroy interface for v3 hw

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Add slavedestroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at...

CVE-2026-80652 crypto: ccp - Treat zero-length cert chain as query for blob lengths

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80652

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

EUVD-2026-67529

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Add slavedestroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at...

CVE-2026-80653

CVE-2026-80653 is a Linux kernel vulnerability in the hisi_sas SCSI driver for v3 hardware. The root cause is a race condition: during SAS PHY link-up, link->status is set to DL_STATE_AVAILABLE in device_links_driver_bound; when a link reset of a remote PHY and rmmod of the SAS driver occur si...

CVE-2026-80652

CVE-2026-80652 affects the Linux kernel 's AMD SEV/CCP driver (drivers/crypto/ccp/sev-dev.c ). When handling a PDH export, a zero-length userspace cert chain buffer is not treated as a blob-length query, causing a BUG_ON() crash at arch/x86/mm/physaddr.c due to a physical-address lookup on ZERO_S...

EUVD-2026-67527

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...

CVE-2026-80651

CVE-2026-80651 is a NULL pointer dereference in the Linux kernel's drivers/crypto/ccp/sev-dev-tsm.c , specifically in the dsm_create() function. The function checks whether pdev->bus is NULL when computing segment_id, but immediately afterward unconditionally dereferences pdev->bus via pcie...