CVE-2026-80672 ntfs: fix u16 truncation of restart-area length check

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80673

Linux kernel NTFS driver contains a slab out-of-bounds read in ntfs_external_attr_find(). When resolving an attribute lookup with a non-zero @lowest_vcn, the function reads lowest_vcn (offset 8) and name_offset from the next $ATTRIBUTE_LIST entry without full bounds validation, allowing a crafted...

EUVD-2026-67549

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfsexternalattrfind When resolving an attribute lookup with a non-zero @lowestvcn, ntfsexternalattrfind peeks at the next $ATTRIBUTELIST entry to decide whether to keep searchin...

CVE-2026-80673

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfsexternalattrfind When resolving an attribute lookup with a non-zero @lowestvcn, ntfsexternalattrfind peeks at the next $ATTRIBUTELIST entry to decide whether to keep searchin...

CVE-2026-80673 ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfsexternalattrfind When resolving an attribute lookup with a non-zero @lowestvcn, ntfsexternalattrfind peeks at the next $ATTRIBUTELIST entry to decide whether to keep searchin...

EUVD-2026-67547

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

CVE-2026-80671 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

CVE-2026-80670 perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perfenvgetcputopology in machineresolve machineresolve accesses env-cpual-cpu.socketid after checking al-cpu = 0 and env-cpu != NULL, but without validating al-cpu against env-nrcpusavail. Since al-cpu comes from...

EUVD-2026-67546

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perfenvgetcputopology in machineresolve machineresolve accesses env-cpual-cpu.socketid after checking al-cpu = 0 and env-cpu != NULL, but without validating al-cpu against env-nrcpusavail. Since al-cpu comes from...

CVE-2026-80671

CVE-2026-80671 affects the Linux kernel 's perf sched subsystem, specifically the register_pid() function. When processing untrusted perf.data input, four issues exist: an integer overflow in the allocation size calculation on 32-bit systems, a heap buffer overflow via unbounded strcpy into a fix...

CVE-2026-80671

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

CVE-2026-80671 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

CVE-2026-80670

CVE-2026-80670 affects the Linux kernel perf tools subsystem. The function machine__resolve() accesses env->cpu[al->cpu].socket_id after validating al->cpu >= 0 and env->cpu != NULL, but fails to validate al->cpu against env->nr_cpus_avail. Because al->cpu originates from ...

EUVD-2026-67545

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669

This Linux kernel vulnerability affects the interaction between BPF LSM programs and the xfrm_decode_session() hook. BPF LSM programs can attach to this hook, which may return an error. However, security_skb_classify_flow() invokes the hook from a void path and triggers a BUG_ON() if an error is ...

CVE-2026-80669 bpf: Disable xfrm_decode_session hook attachment

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80667 net/mlx5: LAG, MPESW, Fix missing complete() on devcom error

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete on devcom error mlx5mpeswwork returned without calling complete when mlx5laggetdevcomcomp returned NULL. A caller that queued the work and waited on mpesww-comp would block indefinitely...

CVE-2026-80668 netfilter: nf_conntrack_expect: use conntrack GC to reap expectations

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker t...

EUVD-2026-67543

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete on devcom error mlx5mpeswwork returned without calling complete when mlx5laggetdevcomcomp returned NULL. A caller that queued the work and waited on mpesww-comp would block indefinitely...

EUVD-2026-67544

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker t...