CVE-2026-80638 ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2removerefcountextent BUG Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. CAUSE When the last leaf block is removed fro...

CVE-2026-80638

CVE-2026-80638 is an out-of-bounds write in the Linux kernel's ocfs2 filesystem module, specifically in ocfs2_remove_refcount_extent(). When the last leaf block is removed from a refcount tree, a bulk memset on &rb->rf_records executes while rl_count is 0 (since rf_list.l_tree_depth aliases rf...

EUVD-2026-67514

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2removerefcountextent BUG Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. CAUSE When the last leaf block is removed fro...

CVE-2026-80636

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not used anymore after moving ct timeout and helper to use datapath refcount to track object use. Revert commit c56716c69ce1 "netfilter:...

CVE-2026-80637

CVE-2026-80637 affects the Linux kernel 's netfilter synproxy module, where an unaligned memory access in the timestamp adjustment code could cause performance degradation or a crash on strict alignment architectures . The fix replaces direct reads/writes with get_unaligned_be32() and put_unalign...

CVE-2026-80636

CVE-2026-80636 affects the Linux kernel netfilter conntrack subsystem. The vulnerability stems from the ct extension genid infrastructure (introduced by commit c56716c69ce1), which disables all ct extensions for unconfirmed conntracks—causing them to be NULL —when this behavior should only apply ...

CVE-2026-80637 netfilter: synproxy: fix unaligned memory access in timestamp adjustment

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use getunalignedbe32 and putunalignedbe32 to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory acces...

CVE-2026-80637

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use getunalignedbe32 and putunalignedbe32 to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory acces...

EUVD-2026-67512

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not used anymore after moving ct timeout and helper to use datapath refcount to track object use. Revert commit c56716c69ce1 "netfilter:...

EUVD-2026-67513

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use getunalignedbe32 and putunalignedbe32 to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory acces...

CVE-2026-80636 netfilter: conntrack: revert ct extension genid infrastructure

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not used anymore after moving ct timeout and helper to use datapath refcount to track object use. Revert commit c56716c69ce1 "netfilter:...

CVE-2026-80637 netfilter: synproxy: fix unaligned memory access in timestamp adjustment

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use getunalignedbe32 and putunalignedbe32 to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory acces...

EUVD-2026-67511

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

CVE-2026-80635

CVE-2026-80635 is an out-of-bounds read vulnerability in the wcn36xx Wi-Fi driver of the Linux kernel. When processing a trigger BA (Block Acknowledgment) firmware response, the code checks the response length only against the base struct size (20 bytes). However, when candidate_cnt >= 1, a 22...

CVE-2026-80635

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

CVE-2026-80634 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid numencaps underflow on bridge VLAN untag The DEVPATHBRVLANUNTAG case post-decrements info-numencaps inside WARNONONCE. numencaps is u8, so if it's already 0 the decrement still happens and wraps it to...

CVE-2026-80634

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid numencaps underflow on bridge VLAN untag The DEVPATHBRVLANUNTAG case post-decrements info-numencaps inside WARNONONCE. numencaps is u8, so if it's already 0 the decrement still happens and wraps it to...

CVE-2026-80634 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid numencaps underflow on bridge VLAN untag The DEVPATHBRVLANUNTAG case post-decrements info-numencaps inside WARNONONCE. numencaps is u8, so if it's already 0 the decrement still happens and wraps it to...

CVE-2026-80635 wifi: wcn36xx: fix OOB read from short trigger BA firmware response

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

CVE-2026-80634

CVE-2026-80634 is a Linux kernel vulnerability in the netfilter flowtable subsystem. The root cause is an integer underflow: in the DEV_PATH_BR_VLAN_UNTAG path, info->num_encaps (a u8) is post-decremented inside WARN_ON_ONCE(), wrapping to 255 when already zero. This causes nft_dev_forward_pat...