CVE-2026-80694 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: pass eth to mtkhandleirqrx in pollcontroller mtkhandleirqrx expects a struct mtketh matching the requestirq cookie, but mtkpollcontroller incorrectly passed the netdevice . Calling ndopollcontroller with...

CVE-2026-80694

CVE-2026-80694 is a type-mismatch bug in the Linux kernel's MediaTek mtk_eth_soc Ethernet driver. The function mtk_poll_controller incorrectly passed a net_device * to mtk_handle_irq_rx, which expects a struct mtk_eth * (the request_irq cookie). Calling ndo_poll_controller with CONFIG_NET_POLL_CO...

CVE-2026-80694 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: pass eth to mtkhandleirqrx in pollcontroller mtkhandleirqrx expects a struct mtketh matching the requestirq cookie, but mtkpollcontroller incorrectly passed the netdevice . Calling ndopollcontroller with...

EUVD-2026-67429

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: pass eth to mtkhandleirqrx in pollcontroller mtkhandleirqrx expects a struct mtketh matching the requestirq cookie, but mtkpollcontroller incorrectly passed the netdevice . Calling ndopollcontroller with...

CVE-2026-80694

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: pass eth to mtkhandleirqrx in pollcontroller mtkhandleirqrx expects a struct mtketh matching the requestirq cookie, but mtkpollcontroller incorrectly passed the netdevice . Calling ndopollcontroller with...

CVE-2026-80693

CVE-2026-80693 is an out-of-bounds write in the Linux kernel's idpf (Intel DPA) network driver. The function idpf_get_reg_intr_vecs() fills a reg_vals[] array using per-chunk num_vectors from a VIRTCHNL2_OP_ALLOC_VECTORS reply, but the array size is based on caps.num_allocated_vectors. Since the ...

CVE-2026-80693 idpf: bound interrupt-vector register fill to the allocated array

In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpfgetregintrvecs fills the caller-allocated regvals array from the VIRTCHNL2OPALLOCVECTORS reply in adapter-reqvecchunks, bounding its inner loop only by the...

EUVD-2026-67428

In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpfgetregintrvecs fills the caller-allocated regvals array from the VIRTCHNL2OPALLOCVECTORS reply in adapter-reqvecchunks, bounding its inner loop only by the...

CVE-2026-80693 idpf: bound interrupt-vector register fill to the allocated array

In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpfgetregintrvecs fills the caller-allocated regvals array from the VIRTCHNL2OPALLOCVECTORS reply in adapter-reqvecchunks, bounding its inner loop only by the...

CVE-2026-80692 Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

EUVD-2026-67427

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-80692 Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-80692

CVE-2026-80692 is a theoretical Use-After-Free (UAF) in the Linux kernel's Bluetooth HCI subsystem , specifically in the hci_connect_acl() and hci_connect_le_sync() callbacks. If the conn object is freed while the hci_sync task is running, a UAF can occur. The fix holds a refcount to the conn obj...

CVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

EUVD-2026-67425

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

CVE-2026-80691

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

CVE-2026-80690 scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

CVE-2026-80690

CVE-2026-80690 affects the Linux kernel UFS (Universal Flash Storage) SCSI driver. The root cause is that the hba->rpmbs list is not initialized in ufshcd_alloc_host(), leading to a NULL pointer dereference in the device teardown path when ufs_rpmb_probe() fails. The fix is a list initializati...

CVE-2026-80691

CVE-2026-80691 is a NULL pointer dereference in the Linux kernel SCSI target iblock subsystem . In iblock_execute_pr_out(), the PRO_PREEMPT , PRO_PREEMPT_AND_ABORT , and PRO_RELEASE operations perform capability checks through ops->pr_clear; the flawed check allows unimplemented hooks to pass,...

EUVD-2026-67426

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...