CVE-2026-80534

CVE-2026-80534 is a lock-leak bug in the XFS filesystem of the Linux kernel. The function xfs_dq_get_next_id() acquires the quota inode ILock before calling xfs_iread_extents() ; if that call fails, the function returns early without releasing the lock, leaving the quota inode permanently locked....

CVE-2026-80533

CVE-2026-80533 is a Linux kernel bug in the XFS filesystem's AGI repair path. The function xrep_iunlink_walk_ondisk_bucket walks ragi->sc->sa.agi_bp to rebuild unlinked inode lists, but agi_bp can be null if the buffer verifier fails, causing an out-of-bounds walk. The fix substitutes ragi-...

CVE-2026-80532

CVE-2026-80532 affects the XFS filesystem in the Linux kernel , specifically the online fsck (repair) subsystem. The function xrep_iunlink_resolve_bucket , which reconstructs in-core prev/next unlinked list pointers from disk and memory before relinking lost inodes, is vulnerable to an infinite l...

CVE-2026-80531

CVE-2026-80531 is a Use-After-Free (UAF) vulnerability in the Linux kernel's XFS filesystem , specifically in the xrep_tempfile_create function. The root cause occurs when the tempfile creation code fails after it has already set sc->tempip , leaving a dangling pointer that may be dereferenced...

CVE-2026-80529

CVE-2026-80529 affects the Linux kernel's XFS filesystem . In xlog_recover_dquot_commit_pass2() , a recovered dquot is validated via xfs_dqblk_verify() ; on failure the function sets error = -EFSCORRUPTED and jumps to out_release , which unconditionally returns 0. This discards the corruption err...

CVE-2026-80530

This Linux kernel vulnerability affects the XFS filesystem 's range-exchange (exchmaps) operation. When the XFS_EXCHMAPS_INO1_WRITTEN flag is set, xfs_exchmaps_can_skip_mapping() may skip hole and unwritten mappings from file1, breaking the assumption that all shared extents are exchanged during ...

CVE-2026-80527

CVE-2026-80527 affects the Linux kernel Ceph filesystem (libceph/ceph module). A reader process can hang indefinitely in __ceph_get_caps() when the MDS revokes the FILE_RD capability from the client but the local cap->mds_wanted field still indicates the cap was requested. The root cause is an...

CVE-2026-80526

CVE-2026-80526 affects the Linux kernel ASoC tas2562 audio codec driver. The root cause is that tas2562_volume_control_put() does not validate the control value written by userspace before using it as an index into a fixed-size array , allowing an out-of-bounds value to be read and written to the...

CVE-2026-80524

This vulnerability affects the Linux kernel in the OP-TEE FFA driver, specifically the optee_ffa_lend_protmem function. A NULL pointer dereference can occur under memory pressure because the allocated pointer is not validated before use. The fix adds the missing NULL check before dereferencing. N...

CVE-2026-80525

CVE-2026-80525 affects the Linux kernel ASoC SOF ipc4-topology component. The ipc_config_data buffer for copier widgets is built once during ipc_prepare and cached for reuse. On suspend/resume , host and link DMA streams are re-allocated with potentially different stream tags, but the widget list...

CVE-2026-80523

In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will...

CVE-2026-80522

CVE-2026-80522 affects the Linux kernel 's crypto: tegra driver. The rctx->cryptlen calculation in tegra_gcm_do_one_req() is inconsistent with the method used in tegra_ccm_crypt_init(). If a caller never invokes tegra_gcm_setauthsize(), the ctx->authsize field remains zero , causing an inco...

CVE-2026-80521

CVE-2026-80521 affects the Linux kernel's af_unix (Unix domain sockets) subsystem. The root cause is a race condition in the socket garbage collector (GC): unix_add_edges() can publish a new edge to GC before its associated skb is queued via skb_queue_tail(). If both endpoints are closed in that ...

CVE-2026-80520

CVE-2026-80520 affects the Linux kernel's OVPN (in-kernel OpenVPN) module. The function ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking for NULL. However, a peer can have only one installed key, and the key-kill path may be asked to remove a...

CVE-2026-80519

This CVE affects the ovpn module in the Linux kernel. The vulnerability stems from an incorrect cleanup ordering in crypto completion callbacks: the peer reference (which pins the netdev and prevents module removal) was dropped before the callback finished its own cleanup. If ovpn_crypto_key_slot...

CVE-2026-74754

CVE-2026-74754 is a race condition in the Linux kernel SCSI core. The shost->eh_noresume flag is consulted twice per error-handling (EH) iteration—once before scsi_autopm_get_host() and once before scsi_autopm_put_host(). If a power-management path (e.g., ufshcd_set_dev_pwr_mode()) flips this ...

CVE-2026-74753

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perfeventopen...

CVE-2026-74752

CVE-2026-74752 affects the Linux kernel SCTP subsystem . When cookie authentication is disabled, the COOKIE_ECHO handler restores fixed-size AUTH fields directly from peer-controlled cookie bytes without validation. A forged RANDOM length can trigger out-of-bounds reads during key-vector construc...

CVE-2026-74750

CVE-2026-74750 affects the Linux kernel ovpn (OpenVPN) module . Key slots are released via a kref, and the existing release path frees AEAD transforms from an RCU callback . This is unsafe because crypto_free_aead can sleep (e.g., when an async or hardware crypto implementation has teardown work ...

CVE-2026-74751

CVE-2026-74751 affects the Linux kernel RISC-V architecture, specifically the ZBB-optimized strnlen library function. The root cause is that the optimized loop loads a full word ahead of the aligned boundary check ; when the input string is aligned and count is a multiple of the register size, th...