CVE-2026-80845 xfrm: avoid lock inversion in nat keepalive work

In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work natkeepalivework walks the state table while xfrmstatewalk holds net-xfrm.xfrmstatelock. Its callback then acquires x-lock, which conflicts with the delete path taking the same loc...

EUVD-2026-71295

In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work natkeepalivework walks the state table while xfrmstatewalk holds net-xfrm.xfrmstatelock. Its callback then acquires x-lock, which conflicts with the delete path taking the same loc...

CVE-2026-80845 xfrm: avoid lock inversion in nat keepalive work

In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work natkeepalivework walks the state table while xfrmstatewalk holds net-xfrm.xfrmstatelock. Its callback then acquires x-lock, which conflicts with the delete path taking the same loc...

CVE-2026-80845

CVE-2026-80845 affects the Linux kernel xfrm subsystem, specifically the NAT keepalive worker. The root cause is an AB-BA lock inversion : nat_keepalive_work() acquires x->lock while holding xfrm_state_lock, whereas the SA deletion path (xfrm_state_delete() / __xfrm_state_delete()) takes the s...

CVE-2026-80845

In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work natkeepalivework walks the state table while xfrmstatewalk holds net-xfrm.xfrmstatelock. Its callback then acquires x-lock, which conflicts with the delete path taking the same loc...

EUVD-2026-71280

In the Linux kernel, the following vulnerability has been resolved: usb: core: Add lock to usbwakeupnotification Add a spin lock to usbwakeup notification to prevent a race condition with dereferencing freed memory. This could be hit by the xHCI driver as it calls this function from an IRQ and...

CVE-2026-80830

In the Linux kernel, the following vulnerability has been resolved: usb: core: Add lock to usbwakeupnotification Add a spin lock to usbwakeup notification to prevent a race condition with dereferencing freed memory. This could be hit by the xHCI driver as it calls this function from an IRQ and...

CVE-2026-80819 Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

EUVD-2026-71254

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

EUVD-2026-71239

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

CVE-2026-80804 xfs: restore nofs context unconditionally in xfs_trans_roll

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

CVE-2026-80804

CVE-2026-80804 affects the Linux kernel XFS filesystem. In xfs_trans_roll(), when __xfs_trans_commit() fails, the NOFS context is cleared but only restored in the success path, leaving the error path without nofs protection. This causes a circular lock dependency between xfs_nondir_ilock_class an...

CVE-2026-80804 xfs: restore nofs context unconditionally in xfs_trans_roll

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

EUVD-2026-71407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80764 Bluetooth: hci_event: fix LE list UAF on reset

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80762

CVE-2026-80762 is a use-after-free in the Linux kernel Bluetooth HCI subsystem (hci_sync). The function hci_update_event_filter_sync() walks the device's accept list while issuing synchronous HCI commands per remote-wakeup device. The suspend path holds hdev->req_lock, but accept-list mutation...

EUVD-2026-71405

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...

EUVD-2026-70777

MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLoop where the accept thread performs a blocking receive without timeout during the wire-protocol handshake. An attacker can open a TCP connection to the MOOSDB port and send no data, causing the...

PT-2026-85798

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A circular locking dependency exists in the ocfs2 module, which can lead to a deadlock. The issue involves three system locks: INODE ALLOC SYSTEM INODE, EXTENT ALLOC SYSTEM INODE, and...

PT-2026-85734

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on setattr writeback failure fuse do setattr takes filemap invalidate lock for a DAX truncate fault blocked = true and releases it at the out:/error: labels. But when a writeback flush is also neede...