UBUNTU-CVE-2026-80628

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q-lock sndseqossreadqclear resets qlen, head, and tail without q-lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset ca...

CVE-2026-80633

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dmaresv lock before dmabufunpin in release path dmabufunpin requires the caller to hold the exporter's dmaresv lock: void dmabufunpinstruct dmabufattachment attach ... dmaresvasserthelddmabuf-resv;...

CVE-2026-80687

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

UBUNTU-CVE-2026-80633

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dmaresv lock before dmabufunpin in release path dmabufunpin requires the caller to hold the exporter's dmaresv lock: void dmabufunpinstruct dmabufattachment attach ... dmaresvasserthelddmabuf-resv;...

CVE-2026-80606

In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifierlock for write on inject test path When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit runs vmacheckuserptr with the svm notifierlock taken for read. The test injection causes vmacheckuserpt...

CVE-2026-80660

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ unregister sysfs devices outside occ lock occactivefalse and occshutdown unregister sysfs-backed devices while occ-lock is held. hwmondeviceunregister and sysfsremovegroup can wait for active sysfs callbacks to drain,...

CVE-2026-80666

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

UBUNTU-CVE-2026-80660

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ unregister sysfs devices outside occ lock occactivefalse and occshutdown unregister sysfs-backed devices while occ-lock is held. hwmondeviceunregister and sysfsremovegroup can wait for active sysfs callbacks to drain,...

UBUNTU-CVE-2026-80659

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

UBUNTU-CVE-2026-80687

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80687

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80687 iommufd/viommu: Release the igroup lock on the vdevice_size error path

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

EUVD-2026-67563

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80687

CVE-2026-80687 is a deadlock vulnerability in the Linux kernel 's iommufd/viommu subsystem. The function iommufd_vdevice_alloc_ioctl() acquires idev->igroup->lock, then validates the driver's vdevice_size against the core structure size. On failure, a WARN_ON_ONCE guard jumps to out_put_ide...

CVE-2026-80687 iommufd/viommu: Release the igroup lock on the vdevice_size error path

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80676 Drivers: hv: vmbus: use generic driver_override infrastructure

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: use generic driveroverride infrastructure When a driver is probed through driverattach, the bus' match callback is called without the device lock held, thus accessing the driveroverride field without a lock,...

CVE-2026-80676 Drivers: hv: vmbus: use generic driver_override infrastructure

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: use generic driveroverride infrastructure When a driver is probed through driverattach, the bus' match callback is called without the device lock held, thus accessing the driveroverride field without a lock,...

CVE-2026-80660

CVE-2026-80660 is a lock-ordering deadlock in the Linux kernel's hwmon (occ) driver . The functions occ_active(false) and occ_shutdown() unregister sysfs-backed devices while holding occ->lock, but hwmon_device_unregister() and sysfs_remove_group() may wait for active sysfs callbacks to drain,...

EUVD-2026-67535

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

CVE-2026-80660 hwmon: (occ) unregister sysfs devices outside occ lock

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ unregister sysfs devices outside occ lock occactivefalse and occshutdown unregister sysfs-backed devices while occ-lock is held. hwmondeviceunregister and sysfsremovegroup can wait for active sysfs callbacks to drain,...