CVE-2026-80632

CVE-2026-80632 affects the Linux kernel 's wifi mt76 driver for the mt7996 chipset. When both MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED are enabled and mt76 detects the Airoha NPU SoC , the function mt7996_init_tx_queues() dereferences a NULL WED pointer, resulting in a NULL pointer dereference (k...

CVE-2026-80624 mfd: cs42l43: Sanity check firmware size

In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a...

CVE-2026-80624

CVE-2026-80624 affects the Linux kernel 's mfd: cs42l43 driver. The root cause is a missing sanity check: the code verifies that a firmware was received but does not confirm that the firmware size exceeds the firmware header size. Because the firmware pointer is dereferenced as a pointer to the h...

CVE-2026-80624 mfd: cs42l43: Sanity check firmware size

In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a...

CVE-2026-80624

In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a...

EUVD-2026-67500

In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a...

EUVD-2026-67497

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS DES capability, leaving pci-debugfs-rasdesinfo unset. The common debug...

CVE-2026-80621 PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS DES capability, leaving pci-debugfs-rasdesinfo unset. The common debug...

CVE-2026-80621

CVE-2026-80621 is a NULL pointer dereference in the Linux kernel's PCI DesignWare (DWC) driver . When a PCIe controller lacks a RAS DES capability, dwc_pcie_rasdes_debugfs_init() returns success but leaves pci->debugfs->rasdes_info unset. The common debugfs teardown path then unconditionall...

CVE-2026-80621 PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS DES capability, leaving pci-debugfs-rasdesinfo unset. The common debug...

CVE-2026-80621

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS DES capability, leaving pci-debugfs-rasdesinfo unset. The common debug...

CVE-2026-80620 Revert "PCI/MSI: Unmap MSI-X region on error"

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

CVE-2026-80620

CVE-2026-80620 is a Linux kernel vulnerability in the PCI/MSI subsystem . A prior commit (1a8d4c6ecb4c) added an iounmap(dev->msix_base) on the error path of msix_capability_init(), but pci_free_msi_irqs() — called earlier via the __free(free_msi_irqs) cleanup — already unmapped the region and...

CVE-2026-80620

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

CVE-2026-80620 Revert "PCI/MSI: Unmap MSI-X region on error"

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

EUVD-2026-67496

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

CVE-2026-80617 net: airoha: fix foe_check_time allocation size

In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foechecktime allocation size foechecktime is declared as u16 pointer but was allocated with only ppenumentries bytes instead of ppenumentries sizeofu16. When airohappefoeverifyentry is called with hash =...

CVE-2026-80617

CVE-2026-80617 is a heap buffer overflow in the Linux kernel's airoha PPE (Packet Processing Engine) network driver. The foe_check_time buffer is declared as a u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry(...

CVE-2026-80617 net: airoha: fix foe_check_time allocation size

In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foechecktime allocation size foechecktime is declared as u16 pointer but was allocated with only ppenumentries bytes instead of ppenumentries sizeofu16. When airohappefoeverifyentry is called with hash =...

EUVD-2026-67493

In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foechecktime allocation size foechecktime is declared as u16 pointer but was allocated with only ppenumentries bytes instead of ppenumentries sizeofu16. When airohappefoeverifyentry is called with hash =...