CVE-2026-80993 net: phylink: correctly validate returned PCS in phylink_inband_caps

In the Linux kernel, the following vulnerability has been resolved: net: phylink: correctly validate returned PCS in phylinkinbandcaps In phylinkinbandcaps, the PCS returned by macselectpcs is only checked if NULL but macselectpcs can also return an error pointer. This can cause a kernel panic as...

CVE-2026-80993

CVE-2026-80993 affects the Linux kernel in the net: phylink subsystem. In the function phylink_inband_caps() , the PCS returned by mac_select_pcs() was only validated against NULL , but the function can also return an error pointer . This causes a kernel panic because phylink_pcs_inband_caps() di...

EUVD-2026-76315

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv-ptp.clock...

CVE-2026-80992

CVE-2026-80992 is a NULL pointer dereference in the Linux kernel's net: ravb (RENESAS AVB Ethernet) driver. The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer; registration failures can also leave an error pointer in priv->ptp.clock. Red Ha...

CVE-2026-80992

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv-ptp.clock...

CVE-2026-80991 net: ravb: serialize PTP clock teardown

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravbptpinterrupt can race with ravbptpstop and pass the clock to ptpclockevent while ptpclockunregister is freeing it. This can lead to a use-after-free. Use READONCE and WRITEONCE for...

CVE-2026-80992 net: ravb: avoid dereferencing an invalid PTP clock

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv-ptp.clock...

EUVD-2026-76314

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravbptpinterrupt can race with ravbptpstop and pass the clock to ptpclockevent while ptpclockunregister is freeing it. This can lead to a use-after-free. Use READONCE and WRITEONCE for...

CVE-2026-80991

A race condition in the Linux kernel's net: ravb Ethernet driver can lead to a use-after-free during PTP clock teardown. Specifically, ravb_ptp_interrupt() can race with ravb_ptp_stop(), passing the PTP clock to ptp_clock_event() while ptp_clock_unregister() is freeing it. The fix serializes tear...

CVE-2026-80991 net: ravb: serialize PTP clock teardown

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravbptpinterrupt can race with ravbptpstop and pass the clock to ptpclockevent while ptpclockunregister is freeing it. This can lead to a use-after-free. Use READONCE and WRITEONCE for...

CVE-2026-80991

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravbptpinterrupt can race with ravbptpstop and pass the clock to ptpclockevent while ptpclockunregister is freeing it. This can lead to a use-after-free. Use READONCE and WRITEONCE for...

CVE-2026-80992 net: ravb: avoid dereferencing an invalid PTP clock

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv-ptp.clock...

CVE-2026-80987 NTB: ntb_transport: Reject oversized TX buffers

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbtransport: Reject oversized TX buffers ntbprocesstx handles an oversized buffer by calling txhandler with a NULL data pointer and returning success. ntbnetdev therefore neither frees the skb in its completion callback nor...

CVE-2026-80987 NTB: ntb_transport: Reject oversized TX buffers

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbtransport: Reject oversized TX buffers ntbprocesstx handles an oversized buffer by calling txhandler with a NULL data pointer and returning success. ntbnetdev therefore neither frees the skb in its completion callback nor...

EUVD-2026-76310

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbtransport: Reject oversized TX buffers ntbprocesstx handles an oversized buffer by calling txhandler with a NULL data pointer and returning success. ntbnetdev therefore neither frees the skb in its completion callback nor...

CVE-2026-80987

CVE-2026-80987 is a memory leak in the Linux kernel's Non-Transparent Bridge (NTB) transport module. When ntb_process_tx() receives an oversized TX buffer, it calls tx_handler() with a NULL data pointer and returns success, causing ntb_netdev to neither free the socket buffer (skb) nor follow the...

CVE-2026-80987

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbtransport: Reject oversized TX buffers ntbprocesstx handles an oversized buffer by calling txhandler with a NULL data pointer and returning success. ntbnetdev therefore neither frees the skb in its completion callback nor...

CVE-2026-80984

CVE-2026-80984 is a NULL pointer dereference in the Linux kernel's net/smc subsystem on the SMC-D teardown path. When a link group terminates while a socket is waiting in smc_close_stream_wait(), the function smc_tx_prepared_sends() may dereference conn->sndbuf_desc after it has been cleared t...

CVE-2026-80984 net/smc: do not dereference an unset send buffer on the SMC-D teardown path

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...

CVE-2026-80984

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...