CVE-2026-80679

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasdreleasespace checks the implementation of the isese discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND...

CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

UBUNTU-CVE-2026-80704

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80657

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmtchann has already been destroyed. Add NULL checks to...

UBUNTU-CVE-2026-80658

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Fix null-ptr-deref in dwdpremove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

CVE-2026-80705 drm/amd/display: check if dml21_add_phantom_plane() is successful

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

CVE-2026-80704 drm/amd/display: use proper context for logging

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

EUVD-2026-67439

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80704 drm/amd/display: use proper context for logging

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80704

CVE-2026-80704 is a NULL pointer dereference in the Linux kernel's DRM AMD display driver. The function get_ss_info_from_atombios() accessed calc_pll_cs->ctx->logger before calc_pll_cs->ctx was initialized in calc_pll_max_vco_construct(), causing a crash during early driver construction....

EUVD-2026-67436

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

CVE-2026-80701

CVE-2026-80701 affects the Linux kernel 's DRM/vmwgfx (VMware graphics) driver. The root cause is that vmw_cursor_plane_atomic_check() enforces cursor width/height bounds only on the legacy update path, while the SVGA_CAP2_CURSOR_MOB path—the default on modern hosts—accepts any size. When an over...

EUVD-2026-67432

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid fpath for page cache sharing Previously, backing files for page cache sharing were set up with fpath left as NULL only finode was valid. It worked, but a recent mincore fix relies on fpath.mnt and crashes foun...

CVE-2026-80697 erofs: ensure valid f_path for page cache sharing

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid fpath for page cache sharing Previously, backing files for page cache sharing were set up with fpath left as NULL only finode was valid. It worked, but a recent mincore fix relies on fpath.mnt and crashes foun...

CVE-2026-80697 erofs: ensure valid f_path for page cache sharing

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid fpath for page cache sharing Previously, backing files for page cache sharing were set up with fpath left as NULL only finode was valid. It worked, but a recent mincore fix relies on fpath.mnt and crashes foun...

CVE-2026-80697

CVE-2026-80697 affects the Linux kernel in the erofs (Enhanced Read-Only Filesystem) subsystem. Backing files for page cache sharing were previously set up with f_path left as NULL (only f_inode was valid). A recent mincore fix relies on f_path.mnt, triggering a kernel NULL pointer dereference an...

CVE-2026-80691 scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

EUVD-2026-67425

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

CVE-2026-80691

CVE-2026-80691 is a NULL pointer dereference in the Linux kernel SCSI target iblock subsystem . In iblock_execute_pr_out(), the PRO_PREEMPT , PRO_PREEMPT_AND_ABORT , and PRO_RELEASE operations perform capability checks through ops->pr_clear; the flawed check allows unimplemented hooks to pass,...

EUVD-2026-67426

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...