CVE-2026-80913 selinux: require every boolean value to be defined

In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool fills boolvaltostruct at value - 1, so a count larger than the values...

CVE-2026-17273

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference...

CVE-2026-17273

CVE-2026-17273 affects the Debug Server component in IBM i versions 7.3, 7.4, 7.5, and 7.6. A remote authenticated attacker with low privileges can trigger a NULL pointer dereference (CWE-476), resulting in a denial of service with no impact on confidentiality or integrity. The IBM-assigned CVSS ...

EUVD-2026-71477

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference...

CVE-2026-17273 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference...

AZL-99431 CVE-2026-80846 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

AZL-99633 CVE-2026-80819 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

CVE-2026-80817

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix NULL pointer deref in iommufdioaschangeprocess when racing with ioptmapfilepages iommufdioaschangeprocess iterates every IOAS area while only holding every IOAS iovarwsem, so it assumes every area has a non-NUL...

CVE-2026-80815

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2initnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that...

CVE-2026-80813

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmetexecuteidentifynslist is called with matchcss set...

CVE-2026-80771

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set inputregisterdevice exposes the device to userspace immediately. In joyconinputcreate it was called before joyconconfigrumble configures the FFRUMBLE capability and...

CVE-2026-80802

In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdpncii2cread takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2cmasterrecv count into a...

CVE-2026-80846 xfrm: drop ESP-in-TCP packets with no ingress device

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

CVE-2026-80846 xfrm: drop ESP-in-TCP packets with no ingress device

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

EUVD-2026-71296

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

CVE-2026-80822

In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: Add null check for devmkasprintf Add a check to see if devmkasprintf is not NULL in mchpipcgetclusteraggrirq, returning -ENOMEM if the function failed...

CVE-2026-80822

CVE-2026-80822 affects the Linux kernel's mchp-ipc-sbi mailbox driver. The root cause is a missing null check on the return value of devm_kasprintf() in the function mchp_ipc_get_cluster_aggr_irq() . Without this check, a failed allocation could lead to a NULL pointer dereference. The fix adds a ...

EUVD-2026-71254

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

CVE-2026-80819

CVE-2026-80819 is a null pointer dereference in the Linux kernel 's Bluetooth RFCOMM subsystem. The flaw occurs when rfcomm_sock_recvmsg() calls rfcomm_dlc_accept() without holding rfcomm_mutex. A remote peer can trigger the bug by sending a DISC frame on a deferred-setup DLC, which clears d->...

CVE-2026-80817 iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix NULL pointer deref in iommufdioaschangeprocess when racing with ioptmapfilepages iommufdioaschangeprocess iterates every IOAS area while only holding every IOAS iovarwsem, so it assumes every area has a non-NUL...