CVE-2026-80704

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

UBUNTU-CVE-2026-80704

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80705 drm/amd/display: check if dml21_add_phantom_plane() is successful

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

CVE-2026-80704

CVE-2026-80704 is a NULL pointer dereference in the Linux kernel's DRM AMD display driver. The function get_ss_info_from_atombios() accessed calc_pll_cs->ctx->logger before calc_pll_cs->ctx was initialized in calc_pll_max_vco_construct(), causing a crash during early driver construction....

EUVD-2026-67439

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80704 drm/amd/display: use proper context for logging

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80704 drm/amd/display: use proper context for logging

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80701 drm/vmwgfx: enforce cursor size limits for MOB cursors

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

EUVD-2026-67436

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

CVE-2026-80701

CVE-2026-80701 affects the Linux kernel 's DRM/vmwgfx (VMware graphics) driver. The root cause is that vmw_cursor_plane_atomic_check() enforces cursor width/height bounds only on the legacy update path, while the SVGA_CAP2_CURSOR_MOB path—the default on modern hosts—accepts any size. When an over...

CVE-2026-80697 erofs: ensure valid f_path for page cache sharing

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid fpath for page cache sharing Previously, backing files for page cache sharing were set up with fpath left as NULL only finode was valid. It worked, but a recent mincore fix relies on fpath.mnt and crashes foun...

EUVD-2026-67432

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid fpath for page cache sharing Previously, backing files for page cache sharing were set up with fpath left as NULL only finode was valid. It worked, but a recent mincore fix relies on fpath.mnt and crashes foun...

CVE-2026-80697 erofs: ensure valid f_path for page cache sharing

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid fpath for page cache sharing Previously, backing files for page cache sharing were set up with fpath left as NULL only finode was valid. It worked, but a recent mincore fix relies on fpath.mnt and crashes foun...

CVE-2026-80697

CVE-2026-80697 affects the Linux kernel in the erofs (Enhanced Read-Only Filesystem) subsystem. Backing files for page cache sharing were previously set up with f_path left as NULL (only f_inode was valid). A recent mincore fix relies on f_path.mnt, triggering a kernel NULL pointer dereference an...

CVE-2026-80691 scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

CVE-2026-80691 scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

EUVD-2026-67425

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

CVE-2026-80691

CVE-2026-80691 is a NULL pointer dereference in the Linux kernel SCSI target iblock subsystem . In iblock_execute_pr_out(), the PRO_PREEMPT , PRO_PREEMPT_AND_ABORT , and PRO_RELEASE operations perform capability checks through ops->pr_clear; the flawed check allows unimplemented hooks to pass,...

EUVD-2026-67426

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

CVE-2026-80690 scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...