CVE-2026-80550 s390/vfio_ccw: Fix out of bounds check on CCW array

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Fix out of bounds check on CCW array The routine ccwchaincalclength counts the number of channel command words CCWs that are chained together in a single channel program, and rejects anything larger than...

CVE-2026-80550

CVE-2026-80550 is an out-of-bounds read in the Linux kernel s390/vfio_ccw driver. The function ccwchain_calc_length() iterates over chained channel command words (CCWs) with a do..while (count

CVE-2026-80537

CVE-2026-80537 is an off-by-one error in the Linux kernel's XFS filesystem, specifically in the realtime refcount btree root level validation. The functions xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount() use > instead of >= when checking the on-disk root level, allowing a crafted XF...

CVE-2026-80537

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

CVE-2026-80537 xfs: fix off-by-one in rtrefcount btree root level validation

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

CVE-2026-80537 xfs: fix off-by-one in rtrefcount btree root level validation

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

CVE-2026-80536

CVE-2026-80536 is an out-of-bounds write in the Linux kernel's XFS filesystem , specifically in xlog_recover_do_reg_buffer() during mount-time log recovery. The destination offset and buffer size are both attacker-controlled but only bounded by an ASSERT() that compiles away on production kernels...

CVE-2026-80536 xfs: bounds-check buffer log item's dirty bitmap

In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlogrecoverdoregbuffer replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpyxfsbufoffsetbp, uintbit ribufi.iovbase, nbits...

CVE-2026-80536 xfs: bounds-check buffer log item's dirty bitmap

In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlogrecoverdoregbuffer replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpyxfsbufoffsetbp, uintbit ribufi.iovbase, nbits...

CVE-2026-80534

CVE-2026-80534 is a lock-leak bug in the XFS filesystem of the Linux kernel. The function xfs_dq_get_next_id() acquires the quota inode ILock before calling xfs_iread_extents() ; if that call fails, the function returns early without releasing the lock, leaving the quota inode permanently locked....

CVE-2026-80534 xfs: fix ilock leak on error in xfs_dq_get_next_id

In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfsdqgetnextid xfsdqgetnextid takes the quota inode ILOCK before calling xfsireadextents. If xfsireadextents fails, the function returns immediately without releasing the lock, leaking the quota...

CVE-2026-80527 ceph: fix hanging __ceph_get_caps() with stale mds_wanted

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

CVE-2026-80527

CVE-2026-80527 affects the Linux kernel's Ceph filesystem client (cephfs) . The vulnerability is in the capability state management within __ceph_get_caps(): the cap->mds_wanted field is updated before the corresponding CEPH_MSG_CLIENT_CAPS message is actually sent to the MDS, causing a stale ...

CVE-2026-80527 ceph: fix hanging __ceph_get_caps() with stale mds_wanted

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

CVE-2026-80526 ASoC: tas2562: Validate values for volume writes

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

CVE-2026-80522 crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx-cryptlen calculation in tegragcmdoonereq Perform rctx-cryptlen calculation in tegragcmdoonereq the same way it is done in tegraccmcryptinit. The current formulae may lead to a crash if a caller does not...

CVE-2026-80522

CVE-2026-80522 affects the Linux kernel Tegra crypto driver . The root cause is an incorrect rctx->cryptlen calculation in tegra_gcm_do_one_req() when the caller has not invoked tegra_gcm_setauthsize(), leaving ctx->authsize at zero. This results in a write beyond the rctx->dst_sg buffer...

CVE-2026-74752 sctp: validate cookie AUTH state before use

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-74752

CVE-2026-74752 is a critical (CVSS 9.8) vulnerability in the Linux kernel's SCTP implementation. When cookie authentication is disabled, the COOKIE_ECHO handler restores fixed-size AUTH fields directly from peer-controlled cookie bytes without validating them against local backing arrays. A forge...

CVE-2026-74752 sctp: validate cookie AUTH state before use

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...