EUVD-2026-67545

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669 bpf: Disable xfrm_decode_session hook attachment

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

EUVD-2026-67520

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

CVE-2026-80644

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

CVE-2026-80639 cxl/test: Fix __fortify_panic

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains that it is potentially overflowing the xormaps array per countedbynrmaps. Quiet the false positive by initializing @nrmaps earlier. memcpy:...

CVE-2026-80639

CVE-2026-80639 affects the Linux kernel 's cxl/test module (loaded as cxl_translate). The issue is in setup_xor_mapping(), where the Fortify overflow detector reported a potential 32-byte write to a zero-size buffer for the xormaps array, due to the __counted_by(nr_maps) annotation seeing nr_maps...

CVE-2026-80639 cxl/test: Fix __fortify_panic

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains that it is potentially overflowing the xormaps array per countedbynrmaps. Quiet the false positive by initializing @nrmaps earlier. memcpy:...

EUVD-2026-67516

In the Linux kernel, the following vulnerability has been resolved: cxl/fwctl: Fix fortifypanic Fix a runtime assertion in cxlctlgetsupportedfeatures. Fortify complains that it is potentially overflowing the entries array per countedbylenumentries. Quiet the false positive by initializing...

CVE-2026-80640 cxl/fwctl: Fix __fortify_panic

In the Linux kernel, the following vulnerability has been resolved: cxl/fwctl: Fix fortifypanic Fix a runtime assertion in cxlctlgetsupportedfeatures. Fortify complains that it is potentially overflowing the entries array per countedbylenumentries. Quiet the false positive by initializing...

CVE-2026-80639

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains that it is potentially overflowing the xormaps array per countedbynrmaps. Quiet the false positive by initializing @nrmaps earlier. memcpy:...

CVE-2026-80638 ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2removerefcountextent BUG Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. CAUSE When the last leaf block is removed fro...

EUVD-2026-67514

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2removerefcountextent BUG Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. CAUSE When the last leaf block is removed fro...

CVE-2026-80638

CVE-2026-80638 is an out-of-bounds write in the Linux kernel's ocfs2 filesystem module, specifically in ocfs2_remove_refcount_extent(). When the last leaf block is removed from a refcount tree, a bulk memset on &rb->rf_records executes while rl_count is 0 (since rf_list.l_tree_depth aliases rf...

CVE-2026-80638 ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2removerefcountextent BUG Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. CAUSE When the last leaf block is removed fro...

CVE-2026-80625 RDMA/hns: Fix memory leak of bonding resources

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix memory leak of bonding resources In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hnsrocehwv2exit during driver removal, and then is allocated again in...

EUVD-2026-67501

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix memory leak of bonding resources In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hnsrocehwv2exit during driver removal, and then is allocated again in...

CVE-2026-80625 RDMA/hns: Fix memory leak of bonding resources

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix memory leak of bonding resources In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hnsrocehwv2exit during driver removal, and then is allocated again in...

CVE-2026-80625

CVE-2026-80625 affects the Linux kernel in the RDMA/hns driver. In a corner case of concurrent driver removal and driver reset , a bonding resource is first released in hns_roce_hw_v2_exit() and then re-allocated in hns_roce_register_device(), but the release timing has already passed. This cause...

CVE-2026-80604 HID: core: Fix OOB read in hid_get_report for numbered reports

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hidgetreport for numbered reports When a caller passes a size of 0 to hidreportrawevent for a numbered report, the function originally called hidgetreport before performing any size validation. Inside...

CVE-2026-80604 HID: core: Fix OOB read in hid_get_report for numbered reports

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hidgetreport for numbered reports When a caller passes a size of 0 to hidreportrawevent for a numbered report, the function originally called hidgetreport before performing any size validation. Inside...