CVE-2026-80556

CVE-2026-80556 is a use-after-free bug in the Linux kernel's atmel-mci MMC driver. The root cause is a race condition in atmci_remove: when the module is removed, the host structure (allocated via devm_kzalloc) is freed after the remove callback returns, but &host->bh_work—which can be queued ...

CVE-2026-80551 s390/vfio_ccw: Ensure first IDAW remains constant

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full...

CVE-2026-80551 s390/vfio_ccw: Ensure first IDAW remains constant

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full...

CVE-2026-80548

CVE-2026-80548 affects the Linux kernel s390/vfio_ccw subsystem, where the io_mutex lock had a scope too narrow to fully serialize I/O operations, leaving residual race conditions on I/O resources. The fix expands the lock's scope to close these windows and also reworks how cp_free() is invoked f...

CVE-2026-80548 s390/vfio_ccw: Selectively expand io_mutex

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Selectively expand iomutex The iomutex was defined to serialize the ioregions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of race...

CVE-2026-80547 s390/vfio_ccw: Implement a crw lock

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80547 s390/vfio_ccw: Implement a crw lock

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80547

This vulnerability affects the Linux kernel 's s390/vfio_ccw subsystem (Virtual Function Interface for Channel-Word devices on the s390 architecture). The root cause is a missing lock on the CRW (Control Region Word) region, which handles asynchronous hardware events; without it, the list of payl...

CVE-2026-80548 s390/vfio_ccw: Selectively expand io_mutex

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Selectively expand iomutex The iomutex was defined to serialize the ioregions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of race...

CVE-2026-74754 scsi: core: pair EH runtime PM get and put

In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost-ehnoresume is currently consulted twice in one error handling iteration: once before scsiautopmgethost and once again before scsiautopmputhost. That is racy when a PM-triggered err...

CVE-2026-74754

CVE-2026-74754 is a race condition in the Linux kernel SCSI core. The shost->eh_noresume flag is consulted twice per error-handling (EH) iteration—once before scsi_autopm_get_host() and once before scsi_autopm_put_host(). If a power-management path (e.g., ufshcd_set_dev_pwr_mode()) flips this ...

CVE-2026-74748 netfilter: ipset: fix refcount race between list:set GC and swap

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...

CVE-2026-74748

CVE-2026-74748 is a refcount race in the Linux kernel's netfilter ipset subsystem. The function __ip_set_put_byindex() resolves a set index under RCU but decrements the reference count only after acquiring ip_set_ref_lock. A concurrent ip_set_swap() call can interleave between these two steps, ca...

CVE-2026-74748 netfilter: ipset: fix refcount race between list:set GC and swap

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...

CVE-2026-74746 netfilter: flowtable: publish GC-visible tuple last

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd is still...

CVE-2026-74740

CVE-2026-74740 is a TOCTOU (time-of-check-time-of-use) NULL pointer dereference in the Linux kernel's net/sched: act_api subsystem. When handling TC_ACT_GOTO_CHAIN, tcf_action_exec() performs an initial rcu_access_pointer(a->goto_chain) check, then calls tcf_action_goto_chain_exec() which perf...

CVE-2026-79071

A flaw was found in Google Chrome's GPU component. A race condition in the GPU could allow a remote attacker, who has already compromised the renderer process, to potentially execute arbitrary code outside of the browser's security sandbox. This exploitation is achieved by enticing a user to visi...

CVE-2026-79057

A flaw was found in Google Chrome on Android. A race condition in the 'Start' component could allow a local attacker to potentially execute arbitrary code outside of the application's security sandbox. This exploitation requires leveraging social engineering and a co-installed application...

CVE-2026-79014

A flaw was found in Chromium's Autofill component. This race condition allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy. This bypass could enable the attacker to access or manipulate data from different web origins, potentially leading to...

CVE-2026-78906

A flaw was found in Chromium's ANGLE component. A race condition, triggered by a specially crafted HTML page, could allow a remote attacker to execute arbitrary code outside of the browser's security sandbox. This could lead to a complete compromise of the affected system...