UBUNTU-CVE-2026-80654

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

CVE-2026-80655

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent. However, the work structures zynqmppminitsuspendwork and...

EUVD-2026-67530

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

CVE-2026-80654

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

CVE-2026-80654 soc: xilinx: Shutdown and free rx mailbox channel

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

CVE-2026-80654

CVE-2026-80654 affects the soc: xilinx driver in the Linux kernel . A use-after-free occurs in the rx mailbox channel handling: an incorrect condition check in the remove callback prevents proper cleanup when rx_chan is non-NULL, leaving the mailbox channel active after device removal. The channe...

CVE-2026-80632 wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

CVE-2026-80654: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

PT-2026-82994

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mtk eth soc ethernet driver where the mtk poll controller function incorrectly passes a net device pointer instead of a mtk eth structure pointer to the mtk handle...

PT-2026-82932

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996 init tx queues When MT76 NPU and CONFIG NET MEDIATEK SOC WED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996 init tx queues will dereference a NULL WED...

PT-2026-82954

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use after free issue exists in the Linux kernel within the xilinx soc component. The problem occurs during the device removal process when the mbox request channel byname function is...

CVE-2026-80632: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

Linux Distros Unpatched Vulnerability : CVE-2026-80654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox...

ROS-20260826-73-0007

The vulnerability of the txmacroputdecenum function in the sound/soc/codecs/lpass-tx-macro.c module related to the Linux operating system’s SoC audio support is associated with out-of-buffer writing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrit...

The vulnerability of the mpfs_sys_controller_probe() function in the drivers/soc/microchip/mpfs-sys-controller.c file of the SOC kernel driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the mpfssyscontrollerprobe function in the drivers/soc/microchip/mpfs-sys-controller.c file of the Linux operating system’s SOC System on Chip kernel module is related to improper memory release. Exploitation of this vulnerability can allow a remote attacker to cause a servic...

ROS-20260825-73-0024

The vulnerability of the wcd938xmbhcinit function in the sound module/soc/codecs/wcd938x.c file, which is part of the Linux operating system’s SoC audio support, involves dereferencing an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a system failure...

CVE-2026-74729: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread putfifowithdiscard acts as both producer and consumer on the kfifo: it calls kfifoskip advances out and kfifoput advances in from the IRQ handler without synchronizin...

CVE-2024-13942

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...

CVE-2024-13942

The RK3588s BootROM (secure) version 350B20210512V100 reads the next-stage loader header twice: a partial read (module hashes only) and a full read (with signature). Module authenticity is checked against the partial data, enabling a TOCTOU attack where an attacker swaps in a modified header on-t...

EUVD-2024-55729

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...