EUVD-2026-71665

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

CVE-2026-80906

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

CVE-2026-80906 net: packet: fix wrong transport_header when sending VLAN-tagged frame

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

CVE-2026-80867

In the Linux kernel, the following vulnerability has been resolved: alpha/PCI: Add securitylockeddown check to pcimmapresource Currently, Alpha's pcimmapresource does not check securitylockeddownLOCKDOWNPCIACCESS before allowing userspace to mmap PCI BARs. The generic version has had this check...

AZL-99416 CVE-2026-80841 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmallo...

CVE-2026-80784

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix memory leak from alloc-during-teardown race mptcppmdestroy empties msk-pm.annolist and msk-pm.userspacepmlocaladdrlist under msk-pm.lock during socket teardown, dropping the lock between the two. A concurrent...

CVE-2026-80807

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

CVE-2026-80818

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

CVE-2026-80771

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set inputregisterdevice exposes the device to userspace immediately. In joyconinputcreate it was called before joyconconfigrumble configures the FFRUMBLE capability and...

CVE-2026-80836

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtiocryptodataqakciphercallback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the origin...

CVE-2026-80797

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: purge fragmented skbs during cleanup pn53xcommonclean purges respq before freeing the common PN533 state, but it leaves fragmentskb untouched. The fragmentation helpers queue transmit fragments there while sending lar...

CVE-2026-80806

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4setinodeflagsinode, init=true in ext4newinode is made before EXT4INODEENCRYPT is set. As a result, it can set...

CVE-2026-80843

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...

CVE-2026-80863

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in freerdatomicresources freerdatomicresources iterates using qp-attr.maxdestrdatomic. Updating maxdestrdatomic before freeing the old array can make the free path walk past the old allocation and trigger a slab...

CVE-2026-80829

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput sndusbmidinovationoutput lays out a two-byte header at transferbuffer0..1 and passes &transferbuffer2 together with a length of ep-maxtransfer - 2 to sndrawmiditransmit:...

CVE-2026-80790

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: fix invalid free in LS IOD error path nvmetfcalloclsiodlist advances iod while initializing the LS IOD array. If an rqstbuf allocation or response buffer DMA mapping fails, the unwind loop decrements iod past the start ...

CVE-2026-80792

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...

CVE-2026-80858

In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuseuringcreatequeue initializes a fuseringqueue and then publishes the pointer into ring-queuesqid with WRITEONCE under the fch-lock. There are several readers that may...

CVE-2026-18567

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory...

CVE-2026-18567 IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory...