CVE-2026-80952

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

CVE-2026-89587

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability querycapability copies four ACPI buffer objects returned by the firmware DSM into fixed-size u816 fields in struct pfruupdatecapinfo using memcpy with the...

CVE-2026-81007

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

UBUNTU-CVE-2026-89587

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability querycapability copies four ACPI buffer objects returned by the firmware DSM into fixed-size u816 fields in struct pfruupdatecapinfo using memcpy with the...

DEBIAN-CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

UBUNTU-CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

UBUNTU-CVE-2026-80952

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

UBUNTU-CVE-2026-80975

In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...

UBUNTU-CVE-2026-89600

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotifyprecontent builds its filerange on the triggering task's stack. fanotifyallocpermevent saves a pointer to range.pos in the heap-allocated permission event so...

UBUNTU-CVE-2026-81007

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

CVE-2026-80944

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

DEBIAN-CVE-2026-80944

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

AZL-100650 CVE-2026-80944 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

DEBIAN-CVE-2026-80927

In the Linux kernel, the following vulnerability has been resolved: timekeeping: Check the return value of tkgetauxts64 in doadjtimex If the auxiliary clock is disabled during tkgetauxts64 but is enabled before tks-clockvalid is checked, then uninitialized stackdata will be used in the calculatio...

CVE-2026-80927

In the Linux kernel, the following vulnerability has been resolved: timekeeping: Check the return value of tkgetauxts64 in doadjtimex If the auxiliary clock is disabled during tkgetauxts64 but is enabled before tks-clockvalid is checked, then uninitialized stackdata will be used in the calculatio...

CVE-2026-80944

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

UBUNTU-CVE-2026-80944

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

EUVD-2026-76677

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

CVE-2026-89765

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

CVE-2026-89759

CVE-2026-89759 affects the Linux kernel's mm/kmemleak subsystem. The root cause is that kmemleak_scan() walks every task stack under a single rcu_read_lock() with no reschedule point; on hosts with a very large number of threads (amplified by KASAN/lockdep in debug builds), the loop can hog a CPU...