bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie

...

net: remove WARN_ON_ONCE() from sk_mc_loop()

...

kernel: KEYS: fix overflow in keyctl_pkey_params_get_2()

A flaw was found in the Linux kernel's keyctlpkeyparamsget2 function within the KEYS subsystem. The vulnerability arises from an incorrect calculation of the internal output buffer's length, which can lead to a buffer overflow when a user-provided buffer is too small. This flaw could allow a loca...

kernel: KEYS: fix overflow in keyctl_pkey_params_get_2()

A flaw was found in the Linux kernel's keyctlpkeyparamsget2 function within the KEYS subsystem. The vulnerability arises from an incorrect calculation of the internal output buffer's length, which can lead to a buffer overflow when a user-provided buffer is too small. This flaw could allow a loca...

kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range

A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifssetrangedirty or ifssetrangeuptodate are called with a zero-length range. This can lead to an out-of-bounds write via bitmapset, potentially allowing a local attacker to cause memory corruptio...

The vulnerability of the l2cap_ecred_reconf_rsp() function in the net/bluetooth/l2cap_core.c module of the Linux kernel’s Bluetooth subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the l2capecredreconfrsp function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to synchronization errors. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility...

The vulnerability of the tmigrhandle_remote_cpu() function in the kernel/time/timer_migration.c module of the Linux kernel’s timer subsystem allows a hacker to cause a service failure.

The vulnerability of the tmigrhandleremotecpu function in the kernel/time/timermigration.c module of the Linux kernel’s timer subsystem is related to the execution of a loop with an unreachable exit condition „Infinite loop“. Exploiting this vulnerability could allow a remote attacker to cause a...

The vulnerability of the `create_securityfs_measurement_lists()` function in the `security/integrity/ima/ima_fs.c` module of the Linux kernel’s security subsystem allows a attacker to cause a service failure.

The vulnerability of the createsecurityfsmeasurementlists function in the security/integrity/ima/imafs.c module of the Linux kernel’s security subsystem is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a...

Linux Distros Unpatched Vulnerability : CVE-2026-80781

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset:...

The vulnerability of the af_alg_cmsg_send() function in the crypto/af_alg.c module of the Linux kernel’s cryptographic subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the afalgcmsgsend function in the crypto/afalg.c module of the Linux kernel’s cryptographic subsystem is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2026-85721

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrm state construct auth-trunc leak attach auth trunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadb alg id. One real case is cmacaes. xfrm state construct then...

Linux Distros Unpatched Vulnerability : CVE-2026-80738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Check skstate before skprotocol in bpftcpsyncookie bpftcpgensyncookie and bpftcpchecksyncookie accept a socket pointer 'sk' with argument type...

Linux Distros Unpatched Vulnerability : CVE-2026-80893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with...

CVE-2026-80727

In the Linux kernel, the following vulnerability has been resolved: x86/mce: Set up the polling timer before CMCI discovery I hit the following on one of my machines: mce: CPU0 BANK15 CMCI inherited storm ------------ cut here ------------ ODEBUG: assertinit not available active state 0 object:...

CVE-2026-80731

In the Linux kernel, the following vulnerability has been resolved: net: remove CAPSYSRAWIO zero-padding in devvalidateheader devvalidateheader reads dev-hardheaderlen directly when zero-padding short link layer headers for CAPSYSRAWIO holders: if capableCAPSYSRAWIO memsetllheader + len, 0,...

CVE-2026-80757

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread takes that nprim verbatim...

CVE-2026-80755

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count permread bounds a permission value by SELVECMAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image...

CVE-2026-80751

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prevo in mtkmfgattachdev mtkmfgattachdev reads prevo on the first iteration of its loop, in "if prevo && prevo-freq == o-freq", before prevo is assigned at the end of the loop body. On that fir...

CVE-2026-80740

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scale is large enough that scaledfont exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in...

CVE-2026-80736 thunderbolt: Fix bandwidth group reservation indexing

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAXGROUPS, while Group ID 0 is reserved. tbconsumeddpbandwidth uses the Group ID directly to index its local groupreserved array...