UBUNTU-CVE-2026-80541

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...

CVE-2026-80526

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

SUSE CVE-2026-74273

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion and attachtarget, as well as the period between...

PRISM: Lightweight Enclave Isolation with Prismatic Capabilities

Trusted execution environments TEEs protect sensitive code and data from external interference, but lack inherent memory safety. CHERI can enforce spatial memory safety at the object level. Attempts to establish a TEE using CHERI primitives suffer from 1 expensive capability revocation operations...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098969)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098969 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroupstoragegetnextkey listnextentry never returns NULL -- whe...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098768)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098768 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099012)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099012 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4: replace BUGON with WARNON in fence emission sdmav40ringemitfence contains two...

CVE-2025-36940

Use-After-Free vulnerability in a zircon kernel pager proxy Fuchsia, which could lead to a Privilege Escalation from Userspace to Kernel AP...

CVE-2025-36940

A Use-After-Free vulnerability exists in a zircon kernel pager proxy within the Fuchsia operating system. This flaw could potentially lead to Privilege Escalation from Userspace to Kernel (AP). No specific affected versions, root cause details, or remediation steps are provided in the documents. ...

EUVD-2025-210765

Use-After-Free vulnerability in a zircon kernel pager proxy Fuchsia, which could lead to a Privilege Escalation from Userspace to Kernel AP...

CVE-2026-9728

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

A flaw was found in the Kernel-based Virtual Machine KVM for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 L1 intercepts during the completion of userspace I/O emulation for a Level 2 L2 instruction. If the L1 or host userspace modifies I/O interception settings during thi...

CVE-2026-9728

CVE-2026-9728 is a time-of-check/time-of-use (TOCTOU) race condition in the Zephyr RTOS userspace mailbox subsystem. The syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validates msg->data/msg->size by reading them directly from live userspace memory, then forwards the o...

CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...

CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...

EUVD-2026-64897

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...

CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvmvcpuioctlinterrupt The function kvmvcpuioctlinterrupt can be called from userspace. Here, checking of irq validity is added within kvmvcpuioctlinterrupt...

CVE-2026-9728: Time-of-check Time-of-use (TOCTOU) Race Condition

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...

PT-2026-80925

Name of the Vulnerable Software and Affected Versions Fuchsia affected versions not specified Description A Use-After-Free issue exists in a zircon kernel pager proxy. This flaw allows for privilege escalation from userspace to the kernel AP. Use-After-Free is a memory corruption flaw that occurs...