CVE-2026-80576

CVE-2026-80576 affects the Linux kernel's drm/amdgpu driver. In amdgpu_cs_p2_ib(), a user-supplied ib_bytes value was passed to ib->length_dw without a limit. Since ring_emit_ib() encodes this length into packet fields, oversized values can corrupt adjacent control bits , destabilizing command...

CVE-2026-80575 Input: cs40l50-vibra - validate custom data from user space

In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50add copies the custom data of an FFPERIODIC/FFCUSTOM effect straight from the ffeffect the user passed to EVIOCSFF, without requiring it to hold anything:...

CVE-2026-80573 Input: iforce - validate input packet lengths

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

CVE-2026-80573

CVE-2026-80573 affects the iforce input driver in the Linux kernel . The function iforce_process_packet() reads fixed fields from joystick, wheel, and status packets without first validating their lengths. Specifically, the shared hats-and-buttons helper unconditionally reads data[6], the status ...

CVE-2026-80573 Input: iforce - validate input packet lengths

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

CVE-2026-80571 powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...

EUVD-2026-66486

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...

CVE-2026-80571

CVE-2026-80571 affects the Linux kernel on powerpc/pseries systems, specifically the papr-phy-attest driver. In the function papr_phy_attest_create_handle() , the field params->cmd.length is not validated before use, which can result in a buffer overflow . The driver also fails to free params ...

CVE-2026-80571 powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...

CVE-2026-80566 Input: hynitron_cstxxx - validate touch count and finger IDs

In the Linux kernel, the following vulnerability has been resolved: Input: hynitroncstxxx - validate touch count and finger IDs The driver allocates maxtouchnum input slots, which are indexed from zero through maxtouchnum - 1. The current check allows a finger ID equal to maxtouchnum to reach...

EUVD-2026-66481

In the Linux kernel, the following vulnerability has been resolved: Input: hynitroncstxxx - validate touch count and finger IDs The driver allocates maxtouchnum input slots, which are indexed from zero through maxtouchnum - 1. The current check allows a finger ID equal to maxtouchnum to reach...

CVE-2026-80566 Input: hynitron_cstxxx - validate touch count and finger IDs

In the Linux kernel, the following vulnerability has been resolved: Input: hynitroncstxxx - validate touch count and finger IDs The driver allocates maxtouchnum input slots, which are indexed from zero through maxtouchnum - 1. The current check allows a finger ID equal to maxtouchnum to reach...

CVE-2026-80546

CVE-2026-80546 affects the s390/zcrypt subsystem of the Linux kernel, specifically the xcrb_msg_to_type6cprb_msgx() function. Three related input-validation flaws allow a local attacker with low privileges to trigger: (1) integer overflow during CEIL4 alignment, leading to undersized buffer alloc...

CVE-2026-80546 s390/zcrypt: Improve CCA CPRB length and overflow checks

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrbmsgtotype6cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could...

CVE-2026-80546 s390/zcrypt: Improve CCA CPRB length and overflow checks

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrbmsgtotype6cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could...

CVE-2026-80545

CVE-2026-80545 affects the Linux kernel's s390 zcrypt subsystem, specifically the xcrb_msg_to_type6_ep11cprb_msgx() function. The function copies the ep11_cprb structure and payload fields from userspace without verifying sufficient buffer length, and a CEIL4 arithmetic overflow can bypass size c...

CVE-2026-80545 s390/zcrypt: Improve EP11 CPRB length and overflow checks

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrbmsgtotype6ep11cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11cprb structure and...

CVE-2026-80545 s390/zcrypt: Improve EP11 CPRB length and overflow checks

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrbmsgtotype6ep11cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11cprb structure and...

CVE-2026-80541 drm/amdgpu: validate GEM_CREATE domain combinations

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...

CVE-2026-80541

A vulnerability in the Linux kernel's drm/amdgpu driver allows a local, low-privileged user to trigger a kernel BUG_ON() crash by crafting a GEM_CREATE ioctl with an invalid combination of domain flags (e.g., CPU|GTT|VRAM combined with DOORBELL, GDS, GWS, or OA). The root cause is that while indi...