CVE-2026-80753

CVE-2026-80753 affects the Linux kernel's ovpn module , where deferred work items run on global system workqueues without a driver-owned drain point. During module exit, a workqueue worker can drop the final object reference that unblocks device teardown while still executing ovpn module text , c...

CVE-2026-80751 pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prevo in mtkmfgattachdev mtkmfgattachdev reads prevo on the first iteration of its loop, in "if prevo && prevo-freq == o-freq", before prevo is assigned at the end of the loop body. On that fir...

EUVD-2026-70356

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

CVE-2026-80752

CVE-2026-80752 affects the psxpad-spi input driver in the Linux kernel . The root cause is that psxpad_spi_suspend() retrieves the controller state via spi_get_drvdata(), but the probe function never stores the driver data. This results in a NULL pointer dereference when the system enters suspend...

CVE-2026-80752 Input: psxpad-spi - set driver data before use

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

CVE-2026-80751

CVE-2026-80751 is a Linux kernel vulnerability in the MediaTek PMIC Domain (pmdomain) mfg driver . In mtk_mfg_attach_dev(), the variable prev_o is read on the first iteration of a loop before being assigned, making its value indeterminate. If it evaluates to non-NULL, the kernel dereferences a st...

EUVD-2026-70355

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prevo in mtkmfgattachdev mtkmfgattachdev reads prevo on the first iteration of its loop, in "if prevo && prevo-freq == o-freq", before prevo is assigned at the end of the loop body. On that fir...

EUVD-2026-70354

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after ofnodeput scpsysgetbusprotectionlegacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap...

CVE-2026-80750

CVE-2026-80750 affects the Linux kernel 's MediaTek pmdomain (power management domain) driver. The vulnerable function scpsys_get_bus_protection_legacy() contains a use-after-free bug: two error paths call of_node_put() on a device node before checking whether the regmap lookup failed, then pass ...

CVE-2026-80749

CVE-2026-80749 affects the Linux kernel in the drm/connector/hdmi component. A helper function that copies an audio infoframe into the connector's copy used the destination size (60 bytes) instead of the source size (28 bytes) , resulting in an out-of-bounds read of 60 bytes from a 28-byte alloca...

CVE-2026-80749 drm/connector/hdmi: Fix out of bounds memory read

In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination a generic target, sized to accept many different data blocks...

CVE-2026-80750 pmdomain: mediatek: fix remaining %pOF after of_node_put()

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after ofnodeput scpsysgetbusprotectionlegacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap...

EUVD-2026-70353

In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination a generic target, sized to accept many different data blocks...

CVE-2026-80748 mmc: loongson2: Fix sg iteration in data reorder functions

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry...

CVE-2026-80748

CVE-2026-80748 affects the Linux kernel 's mmc loongson2 driver, specifically the ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data() functions. The root cause is an incorrect iteration pattern: the for_each_sg() macro already advances sg to the current scatterlist entry, but the ...

EUVD-2026-70352

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry...

CVE-2026-80747 drm/amdkfd: Add bounds check for CRAT subtype length

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...

EUVD-2026-70350

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix dispccmdssmdpclksrc RCG stall on Eliza EVK Eliza EVK eliza-cqs-evk.dts does not have display enabled, however its Display Clock Controller is enabled and references parent clocks from DSI PHYs, which...

CVE-2026-80746

CVE-2026-80746 affects the Linux kernel 's Qualcomm Display Clock Controller driver (dispcc-eliza ). On the Eliza EVK platform, the Display Clock Controller is enabled even though display is not, and it references parent clocks from DSI PHYs, causing a clock reparenting issue during probe. This r...

CVE-2026-80746 clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix dispccmdssmdpclksrc RCG stall on Eliza EVK Eliza EVK eliza-cqs-evk.dts does not have display enabled, however its Display Clock Controller is enabled and references parent clocks from DSI PHYs, which...