CVE-2026-80756

In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started selwriteload calls selinuxpolicycancel when selmakepolicynodes fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first...

CVE-2026-80755

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count permread bounds a permission value by SELVECMAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image...

CVE-2026-80754

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitter TX electrode count was incorrectly assigned the value of the receiver RX electrode count due to copy-paste typos. This...

CVE-2026-80753

In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point tha...

CVE-2026-80751

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prevo in mtkmfgattachdev mtkmfgattachdev reads prevo on the first iteration of its loop, in "if prevo && prevo-freq == o-freq", before prevo is assigned at the end of the loop body. On that fir...

CVE-2026-80750

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after ofnodeput scpsysgetbusprotectionlegacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap...

CVE-2026-80749

In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination a generic target, sized to accept many different data blocks...

CVE-2026-80748

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry...

CVE-2026-80747

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...

CVE-2026-80746

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix dispccmdssmdpclksrc RCG stall on Eliza EVK Eliza EVK eliza-cqs-evk.dts does not have display enabled, however its Display Clock Controller is enabled and references parent clocks from DSI PHYs, which...

CVE-2026-80745

In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEGtable mapping does not match the FP9931 datasheet. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h - 7.04V -7.04V 05h - 7.26V -7.26V 06h - 7.49V...

CVE-2026-80744

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftablesoffload: suppress WARNONONCE for ENOMEM in abort path In nftflowruleoffloadabort, WARNONONCEerr is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under...

CVE-2026-80743

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: pass auddrvdata to irq handlers The irq handlers take a struct device pointer and call devgetdrvdata to obtain the driver data. However, the driver data is only set at the end of probe, after...

CVE-2026-80741

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drmlogdrawkmsgrecord accesses slen - 1 to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINTMAX, causing an out-of-bounds read...

CVE-2026-80742

In the Linux kernel, the following vulnerability has been resolved: afpacket: Don't send zero-byte data in tpacketsnd. syzbot reported a WARNING in devqueuexmit triggered via tpacketsnd: skbassertlen WARNING: at include/linux/skbuff.h:2753 skbassertlen WARNING: at devqueuexmit+0x21bc/0x4970...

CVE-2026-80740

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scale is large enough that scaledfont exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in...

CVE-2026-80739

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock In case mlx5eaddfdbflow fails in lower levels, the flow is deleted via mlx5etcdelflow, and mlx5etcdelflow is acquiring ESW devcom lock without condition. In...

CVE-2026-80738

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skstate before skprotocol in bpftcpsyncookie bpftcpgensyncookie and bpftcpchecksyncookie accept a socket pointer 'sk' with argument type ARGPTRTOBTFIDSOCKCOMMON. However, they access sk-skprotocol without validating...

CVE-2026-80737

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port...

CVE-2026-80735

In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref skuserdata Some subsystems, like BPF SOCKMAP, set skuserdata without actually setting the encaptype. For this reason, we must make sure that the type is the one ovpn expects befor...