CVE-2026-89678

CVE-2026-89678 is a flaw in the Linux kernel's nfsd (NFS server daemon), specifically in the nfsd_direct_write() function. The partial-write detection logic compares host_err against segments[i].iter.count, which has already been advanced by vfs_iocb_iter_write() to the residual (original length ...

CVE-2026-81011

CVE-2026-81011 affects the Linux kernel's hp-bioscfg platform driver (platform/x86). The per-type package parsers derive the element count from elements[0] (the ACPI NAME field, always a string) rather than the validated obj->package.count, causing them to bound against the name string length ...

CVE-2026-81010

CVE-2026-81010 affects the Linux kernel's io_uring/waitid component. The function io_waitid_cb() fails to honor the tw.cancel flag when executed via the fallback task_work path from a kworker, causing __do_wait() to run in the wrong task context. Because waitid is task-context dependent, child lo...

PT-2026-90484

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing file open derives the path to be stored in the new backing file from user file-f path. This is incorrect when user file itself is a backing file, which is the case for nested...

PT-2026-90141

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hp init bios package attribute validates obj-package.count and then calls one of the five ...

PT-2026-90394

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsd direct write nfsd direct write walks a list of write segments and, after each vfs iocb iter write, tries to detect a short write so the loop can stop before placing the next segment at a...

CVE-2026-80231: Exposure of Data Element to Wrong Session

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

SUSE CVE-2026-80831

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxsdcpaesblockcrypt uses sgdmalen without mapping the source scatterlist with dmamapsg first. Therefore, sgdmalen is invalid and could return zero or a stale DMA length,...

CVE-2026-80910

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol-value.integer.value0 a long instead ...

CVE-2026-80910

CVE-2026-80910 affects the Linux kernel's lpass-wsa-macro ASoC codec driver. The root cause is that the get and put callbacks for the "EAR SPKR PA Gain" and four "WSA RX Mux" * enumerated controls access the value via ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enum...

CVE-2026-80875

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeofstruct ipv6hdr, while the surrounding IPVS code already parsed the packet with ipvsfilliphsk...

CVE-2026-80894

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed to iommufdautoresponsefaults on replace iommufdhwptreplacedevice calls: iommufdautoresponsefaultshwpt, oldhandle; passing the new hwpt together with the handle of the device's old domain. This shoul...

EUVD-2026-71505

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeofstruct ipv6hdr, while the surrounding IPVS code already parsed the packet with ipvsfilliphsk...

CVE-2026-80875

In the Linux kernel , the IPVS (IP Virtual Server) subsystem contained a bug in TCP state lookup for IPv6 packets. The code reparsed the socket buffer to locate the TCP header using a fixed offset of sizeof(struct ipv6hdr), rather than the already-computed transport-header offset stored in iph.le...

CVE-2026-80875 ipvs: use parsed transport offset in TCP state lookup

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeofstruct ipv6hdr, while the surrounding IPVS code already parsed the packet with ipvsfilliphsk...

AZL-99402 CVE-2026-80831 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxsdcpaesblockcrypt uses sgdmalen without mapping the source scatterlist with dmamapsg first. Therefore, sgdmalen is invalid and could return zero or a stale DMA length,...

EUVD-2026-71281

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxsdcpaesblockcrypt uses sgdmalen without mapping the source scatterlist with dmamapsg first. Therefore, sgdmalen is invalid and could return zero or a stale DMA length,...

EUVD-2026-70352

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry...

kernel: iommu/amd: Fix clone_alias() to use the original device's devid

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit AMD driver. The clonealias function incorrectly uses the device ID devid when handling alias devices. This can lead to the propagation of wrong or stale Device Table Entry DTE entries to alias devices, potentially...

CVE-2026-80679

A flaw was found in the Linux kernel. Specifically, within the s390/dasd component, the dasdreleasespace function incorrectly checks a function pointer by using a logical AND operator instead of a logical OR operator. This error can lead to a NULL pointer dereference, which may cause a system cra...