CVE-2026-80696

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Fix reading the minimum alarm voltage Coverity reports an out-of-bounds access when reading the minimum alarm voltage for the VGPIO channel. Add the missing return statement to fix the problem...

CVE-2026-80694

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: pass eth to mtkhandleirqrx in pollcontroller mtkhandleirqrx expects a struct mtketh matching the requestirq cookie, but mtkpollcontroller incorrectly passed the netdevice . Calling ndopollcontroller with...

CVE-2026-80693

In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpfgetregintrvecs fills the caller-allocated regvals array from the VIRTCHNL2OPALLOCVECTORS reply in adapter-reqvecchunks, bounding its inner loop only by the...

CVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-80691

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

CVE-2026-80690

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

CVE-2026-80689

In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmiotracearray in logging functions mmiotracerw and mmiotracemapping retrieve mmiotracearray into tr and pass it to tracemmiotracerw and tracemmiotracemap. If these functions are invoked whil...

CVE-2026-80688

In the Linux kernel, the following vulnerability has been resolved: riscv: drop init from veccheckunalignedaccessspeedallcpus This function runs within a kthread and need not necessarily finish before system finishes boot and freeinitmem unmaps the .init.text section. This function makes calls to...

CVE-2026-80687

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80686

In the Linux kernel, the following vulnerability has been resolved: mm: migratedevice: fix ptepfn/ptedirty called on non-present PTE ptepfn and ptedirty have undefined behaviour when called on a non-present PTE. In migratevmacollectpmd, these functions may be invoked on non-present entries e.g.,...

CVE-2026-80685

In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read page2 for order-1 folios in snapshotpage snapshotpage currently reads page2 after checking nrpages 1, but it should only do so when nrpages 2. If an order-1 folio is allocated at the end of a vmemmap section,...

CVE-2026-80683

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

CVE-2026-80684

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...

CVE-2026-80682

In the Linux kernel, the following vulnerability has been resolved: riscv/mm: use physical alignment for vmemmapstartpfn RISC-V computes vmemmapstartpfn by rounding physrambase down to VMEMMAPADDRALIGN. That alignment must therefore be expressed in the physical-address domain. Commit 476849b0fba4...

CVE-2026-80680

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amdmp2registercb stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2caddadapter fails, probe returns and devres...

CVE-2026-80681

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80678

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

CVE-2026-80679

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasdreleasespace checks the implementation of the isese discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND...

CVE-2026-80677

In the Linux kernel, the following vulnerability has been resolved: driver core: use READONCE for dev-driver in devhassyncstate devhassyncstate reads dev-driver twice without holding devicelock -- once for the NULL check and once to dereference -syncstate. Some callers only hold...

CVE-2026-80676

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: use generic driveroverride infrastructure When a driver is probed through driverattach, the bus' match callback is called without the device lock held, thus accessing the driveroverride field without a lock,...

CVE-2026-80675

In the Linux kernel, the following vulnerability has been resolved: libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map-sha against the metadata hash in its instructions. map-sha is calculated when BPFOBJGETINFOBYFD is called on the frozen map. While the map is...

CVE-2026-80674

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode's $ATTRIBUTELIST is sanity-checked by loadattributelist only on the non-resident path; ntfsreadlockedinode copies a resident attribute list into...

CVE-2026-80672

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80673

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfsexternalattrfind When resolving an attribute lookup with a non-zero @lowestvcn, ntfsexternalattrfind peeks at the next $ATTRIBUTELIST entry to decide whether to keep searchin...

CVE-2026-80670

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perfenvgetcputopology in machineresolve machineresolve accesses env-cpual-cpu.socketid after checking al-cpu = 0 and env-cpu != NULL, but without validating al-cpu against env-nrcpusavail. Since al-cpu comes from...

CVE-2026-80671

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80667

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete on devcom error mlx5mpeswwork returned without calling complete when mlx5laggetdevcomcomp returned NULL. A caller that queued the work and waited on mpesww-comp would block indefinitely...

CVE-2026-80668

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker t...

CVE-2026-80666

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80664

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtnat: reject unsupported target families xtnat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nftcompa...

CVE-2026-80662

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXLHEADERLOGSIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes CXLRASCAPABILITYLENGTH; the Header Log occupies the trailing 64 bytes at offset 0x18...

CVE-2026-80663

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...

CVE-2026-80661

In the Linux kernel, the following vulnerability has been resolved: ufs: core: tracing: Do not dereference pointers in TPprintk The trace events in drivers/ufs/core/ufstrace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TPprintk the printing...

CVE-2026-80660

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ unregister sysfs devices outside occ lock occactivefalse and occshutdown unregister sysfs-backed devices while occ-lock is held. hwmondeviceunregister and sysfsremovegroup can wait for active sysfs callbacks to drain,...

CVE-2026-80659

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

CVE-2026-80658

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Fix null-ptr-deref in dwdpremove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

CVE-2026-80657

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmtchann has already been destroyed. Add NULL checks to...

CVE-2026-80656

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted nodesize value of ...

CVE-2026-80655

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent. However, the work structures zynqmppminitsuspendwork and...

CVE-2026-80654

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

CVE-2026-80653

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Add slavedestroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at...

CVE-2026-80652

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80651

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...

CVE-2026-80650

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: gc2235: fix UAF and memory leak gc2235probe handles its error paths incorrectly. If mediaentitypadsinit fails, gc2235remove is called, which tears down the subdev and frees dev, but then still falls through to...

CVE-2026-80649

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix OOB in scmipowernameget scmipowernameget does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access. Fix this by returning "unknown" for invalid domains, li...

CVE-2026-80648

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

CVE-2026-80647

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix warning in poll cq direct mode CQs allocated by iballoccq always have a comphandler. Though in direct mode this handler is never expected to be called, it is still called when the driver is reset, triggering the...

CVE-2026-80646

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...