CVE-2026-80823

nfc: st21nfca: validate ATRREQ length against the received frame...

CVE-2026-80822

mailbox: mchp-ipc-sbi: Add null check for devmkasprintf...

CVE-2026-80821

nvmet: pci-epf: put CQ ref on createcq mapping failure...

CVE-2026-80820

xfs: don't livelock in scrub on a circular unlinked list...

CVE-2026-80819

Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept...

CVE-2026-80818

iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown...

CVE-2026-80817

iommu/iommufd: Fix NULL pointer deref in iommufdioaschangeprocess when racing with ioptmapfilepages...

CVE-2026-80816

ALSA: FCP: Use a private URB for the notification endpoint...

CVE-2026-80815

ALSA: scarlett2: Use a private URB for the notification endpoint...

CVE-2026-80814

rndishost: add overflow check in rndisrxfixup...

CVE-2026-80813

nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist...

CVE-2026-80812

ALSA: dummy: Check card index validity at probe...

CVE-2026-80811

iouring/cmd: fix iovec leak when the async cmd is not recycled...

CVE-2026-80810

iouring/rsrc: fix folio size overflow in iovecfillbvec...

CVE-2026-80809

ocfs2: fix missing metadata reservation for large xattrs...

CVE-2026-80808

ext4: stop retrying saturated xattr cache entries...

CVE-2026-80807

nilfs2: reject invalid block index in GC ioctl...

CVE-2026-80806

ext4: don't enable DAX on new encrypted files...

CVE-2026-80805

xfs: validate attr entry pointer before field access...

CVE-2026-80804

xfs: restore nofs context unconditionally in xfstransroll...

CVE-2026-80803

nfc: digital: clamp SENSFRES length to the destination buffer...

CVE-2026-80802

nfc: fdp: bound the device-reported read length and fix an skb leak...

CVE-2026-80801

nfc: microread: validate target discovery payload lengths...

CVE-2026-80800

nfc: llcp: bound the connectsn TLV walk to the skb...

CVE-2026-80799

nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers...

CVE-2026-80798

nfc: llcp: reject PDUs shorter than the LLCP header...

CVE-2026-80797

nfc: pn533: purge fragmented skbs during cleanup...

CVE-2026-80796

nfc: nci: add datalen bound checks to activation parameter extractors...

CVE-2026-80795

nfc: nci: fix out-of-bounds write in ncitargetautoactivated...

CVE-2026-80794

nfc: nci: fix uninit-value in the RF discover/activated NTF handlers...

CVE-2026-80793

ipv4: reject undersized MTUs in ipdofragment...

CVE-2026-80792

ipv6: fix use-after-free in ip6finishoutput2...

CVE-2026-80791

nvmet-auth: zero the AUTHRECEIVE response buffer...

CVE-2026-80790

nvmet-fc: fix invalid free in LS IOD error path...

CVE-2026-80789

nvmet-tcp: bound SGL data length before allocating command buffers...

CVE-2026-80788

nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations...

CVE-2026-80787

nvmet: pci-epf: fix use-after-free in nvmetpciepfexeciodwork...

CVE-2026-80785

fbdev: serialize mode sysfs access with lockfbinfo...

CVE-2026-80786

fbdev: Wrap user-invoked calls to fbsetvar in helper...

CVE-2026-80784

mptcp: pm: fix memory leak from alloc-during-teardown race...

CVE-2026-80783

HID: magicmouse: prevent unbounded recursion in magicmouserawevent...

CVE-2026-80782

HID: magicmouse: do not keep a stale msc-input if no input is claimed...

CVE-2026-80780

HID: pidff: fix OOB write when hid-inputs is empty...

CVE-2026-80781

HID: core: fix OOB read of field-usage in hidsetfield...

CVE-2026-80779

net/ionic: avoid OOB TX partner lookup for hwstamp RXQ...

CVE-2026-80778

futex/pi: Reject cross-mm private futex owners...

CVE-2026-80777

futex/pi: Plug private futex exec race...

CVE-2026-80776

futex: Fix race in futexpivotpending during private hash resize...

CVE-2026-80775

futex: Fix race on the initial mm-futex.phash.ref allocation...

CVE-2026-80774

HID: asus: fix missing hidisusb check...