EUVD-2026-80514

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decoderangetlbi helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not...

EUVD-2026-80513

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables iterates dist-lpixa using xaforeach and dereferences the returned struct vgicirq in the loop body without holding a reference on the LP...

EUVD-2026-80512

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

EUVD-2026-80511

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means i...

EUVD-2026-80509

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Free init resources if kvminit fails kvmloongarchinit calls kvmloongarchenvinit to allocate the per-CPU kvmcontext vmcs and kvmloongarchops and to register the perf callbacks, and then calls kvminit. If kvminit...

EUVD-2026-80510

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Variable vector is declared on stack in function dmsintcinjectirq and sometimes it is used without initialized. Here fix this issue...

EUVD-2026-80508

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVMMRFLAGSONLY kvmarchpreparememoryregion computes new-arch.flags, i.e. whether a memslot is KVMMEMHUGEPAGECAPABLE or KVMMEMHUGEPAGEINCAPABLE, only for KVMMRCREATE and KVMMRMOVE, and...

EUVD-2026-80506

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...

EUVD-2026-80507

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pchmsisetirq passes e-msi.data straight into eiointcsetirq as the irq number. The MSI data comes from userspace, that either via a KVMIRQROUTINGMSI entry set with...

EUVD-2026-80505

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arenavmstart is dynamically enabled, it shifts the relative...

EUVD-2026-80503

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

EUVD-2026-80504

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix acpipackageids array overflow With LoongArch virt machine, a typical setting is one core per socket, there will max 256 sockets packages on one VM. With PPTT acpi table, array acpipackageids will be overflowed. Her...

EUVD-2026-80502

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

EUVD-2026-80501

In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2videounregisterdevice on disconnect to fix NULL deref airspydisconnect clears s-udev under v4l2lock, but airspystopstreaming unconditionally calls airspyctrlmsg and airspyfreestreambufs afterwards. If a...

EUVD-2026-80500

In the Linux kernel, the following vulnerability has been resolved: media: cec: core: Fix kmemleak due to missed rcfreedevice call The commit dccc0c3ddf8f "media: rc: fix race between unregister and urb/irq callbacks" removed the implicit call to rcfreedevice from rcunregisterdevice. However, the...

EUVD-2026-80499

In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in waitforcompletionkillable. If that wait is interrupted by a signal, canceldelayedworksync...

EUVD-2026-80498

In the Linux kernel, the following vulnerability has been resolved: media: cec: extron-da-hd-4k-plus: add sanity check Add check to prevent overflowing msg.msg in case the incoming data is malformed...

EUVD-2026-80497

In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cecreceivenotify reads the exclusive follower pointer without the adapter lock. Serialize the no-follower check and message delivery against mode changes and release...

EUVD-2026-80496

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: fix memory leak in cedrusinitctrls In cedrusinitctrls, the V4L2 control handler is initialized before allocating memory for ctx-ctrls. If this allocation fails, the function returns -ENOMEM without freeing the...

EUVD-2026-80494

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

EUVD-2026-80495

In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice sndcobaltcardcreate stores cobsc in sc-privatedata and installs sndcobaltcardprivatefree as sc-privatefree. From that point, sndcardfreesc releases cobsc through the ALSA card...

EUVD-2026-80493

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netupciexit frees a netupcistate while its work item, netupreadcistatus, may still be pending or running on the system workqueue. The worker obtains the state with containerof...

EUVD-2026-80492

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: defer audio-only extension registration The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before devnext is created. The duplicate device inherits...

EUVD-2026-80490

In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007sndinit already takes a v4l2device reference for the ALSA side, but go7007sndremove drops it immediately after calling sndcardfreewhenclosed. That is too early when ...

EUVD-2026-80491

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: fix use-after-free of devnext-devlist on disconnect When a device with hasdualts=1 is probed and the isaudioonly path is taken, both dev and dev-devnext are added to the global em28xxdevlist via em28xxinitextension...

EUVD-2026-80489

In the Linux kernel, the following vulnerability has been resolved: media: i2c: imx415: Release runtime PM reference on VBLANK error The VBLANK path returned immediately when programming VMAX failed after pmruntimegetifinuse had taken a runtime PM reference. Break out of the switch instead so the...

EUVD-2026-80487

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740remove function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a...

EUVD-2026-80488

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov02a10: fix endpoint parsing use-after-free The ov02a10checkhwcfg function calls fwnodehandleputep immediately after allocating and parsing the endpoint. However, it subsequently calls fwnodepropertyreadu32 using the...

EUVD-2026-80486

In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix async notifier cleanup leak on parse error isysnotifierinit calls v4l2asyncnfinit and then adds fwnode remote subdevs in a loop with v4l2asyncnfaddfwnoderemote. If an endpoint parse or add fails partway...

EUVD-2026-80485

In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: Fix SCP device refcounting mdpprobe first tries to get the SCP handle with scpget. When that fails, it falls back to looking up the SCP platform device with getpdevbyid and then reads its driver data. T...

EUVD-2026-80484

In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Add the missing sanity check after looking up the SCP to avoid dereferencing a NULL-pointer in case its driver has not yet been bound...

EUVD-2026-80483

In the Linux kernel, the following vulnerability has been resolved: media: rc: sunxi-cir: Unregister rc device on probe failure After rcregisterdevice succeeds, later probe failures must undo the registration with rcunregisterdevice. The current error path jumps to the allocation cleanup label an...

EUVD-2026-80482

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTERREFPICSETPRED index underflow strefpicsetprediction computes the reference RPS index as strpsidx - deltaidxminus1 + 1 per HEVC spec equation 7-59. Both operands are u8, so when deltaidxminus1 + 1...

EUVD-2026-80480

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: release URBs and stream buffers on startstreaming failure rtl2832sdrstartstreaming calls rtl2832sdrallocstreambufs, rtl2832sdrallocurbs and rtl2832sdrsubmiturbs in sequence and shares a single err: label that...

EUVD-2026-80481

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...

EUVD-2026-80479

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

EUVD-2026-80478

In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob fw-datafwsize - 8 and fwsize - 4. If the firmware file is shorter than 8...

EUVD-2026-80477

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164devsetup adds the device to the global saa7164devlist before requesting the PCI BAR memory regions. If getresources fails, saa7164devsetup decrements the device...

EUVD-2026-80476

In the Linux kernel, the following vulnerability has been resolved: media: tda18250: fix possible integer overflow Integer overflow may occur, when variable exp equals to zero. Result of shift 1 exp - 1 may then leads to undefined behavior...

EUVD-2026-80474

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2asyncmatchnotify creates ancillary media links before adding asc-ascsubdeventry to sd-asclist. If ancillary link creation fails, the function jumps to...

EUVD-2026-80475

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: quiesce overflow recovery before freeing streams The VIP overflow recovery worker is armed from the hardirq handler when a FIFO overflow is detected, and the list-complete path looks the stream up through the VPDM...

EUVD-2026-80473

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC EXT SPS RPS counts The HEVC SPS control carries the short-term and long-term RPS counts that decoder drivers use to walk the matching EXT SPS dynamic arrays. Reject SPS values that exceed the HEVC...

EUVD-2026-80472

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix fwnode leak in v4l2fwnodeparselink In v4l2fwnodeparselink, the remote endpoint fwnode reference is acquired using fwnodegraphgetremoteendpoint. This reference is properly released in the error paths, but i...

EUVD-2026-80471

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthreadvidcap on failure kthreadrun returns an ERRPTR on failure, not NULL. When startstreaming fails, data-kthreadvidcap is left holding this error pointer instead of being...

EUVD-2026-80470

In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered videodevice twice zoraninitvideodevice installs zoranvdevrelease as the videodevice release callback through zorantemplate. After videoregisterdevice succeeds, videounregisterdevice drops...

EUVD-2026-80469

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...

EUVD-2026-80468

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add timeout while stopstreaming When stopstreaming is called, an infinite loop may occur in some cases. Add a bounded poll of the queue status: loop until the queues drain, sleeping briefly between poll...

EUVD-2026-80467

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Defer jobfinish only when a DECPIC was queued Decoder instances sharing a VPU also share one v4l2m2m job slot, released when the running context calls v4l2m2mjobfinish. While draining, devicerun defers...

EUVD-2026-80466

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Resume device before setting EOS flag Setting the EOS flag talks to the firmware via sendfirmwarecommand, which accesses VPU registers. Both the STREAMOFF path wave5vpudecjobabort and the V4L2DECCMDSTOP...

EUVD-2026-80464

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...