CVE-2026-80723

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

CVE-2026-80712

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...

CVE-2026-80711

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWERSUPPLYPROPSTATUS to a supplier power supply. If no supplier is registered,...

CVE-2026-80714

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ipvsbinddest copies connection flags from the destination into cp-flag...

CVE-2026-80690

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

CVE-2026-80622

In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclkcleanup This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the fileoperations structure does not specify...

CVE-2026-80635

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

CVE-2026-80599

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible ethhdr proto field When batadvgetvid accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to...

CVE-2026-80678

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

CVE-2026-80689

In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmiotracearray in logging functions mmiotracerw and mmiotracemapping retrieve mmiotracearray into tr and pass it to tracemmiotracerw and tracemmiotracemap. If these functions are invoked whil...

CVE-2026-80681

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80693

In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpfgetregintrvecs fills the caller-allocated regvals array from the VIRTCHNL2OPALLOCVECTORS reply in adapter-reqvecchunks, bounding its inner loop only by the...

CVE-2026-80659

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

CVE-2026-80677

In the Linux kernel, the following vulnerability has been resolved: driver core: use READONCE for dev-driver in devhassyncstate devhassyncstate reads dev-driver twice without holding devicelock -- once for the NULL check and once to dereference -syncstate. Some callers only hold...

CVE-2026-80663

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...

CVE-2026-80612

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

CVE-2026-80615

In the Linux kernel, the following vulnerability has been resolved: net: dstmetadata: fix false-positive memcpy overflow in tundstunclone kmallocflex in metadatadstalloc sets countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure ...

CVE-2026-80674

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode's $ATTRIBUTELIST is sanity-checked by loadattributelist only on the non-resident path; ntfsreadlockedinode copies a resident attribute list into...

CVE-2026-80696

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Fix reading the minimum alarm voltage Coverity reports an out-of-bounds access when reading the minimum alarm voltage for the VGPIO channel. Add the missing return statement to fix the problem...

CVE-2026-80616

In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARNON on -ENOMEM in cfg802154switchnetns It's pointless to call WARNON in case of an allocation failure in devchangenetnamespace and devicerename, since it only leads to useless splats caused by...

CVE-2026-80715

In the Linux kernel, the following vulnerability has been resolved: igc: remove napisynchronize in igcdown When an AFXDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igccleanrxirqzc then returns the full budget on every poll, so napicompletedone neve...

CVE-2026-80704

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80720

In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bioset for iomapsplitioend iomapsplitioend can split bios that already come from iomapioendbioset and thus deadlock when the bioset is exhausted. Add a separate bioset to avoid this deadlock. Christian Braun...

CVE-2026-80648

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

CVE-2026-80628

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q-lock sndseqossreadqclear resets qlen, head, and tail without q-lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset ca...

CVE-2026-80630

In the Linux kernel, the following vulnerability has been resolved: net/sched: schfqcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever fqcodel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog befo...

CVE-2026-80645

In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721dbdpc With a listforeach loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid...

CVE-2026-80602

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AM...

CVE-2026-80598

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompresslznt decompresslznt does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read...

CVE-2026-80629

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: npc: Fix size of entry2cntrmap KASAN prints below splat. This is caused by allocating counter for reserved mcam entry for cpt 2nd pass entry. But mcam-entry2cntrmap is not allocated for reserved entries. BUG: KASAN:...

CVE-2026-80654

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition...

CVE-2026-80658

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Fix null-ptr-deref in dwdpremove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

CVE-2026-80639

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains that it is potentially overflowing the xormaps array per countedbynrmaps. Quiet the false positive by initializing @nrmaps earlier. memcpy:...

CVE-2026-80709

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

CVE-2026-80650

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: gc2235: fix UAF and memory leak gc2235probe handles its error paths incorrectly. If mediaentitypadsinit fails, gc2235remove is called, which tears down the subdev and frees dev, but then still falls through to...

CVE-2026-80621

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS DES capability, leaving pci-debugfs-rasdesinfo unset. The common debug...

CVE-2026-80631

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzodecompressbio validates each on-disk segment length seglen only against the workspace cbuf size, not against the compressed input size compressedlen, th...

CVE-2026-80600

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

CVE-2026-80717

In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctpverifyparam accepts a header-only parameter...

CVE-2026-80719

In the Linux kernel, the following vulnerability has been resolved: mm: mglru: fix stale batch updates after memcg reparenting The mglru page table walker batches per-generation size deltas in walk-nrpages while walking page tables without holding the lruvec lock. The resetbatchsize later folds...

CVE-2026-80710

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

CVE-2026-80638

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2removerefcountextent BUG Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. CAUSE When the last leaf block is removed fro...

CVE-2026-80620

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

CVE-2026-80649

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix OOB in scmipowernameget scmipowernameget does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access. Fix this by returning "unknown" for invalid domains, li...

CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80724

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclockmiscdevmmap rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VMMAYWRITE set. Userspace can map the page read-only and then...

CVE-2026-80684

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...

CVE-2026-80691

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

CVE-2026-80651

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...