CVE-2026-81013

CVE-2026-81013 is a heap out-of-bounds read in the Linux kernel's hp-bioscfg platform driver. The root cause is in validate_password_input(), which computes length = strlen(buf) and then checks buf[length - 1] to strip a trailing newline without first verifying that length is nonzero. Writing a b...

CVE-2026-81011

CVE-2026-81011 affects the Linux kernel's hp-bioscfg platform driver (platform/x86). The per-type package parsers derive the element count from elements[0] (the ACPI NAME field, always a string) rather than the validated obj->package.count, causing them to bound against the name string length ...

CVE-2026-81010

CVE-2026-81010 affects the Linux kernel's io_uring/waitid component. The function io_waitid_cb() fails to honor the tw.cancel flag when executed via the fallback task_work path from a kworker, causing __do_wait() to run in the wrong task context. Because waitid is task-context dependent, child lo...

CVE-2026-81009

CVE-2026-81009 affects the Linux kernel in the io_uring/query subsystem. The function io_handle_query_entry() clamps hdr.size for the inbound copy_from_user() but retains the original user-supplied value as usize. When passed to copy_struct_to_user(), an oversized usize triggers clear_user() on t...

CVE-2026-81008

CVE-2026-81008 is a slab use-after-free in the Linux kernel's interconnect subsystem, affecting icc_get() and of_icc_get_by_index(). When kasprintf() fails to allocate path->name, the error path calls kfree(path) directly, leaving dangling pointers in the req_list hlists that were already popu...

CVE-2026-81007

CVE-2026-81007 affects the Linux kernel 's ipmi/ipmb subsystem. The function ipmb_write() read message fields before validating the length byte, allowing a zero or short write to read uninitialized stack bytes and causing an integer underflow in the block write length when the length is smaller t...

CVE-2026-81006

CVE-2026-81006 is a memory corruption flaw in the Linux kernel's IPMI subsystem. The function ipmi_add_smi() creates the nr_users and nr_msgs sysfs files before attempting to create the maintenance_mode file. If the last creation fails, the error path removes only nr_users before dropping the fin...

CVE-2026-81005

CVE-2026-81005 affects the Linux kernel IPMI SI driver (ipmi_si). When BMC registration fails—typically because the BMC does not return a successful response to the Get Device ID command—the shutdown_smi() callback frees the si_sm pointer and sets it to NULL , but the intf->in_shutdown flag is...

CVE-2026-81004

CVE-2026-81004 affects the Linux kernel's IPMI message handler (ipmi:msghandler). When an error occurs during the startup of an IPMI interface, scheduled work may not be properly canceled before the interface is freed, which can prevent clean resource release and potentially lead to resource exha...

CVE-2026-81003

CVE-2026-81003 affects the Linux kernel net/iucv subsystem (IBM s390 IUCV/HiperSockets). The function afiucv_hs_rcv() matched incoming frames to sockets using only four 8-byte name fields in the transport header, without verifying the ingress net_device . This allowed frames from any network devi...

CVE-2026-81002

CVE-2026-81002 is a critical (CVSS 9.8) memory corruption flaw in the Linux kernel's XDP component. The xdp_convert_zc_to_xdp_frame() function clones an AF_XDP zero-copy packet into an order-0 page but incorrectly advertises PAGE_SIZE as the frame size, allowing the frame to overlap skb_shared_in...

CVE-2026-81000

CVE-2026-81000 affects the Linux kernel TUN/TAP driver . The root cause is an integer underflow in tun_get_user(): when Open vSwitch (OVS) propagates an oversized headroom request from another port, SKB_MAX_HEAD(align) underflows, causing tun_alloc_skb() to place skb->data outside the allocate...

CVE-2026-81001

A use-after-free race condition exists in the Linux kernel's SLIP (Serial Line Internet Protocol) driver , specifically in sl_sync() (drivers/net/slip/slip.c). The slip_devs[] table stores bare net_device pointers without reference counting. Because netdev_run_todo() drops the RTNL lock before ca...

CVE-2026-80999

CVE-2026-80999 affects the Linux kernel 's Realtek DSA driver (net: dsa: realtek). The root cause is that rtl83xx_reset_assert() and rtl83xx_reset_deassert() invoke the non-sleeping gpiod_set_value() for the reset GPIO. When that GPIO is backed by a sleeping controller such as an I2C I/O expander...

CVE-2026-80998

CVE-2026-80998 affects the Linux kernel's bnxt network driver. When the Software UDP Segmentation Offload (SW USO) path (bnxt_sw_udp_gso_xmit) returns early with NETDEV_TX_BUSY while txr->kick_pending is set, the driver writes buffer descriptors but never rings the hardware doorbell , causing ...

CVE-2026-80997

A race condition in the Linux kernel's IP Accelerator (IPA) network driver can cause a permanent transmit (TX) queue stall after a runtime resume. The function ipa_start_xmit() stops the TX queue and relies on a work item (ipa_modem_wake_queue_work()) to restart it, but that work is queued before...

CVE-2026-80996

CVE-2026-80996 affects the Linux kernel 's L2TP (Layer 2 Tunneling Protocol) subsystem. The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail during message allocation, encoding, or multicasting. Because th...

CVE-2026-80995

A use-after-free vulnerability in the Linux kernel's MCTP (Message Control Transport Protocol) networking stack. The mctp_route_lookup() function accesses a route's device (rt->dev) without holding a persistent reference, allowing concurrent deallocation via mctp_dev_put() → kfree(). A subsequ...

CVE-2026-80994

CVE-2026-80994 is a use-after-free vulnerability in the Linux kernel's Open vSwitch (OVS) datapath . During flow deletion (CMD_DEL), the flow mask is freed via RCU after removal from the flow table, but ovs_flow_cmd_fill_info() subsequently dereferences the flow->mask pointer without effective...

CVE-2026-80993

CVE-2026-80993 affects the Linux kernel in the net: phylink subsystem. In the function phylink_inband_caps() , the PCS returned by mac_select_pcs() was only validated against NULL , but the function can also return an error pointer . This causes a kernel panic because phylink_pcs_inband_caps() di...