Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Speicherfehler und Kernel-Abstürze beziehungsweise Denial-of-Service-Zustände auszulösen, Speicher außerhalb vorgesehener Grenzen auszulesen sowie in einzelnen Fällen weitere Sicherheitsauswirkungen zu verursachen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 156
-
Unscored —
futex: Avoid private hash use-after-free on final put
In the Linux kernel, the following vulnerability has been resolved: futex: Avoid private hash use-after-free on final put futex_private_hash_put() drops the reference to fph before evaluating fph->mm for wake_up_var(). futex_ref_put() enables preemption again…
-
Unscored —
Bluetooth: hci_aml: validate firmware segment lengths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate firmware segment lengths aml_download_firmware() reads two lengths from the firmware header and uses them to build pointers before checking that the header and se…
-
Unscored —
Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 mgmt_hci_cmd_sync() checks that the message length agrees with params_len but puts no upper bound on it. params_len is __le16 while t…
-
Unscored —
Bluetooth: ISO: zero the sockaddr before returning it in getname
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname iso_sock_getname() fills a struct sockaddr_iso in place and returns its size without clearing it first, so bytes it does not w…
-
Unscored —
Bluetooth: hci_sync: Fix accept list UAF during suspend
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix accept list UAF during suspend hci_update_event_filter_sync() walks hdev->accept_list while sending a synchronous HCI command for each remote-wakeup device. The suspe…
-
Unscored —
Bluetooth: hci_event: validate LE Set CIG Parameters response
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from…
-
Unscored —
Bluetooth: hci_event: fix LE list UAF on reset
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix LE list UAF on reset hci_cc_reset() clears the LE accept and resolving lists without taking hdev->lock. Other command-complete handlers serialize updates to these li…
-
Unscored —
HID: hyperv: validate initial device info bounds
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor…
-
Unscored —
HID: uclogic: fix use-after-free of inrange_timer on remove
In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: fix use-after-free of inrange_timer on remove uclogic_remove() cancels the pen in-range timer and then stops the device: timer_delete_sync(&drvdata->inrange_timer); hid_hw_stop(…
-
Unscored —
HID: sensor: custom: Fix use-after-free in enable_sensor
In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enable_sensor enable_sensor_store() can call set_power_report_state(), which dereferences sensor_inst->power_state and sensor_inst->report_state. Th…
-
Unscored —
HID: ft260: fix stack-use-after-return write in I2C read race
In the Linux kernel, the following vulnerability has been resolved: HID: ft260: fix stack-use-after-return write in I2C read race ft260_i2c_read() points dev->read_buf at a caller-supplied buffer (often an on-stack variable), arms a completion and waits up to…
-
Unscored —
HID: rapoo: fix missing hid_is_usb() check
In the Linux kernel, the following vulnerability has been resolved: HID: rapoo: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't…
-
Unscored —
HID: nintendo: stop device IO before hid_hw_stop on probe failure
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO before hid_hw_stop on probe failure nintendo_hid_probe() calls hid_device_io_start() before joycon_init() and joycon_leds_create(). If either fails, the error pa…
-
Unscored —
HID: nintendo: register input device after capabilities are set
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input_register_device() exposes the device to userspace immediately. In joycon_input_create() it was called before joycon_confi…
-
Unscored —
HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() joycon_ctlr_read_handler() casts an incoming HID input report to struct joycon_input_report and parses it, guarding the cas…
-
Unscored —
HID: huawei: fix missing hid_is_usb() check
In the Linux kernel, the following vulnerability has been resolved: HID: huawei: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don'…
-
Unscored —
HID: asus: fix missing hid_is_usb() check
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't …
-
Unscored —CVE-2026-80775 Public exploit
futex: Fix race on the initial mm->futex.phash.ref allocation
In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm->futex.phash.ref allocation futex_hash_allocate() allocates mm->futex.phash.ref without any locking. Commit d9b05321e21e ("futex: Move futex_hash_free() back…
-
Unscored —
futex: Fix race in futex_pivot_pending() during private hash resize
In the Linux kernel, the following vulnerability has been resolved: futex: Fix race in futex_pivot_pending() during private hash resize A task performing a custom private hash resize can remain blocked in uninterruptible sleep indefinitely. The hung-task dete…
-
Unscored —
futex/pi: Plug private futex exec() race
In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec() race The check for private futexes whether the waiter's mm, which is stored in the futex_key and copied into the pi_state, is the same as the owner's mm is…
-
Unscored —
futex/pi: Reject cross-mm private futex owners
In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mm_users reference. Nevertheless, attach_to_pi_owner() currently accepts an owner …
-
Unscored —
net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only co…
-
Unscored —
HID: pidff: fix OOB write when hid->inputs is empty
In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid->inputs is empty hid_pidff_init_with_quirks() derives its input_dev from list_entry(hid->inputs.next, struct hid_input, list) without first checking that hi…
-
Unscored —
HID: core: fix OOB read of field->usage in hid_set_field()
In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field->usage in hid_set_field() hid_set_field() hands field->usage + offset to hid_dump_input() before the guard that bounds offset: hid_dump_input(field->report->d…
-
Unscored —
HID: magicmouse: do not keep a stale msc->input if no input is claimed
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc->input if no input is claimed magicmouse_input_mapping() caches the first hid_input's input_dev in msc->input while the report descriptor is parsed, a…
-
Unscored —
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() magicmouse_raw_event() handles DOUBLE_REPORT_ID (0xf7) packets, which pack two touch reports into one, by splitting the …
-
Unscored —
mptcp: pm: fix memory leak from alloc-during-teardown race
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix memory leak from alloc-during-teardown race mptcp_pm_destroy() empties msk->pm.anno_list and msk->pm.userspace_pm_local_addr_list under msk->pm.lock during socket teardown, dro…
-
Unscored —
fbdev: serialize mode sysfs access with lock_fb_info()
In the Linux kernel, the following vulnerability has been resolved: fbdev: serialize mode sysfs access with lock_fb_info() show_mode(), show_modes(), and store_mode() access fb_info->modelist and fb_info->mode without holding lock_fb_info(). store_modes() tak…
-
Unscored —
fbdev: Wrap user-invoked calls to fb_set_var() in helper
In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fb_set_var() in helper Handle fbcon during display updates in fb_set_var_from_user(). Check with fbcon if the mode change is possible, update hardware state …
-
Unscored —
nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() nvmet_pci_epf_exec_iod_work() submits an I/O command with req->execute() and then waits for the command to complete and tra…
-
Unscored —
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into th…
-
Unscored —
nvmet-tcp: bound SGL data length before allocating command buffers
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmet_tcp_map_data() reads the host-controlled 32-bit sgl->length and, for the in-capsule offset descriptor (type 0x01), che…
-
Unscored —
nvmet-fc: fix invalid free in LS IOD error path
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: fix invalid free in LS IOD error path nvmet_fc_alloc_ls_iodlist() advances iod while initializing the LS IOD array. If an rqstbuf allocation or response buffer DMA mapping fails, th…
-
Unscored —
nvmet-auth: zero the AUTH_RECEIVE response buffer
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTH_RECEIVE response buffer nvmet_execute_auth_receive() allocates the response buffer with kmalloc() sized by the host-supplied AUTH_RECEIVE allocation length, but the …
-
Unscored —
ipv6: fix use-after-free in ip6_finish_output2()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or ot…
-
Unscored —
ipv4: reject undersized MTUs in ip_do_fragment()
In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next(). If the effect…
-
Unscored —
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet() each parse a notification into an on-stack struct (nci…
-
Unscored —
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in nci_target_auto_activated() nci_target_auto_activated() appends a target to the fixed-size array ndev->targets[NCI_MAX_DISCOVERED_TARGETS] and increments …
-
Unscored —
nfc: nci: add data_len bound checks to activation parameter extractors
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add data_len bound checks to activation parameter extractors nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() read an inner length byte from the N…
-
Unscored —
nfc: pn533: purge fragmented skbs during cleanup
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: purge fragmented skbs during cleanup pn53x_common_clean() purges resp_q before freeing the common PN533 state, but it leaves fragment_skb untouched. The fragmentation helpers queu…
-
Unscored —
nfc: llcp: reject PDUs shorter than the LLCP header
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header (DSAP/SSAP + PTYPE), but the receive path never checked that a frame is at least LLCP_HEADER_S…
-
Unscored —
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() contain three related bugs in their TLV parsing loops: 1. 'offset' is dec…
-
Unscored —
nfc: llcp: bound the connect_sn TLV walk to the skb
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connect_sn TLV walk to the skb Commit 27256cdb290e ("nfc: llcp: bound SNL TLV parsing to the skb and add length checks") fixed the unbounded TLV walk in nfc_llcp_recv_snl…
-
Unscored —
nfc: microread: validate target discovery payload lengths
In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microread_target_discovered() parses target discovery payloads from skb->data according to the HCI gate. The fixed field offsets and …
-
Unscored —
nfc: fdp: bound the device-reported read length and fix an skb leak
In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdp_nci_i2c_read() takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 u…
-
Unscored —
nfc: digital: clamp SENSF_RES length to the destination buffer
In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSF_RES length to the destination buffer digital_in_recv_sensf_res() memcpy()s resp->len bytes from a remote NFC-F device response into the NFC_SENSF_RES_MAXSIZE-byte ta…
-
Unscored —
xfs: restore nofs context unconditionally in xfs_trans_roll
In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfs_trans_roll When __xfs_trans_commit() fails in xfs_trans_roll(), the NOFS context is cleared but only restored in the success path. This leaves…
-
Unscored —
xfs: validate attr entry pointer before field access
In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry pointer itself is within boun…
-
Unscored —
ext4: don't enable DAX on new encrypted files
In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4_set_inode_flags(inode, init=true) in __ext4_new_inode() is made before …
-
Unscored —
nilfs2: reject invalid block index in GC ioctl
In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double list_add_tail() call on bh->b_assoc_buffers within nilfs_lookup_dirty_data_buffers(). Analysi…
-
Unscored —
ext4: stop retrying saturated xattr cache entries
In the Linux kernel, the following vulnerability has been resolved: ext4: stop retrying saturated xattr cache entries ext4_xattr_block_set() retries when a cache entry selected for reuse has a saturated reference count after taking the buffer lock. The retry …
-
Unscored —
ocfs2: fix missing metadata reservation for large xattrs
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix missing metadata reservation for large xattrs [BUG] lsetxattr() panics the kernel when setting a large xattr value on a fragmented filesystem where the file already has an external…
-
Unscored —
io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() io_vec_fill_bvec() computes the folio size with a plain int 1: unsigned long folio_size = 1 << imu->folio_shift; imu->folio_shift …
-
Unscored —CVE-2026-80811 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
ALSA: dummy: Check card index validity at probe
In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snd_dummy_probe() blindly trusts that the given devptr->id value is within the proper card index range. It's OK for the devices the driver itse…
-
Unscored —
nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() When a host issues an Identify command with CNS 07h (Active Namespace ID List for a specific I/O Command Set), nvmet_exe…
-
Unscored —
rndis_host: add overflow check in rndis_rx_fixup()
In the Linux kernel, the following vulnerability has been resolved: rndis_host: add overflow check in rndis_rx_fixup() Add an overflow check to ensure that data_offset + data_len + 8 does not wrap, which would enable an OOB read of the USB data buffer.
-
Unscored —
ALSA: scarlett2: Use a private URB for the notification endpoint
In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2_init_notify() used mixer->urb, which snd_usb_mixer_status_create() allocates for the UAC2 status interrupt endpoint …
-
Unscored —
ALSA: FCP: Use a private URB for the notification endpoint
In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create() allocates for the optional UAC2 status interrupt endpoint and…
-
Unscored —
iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages
In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages iommufd_ioas_change_process() iterates every IOAS area while only holding every IOAS …
-
Unscored —
iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown arm_smmu_impl_remove() is registered as a devres action in arm_smmu_impl_probe(), before arm_smmu_init_queues() allocates smmu->c…
-
Unscored —
Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept rfcomm_sock_recvmsg() completes a deferred setup by calling rfcomm_dlc_accept() without holding any RFCOMM lock: if (test_an…
-
Unscored —
xfs: don't livelock in scrub on a circular unlinked list
In the Linux kernel, the following vulnerability has been resolved: xfs: don't livelock in scrub on a circular unlinked list LOLLM points out that online fsck can livelock if an unlinked inode list contains a loop. Use a bitmap to detect cycles.
-
Unscored —
nvmet: pci-epf: put CQ ref on create_cq mapping failure
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on create_cq mapping failure nvmet_pci_epf_create_cq() calls nvmet_cq_create(), which takes a reference on the controller and installs the completion queue. If the …
-
Unscored —
mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() Add a check to see if devm_kasprintf() is not NULL in mchp_ipc_get_cluster_aggr_irq(), returning -ENOMEM if the function failed.
-
Unscored —
nfc: st21nfca: validate ATR_REQ length against the received frame
In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ATR_REQ length against the received frame st21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at least ST21NFCA_ATR_REQ_MIN_SIZE and that the self-dec…
-
Unscored —
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usb_device in usbdev_release() usbdev_release() drops its reference to the struct usb_device before draining the list of completed async URBs, but that drain…
-
Unscored —
wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb mt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is …
-
Unscored —
USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00_add_iso_urb() When TD creation fails for the last packet of an isochronous URB, c67x00_add_iso_urb() gives the URB back before updating the endpoint …
-
Unscored —
USB: serial: option: fix slab OOB read in interrupt URB callback
In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setup_port_interrupt_in() based on the endpoint's wMaxPacketSize: buffer_size = usb_e…
-
Unscored —
ALSA: usb-audio: Complete cleanup after system-resume errors
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or …
-
Unscored —
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() snd_usbmidi_novation_output() lays out a two-byte header at transfer_buffer[0..1] and passes &transfer_buffer[2] together with …
-
Unscored —
usb: core: Add lock to usb_wakeup_notification()
In the Linux kernel, the following vulnerability has been resolved: usb: core: Add lock to usb_wakeup_notification() Add a spin lock to usb_wakeup notification to prevent a race condition with dereferencing freed memory. This could be hit by the xHCI driver a…
-
Unscored —
crypto: mxs-dcp - fix source scatterlist length access
In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source scatterlist with dma_map_sg() first. Therefore, sg_dma_len() is i…
-
Unscored —
crypto: qce - fix CCM AAD buffer underallocation
In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qce_aead_ccm_prepare_buf_assoclen() can be smaller than the length later programmed into the DMA scatterlist. The …
-
Unscored —
crypto: sun8i-ss - Remove crypto_rng interface
In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Remove crypto_rng interface Since the crypto_rng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most dr…
-
Unscored —
crypto: sun8i-ce - Remove crypto_rng interface
In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Remove crypto_rng interface Since the crypto_rng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most dr…
-
Unscored —
crypto: qcom-rng - Remove crypto_rng interface
In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Remove crypto_rng interface qcom-rng.c exposes the same hardware through two completely separate interfaces, crypto_rng and hwrng. However, the implementation of this is bu…
-
Unscored —
crypto: virtio - bound the akcipher result length
In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtio_crypto_dataq_akcipher_callback() sets the result length from the device-reported response length without bounding it to the destinatio…
-
Unscored —
netfilter: nf_tables: don't queue packet path object notifications
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't queue packet path object notifications All file:line references below are against v7.2-rc4 (ac5b0e5651b1). The trace was captured on 7.2.0-rc6-kasan72rc6 (075b7484…
-
Unscored —
vxlan: keep the last remote linked during FDB flush
In the Linux kernel, the following vulnerability has been resolved: vxlan: keep the last remote linked during FDB flush A non-nexthop FDB entry is expected to have at least one remote while it remains reachable through the FDB hash table. A filtered bulk flus…
-
Unscored —
batman-adv: reject unrepresentable multicast TVLV offsets
In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject unrepresentable multicast TVLV offsets The network and transport header fields in struct sk_buff are 16-bit offsets from skb->head, and U16_MAX is reserved as the unset tra…
-
Unscored —
ipv6: seg6: clear IPv4 control block on IPIP decapsulation
In the Linux kernel, the following vulnerability has been resolved: ipv6: seg6: clear IPv4 control block on IPIP decapsulation End.DX4 and End.DT4 decapsulate an IPv4 packet through decap_and_validate() and send it directly to IPv4 routing. The inner packet t…
-
Unscored —
net/packet: defer vmalloc TX_RING free until skbs finish
In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX_RING free until skbs finish AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pg_vec i…
-
Unscored —
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's mul…
-
Unscored —
xfrm: fix xfrm_state_construct() auth-trunc leak
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrm_state_construct() auth-trunc leak attach_auth_trunc() can allocate x->aalg while leaving x->props.aalgo at zero when the selected auth algorithm has no sadb_alg_id. One real ca…
-
Unscored —CVE-2026-80844 Public exploit
xfrm: ah6: validate routing header segments_left
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger…
-
Unscored —
xfrm: avoid lock inversion in nat keepalive work
In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work nat_keepalive_work() walks the state table while xfrm_state_walk() holds net->xfrm.xfrm_state_lock. Its callback then acquires x->lock, which …
-
Unscored —
xfrm: drop ESP-in-TCP packets with no ingress device
In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handle_esp() restores skb->dev from the saved skb_iif before passing the packet int…
-
Unscored —
tcp: clamp route advmss to TCP_MIN_MSS
In the Linux kernel, the following vulnerability has been resolved: tcp: clamp route advmss to TCP_MIN_MSS tcp_select_initial_window() assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate that assumption. A too-sm…
-
Unscored —
xfrm: espintcp: fix UAF during close
In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race condition during close for espintcp sockets: espintcp_close() frees emsg->skb via kfree_skb() without holding any socket …
-
Unscored —
net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of current_key on reconnect to another peer tcp_inbound_ao_hash() is called before bh_lock_sock_nested() is taken, with only rcu_read_lock() held. On the fast p…
-
Unscored —
tcp: fix AO info use-after-free in tcp_ao_connect_init()
In the Linux kernel, the following vulnerability has been resolved: tcp: fix AO info use-after-free in tcp_ao_connect_init() tcp_v4_connect() adds a SYN-SENT socket to the ehash before calling tcp_connect(). If TCP-AO is configured, tcp_connect() first verifi…
-
Unscored —
gtp: serialize PDP context updates
In the Linux kernel, the following vulnerability has been resolved: gtp: serialize PDP context updates PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP network device is being unregistered. The latter is serialized by RTNL, but the generic-…
-
Unscored —
tls: device: fix out-of-bounds write in tls_append_frag()
In the Linux kernel, the following vulnerability has been resolved: tls: device: fix out-of-bounds write in tls_append_frag() Found with syzkaller and a local syzbot instance running on top of a netdevsim TLS offload emulation; tls_device.c is otherwise only …
-
Unscored —
KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts When {de,en}crypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4K…
-
Unscored —
usb: gadget: f_tcm: keep port count until LUN teardown completes
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: keep port count until LUN teardown completes tcm_usbg_drop_nexus() permits session removal once tpg_port_count reaches zero. However, usbg_port_unlink() currently decremen…
-
Unscored —
fuse: fix invalidate lock leak on open O_TRUNC DAX failure
In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on open O_TRUNC DAX failure fuse_open() takes filemap_invalidate_lock() for a DAX truncate (dax_truncate = true) and releases it before the out_inode_unlock lab…
-
Unscored —
fuse: fix invalidate lock leak on setattr writeback failure
In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on setattr writeback failure fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate (fault_blocked = true) and releases it at the out:/error: labe…
-
Unscored —
fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free The abort_on_kill path in request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If f…
-
Unscored —
fuse: publish io-uring queues with release semantics
In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuse_uring_create_queue() initializes a fuse_ring_queue and then publishes the pointer into ring->queues[qid] with WRITE_ONCE() under the …
-
Unscored —
fuse: fix missing barrier when checking io-uring readiness
In the Linux kernel, the following vulnerability has been resolved: fuse: fix missing barrier when checking io-uring readiness fuse_block_alloc() reads fch->initialized and then fch->io_uring. fch->io_uring is set before fch->initialized, ordered by the smp_w…
-
Unscored —
fuse: fix race between interrupt and resend
In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 ("fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req") the WARN_ON(!list_empty(&req->intr_entry)) in fuse_…
-
Unscored —
usb: xhci: bail out of setup if the controller is inaccessible
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhci_gen_setup() locates the operational registers using the capability length read from the very first register: xhci->op_regs …
-
Unscored —
nvme-tcp: fix usage of page_frag_cache
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of page_frag_cache nvme uses page_frag_cache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently …
-
Unscored —
RDMA/rxe: Fix OOB in free_rd_atomic_resources()
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the fr…
-
Unscored —
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while th…
-
Unscored —
bpf: Add missing access_ok call to copy_user_syms
In the Linux kernel, the following vulnerability has been resolved: bpf: Add missing access_ok call to copy_user_syms As reported by sashiko we use __get_user without prior access_ok call on the user space pointer. Adding the missing call for the whole pointe…
-
Unscored —
tipc: avoid busy looping in tipc_exit_net()
In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipc_exit_net() Blamed commit introduced a busy-wait loop in tipc_exit_net() to wait for pending UDP bearer cleanup works to complete: while (atomic_read(&tn->wq_c…
-
Unscored —
alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
In the Linux kernel, the following vulnerability has been resolved: alpha/PCI: Add security_locked_down() check to pci_mmap_resource() Currently, Alpha's pci_mmap_resource() does not check security_locked_down(LOCKDOWN_PCI_ACCESS) before allowing userspace to…
-
Unscored —
ntfs3: Allocate iomap inline_data using alloc_page
In the Linux kernel, the following vulnerability has been resolved: ntfs3: Allocate iomap inline_data using alloc_page This fixes a BUG reported in iomap_write_end_inline: iomap_inline_data_valid checks that the inline_data fits within a page. If the inline_d…
-
Unscored —
ntfs: bound the attribute-list entry in ntfs_read_inode_mount()
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the attribute-list entry in ntfs_read_inode_mount() The $MFT attribute-list walk in ntfs_read_inode_mount() validates each entry only with "(u8 *)al_entry + 6 > al_end" and "(u8 *…
-
Unscored —
drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfd_criu_restore_event() -> create_si…
-
Unscored —
crypto: xilinx-trng - Remove crypto_rng interface
In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove crypto_rng interface Implementing the crypto_rng interface has no purpose, as it isn't used in practice. It's being removed from other drivers too. Just remove it…
-
Unscored —
ALSA: hda/tas2781: Cancel async firmware request at unbind
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with request_firmware_nowait(). The firmware loader keeps the…
-
Unscored —
KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions kvm_inject_el2_exception() writes ESR_EL2 for synchronous exceptions but not for SError. enter_exception64() does not write…
-
Unscored —
arm64: dts: renesas: ironhide: Describe inline ECC carveouts
In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide: Describe inline ECC carveouts The DBSC5 DRAM controller protects DRAM content using inline ECC. The inline ECC utilizes areas of DRAM for its operation, which a…
-
Unscored —
ipvs: use parsed transport offset in TCP state lookup
In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeof(struct ipv6hdr), while the surrounding IPVS code alre…
-
Unscored —
ring-buffer: Fix event length with forced 8-byte alignment
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix event length with forced 8-byte alignment When RB_FORCE_8BYTE_ALIGNMENT is true, rb_calculate_event_length() reserves the space of event->array[0] for placing the data length…
-
Unscored —
afs: Fix vllist leak
In the Linux kernel, the following vulnerability has been resolved: afs: Fix vllist leak Fix a leak of the new vllist in afs_update_cell() in the event that it is an empty list (nr_servers == 0), in which case the old list isn't displaced unless the old list …
-
Unscored —
afs: Fix leak of ungot volume
In the Linux kernel, the following vulnerability has been resolved: afs: Fix leak of ungot volume Fix afs_lookup_volume_rcu() so that it doesn't leak a dying volume if afs_try_get_volume() fails.
-
Unscored —
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write A circular locking dependency involves INODE_ALLOC_SYSTEM_INODE, EXTENT_ALLOC_SYSTEM_INODE, and ORPHAN_DIR_SYSTEM_INODE. 1. oc…
-
Unscored —
IB/mlx5: Properly support implicit ODP rereg_mr
In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP rereg_mr Due to all the child mkeys in the implicit ODP configuration we cannot change anything in place for the parent mkey. Instead the whole thing ne…
-
Unscored —
ocfs2: fix buffer head management in ocfs2_read_blocks()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2_read_blocks() In ocfs2_read_blocks(), caller should't assume that buffer head returned by 'sb_getblk()' is exclusively owned and so 'put_bh()' alway…
-
Unscored —
crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm
In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegra_ccm_do_one_req.
-
Unscored —
drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1x_client_register() function is called just prior to register map initialization loop, making…
-
Unscored —
ntb: Store original DMA address for future release
In the Linux kernel, the following vulnerability has been resolved: ntb: Store original DMA address for future release The DMA API requires that dma_free_attrs receive the exact dma_handle originally returned by the allocation function. Do not modify it.
-
Unscored —
afs: Fix uncancelled rxrpc OOB message handler
In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processing (typically to respond to security challenges). Also move OOB message processing to afs_wq so that i…
-
Unscored —
serial: msm: Disable DMA for kernel console UART
In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from userspace and the kernel to the console can trigger a race condition that results in an infinite loop of…
-
Unscored —
drm/vmwgfx: use check_add_overflow for shader size+offset bound
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64…
-
Unscored —
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does s…
-
Unscored —
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix timer drain order, wakeup handling and tx_gen ordering This patch is a follow-up to commit cf070fe33bfb ("can: isotp: serialize TX state transitions under so->rx_lock") which …
-
Unscored —
sctp: reject stale cookies with mismatched verification tags
In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in …
-
Unscored —
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBV…
-
Unscored —
erofs: cap LZMA stream pool size
In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream pool from num_possible_cpus() when the lzma_streams module parameter is unset, then z_er…
-
Unscored —
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() copy_hugetlb_page_range() clears the uffd-wp bit of migration and hwpoison entries with huge_pte_clear_uffd_wp(), which o…
-
Unscored —
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace iommufd_hwpt_replace_device() calls: iommufd_auto_response_faults(hwpt, old_handle); passing the *new* hwpt together …
-
Unscored —
mshv: Order pt_vp_array publish against irqfd assertion path
In the Linux kernel, the following vulnerability has been resolved: mshv: Order pt_vp_array publish against irqfd assertion path mshv_partition_ioctl_create_vp() initialises a VP struct (allocations, mutex_init, init_waitqueue_head, page mappings) and then pu…
-
Unscored —
mshv: Fix race in mshv_irqfd_deassign
In the Linux kernel, the following vulnerability has been resolved: mshv: Fix race in mshv_irqfd_deassign mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign() omits it. This races w…
-
Unscored —
netfs: release readahead folios on iterator preparation failure
In the Linux kernel, the following vulnerability has been resolved: netfs: release readahead folios on iterator preparation failure netfs_prepare_read_iterator() batches readahead folios in put_batch so that the folio references can be dropped after the I/O i…
-
Unscored —
netfs: clear PG_private_2 on copy-to-cache append failure
In the Linux kernel, the following vulnerability has been resolved: netfs: clear PG_private_2 on copy-to-cache append failure netfs_pgpriv2_copy_to_cache() marks the folio with PG_private_2 before netfs_pgpriv2_copy_folio() appends it to the copy-to-cache rol…
-
Unscored —
erofs: remove fscache backend entirely
In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend entirely EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dep…
-
Unscored —
ASoC: SDCA: Make UMP message size check more robust
In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Make UMP message size check more robust If message offset was larger than the buffer length the size check will pass incorrectly. Refactor the check such that it is more robust to…
-
Unscored —
ipvs: fix the checksum validations
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix the checksum validations ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6 packets from clients. In fact, as for TCP/UDP we should validate the checksum for ICMP packets …
-
Unscored —
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA When terminating DMA transfers, active descriptors are not properly reclaimed. Only cyclic descriptors were handled, leavin…
-
Unscored —
drm/xe/oa: Fix sync entry leak on OA config emit failure
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xe_oa_emit_oa_config() releases the sync entries and the syncs array only on its success path. When it fails before the point of no re…
-
Unscored —
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tls_sw_splice_read() after a failed async decrypt When an async decrypt fails, tls_decrypt_done() records the error in ctx->async_wait.err and calls tls_err_abort(), which store…
-
Unscored —
net: tap: fix wrong transport_header when sending VLAN-tagged frame
In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_header when sending VLAN-tagged frame In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g. ETH_P_8021Q), skb_set_network_header() is called first to …
-
Unscored —
net: packet: fix wrong transport_header when sending VLAN-tagged frame
In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport_header when sending VLAN-tagged frame In packet_parse_headers(), when processing a VLAN-tagged frame, skb_set_network_header() is called to advance network_he…
-
Unscored —
drm/amdgpu: Fix UVD dpb min size calculation for H264
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. (cherry picked from commit 64…
-
Unscored —
drm/amdgpu: Reject UVD message with dimensions above 4096
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potential overflow in DPB size calculations. (cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)
-
Unscored —
drm/amdgpu: Reject UVD message with invalid number of h265 refs
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. (cherry picked from commit a4b0720e4f1601f97f59a2…
-
Unscored —
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated, but their get and put callbacks access the value through ucontr…
-
Unscored —
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() If either tplg_ops->dai_config or widget_kcontrol_setup fail during widget setup we would double decrement the use_count of…
-
Unscored —
selinux: reject an unclaimed class value in security_get_classes()
In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never define…
-
Unscored —
selinux: require every boolean value to be defined
In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at …
Revision history
-
#39
Neue Updates von SUSE aufgenommen
-
#38
Neue Updates von Red Hat und SUSE aufgenommen
-
#37
Neue Updates von Red Hat aufgenommen
-
#36
Neue Updates von Red Hat und SUSE aufgenommen
-
#35
Neue Updates von Oracle Linux und Red Hat aufgenommen
-
#34
Neue Updates von SUSE aufgenommen
-
#33
Neue Updates von Red Hat aufgenommen
-
#32
Neue Updates von SUSE und IBM aufgenommen
-
#31
Neue Updates von Debian aufgenommen
-
#30
Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen
-
#29
Neue Updates von SUSE und Red Hat aufgenommen
-
#28
Neue Updates von Red Hat aufgenommen
-
#27
Neue Updates von Red Hat und Oracle Linux aufgenommen
-
#26
Neue Updates von SUSE, Rocky Enterprise Software Foundation, Oracle Linux und Red Hat aufgenommen
-
#25
Neue Updates von Red Hat aufgenommen
-
#24
Neue Updates von Red Hat aufgenommen
-
#23
Neue Updates von SUSE und Red Hat aufgenommen
-
#22
PoC aufgenommen CVE-2026-80775
-
#21
Neue Updates von Oracle Linux, SUSE, openSUSE, Debian und Red Hat aufgenommen
-
#20
Neue Updates von Red Hat, SUSE und Rocky Enterprise Software Foundation aufgenommen
-
#19
Neue Updates von SUSE, Red Hat und Oracle Linux aufgenommen
-
#18
Neue Updates von SUSE, Oracle Linux, Ubuntu, Red Hat und Rocky Enterprise Software Foundation aufgenommen
-
#17
Neue Updates von Amazon, Red Hat und Oracle Linux aufgenommen
-
#16
Neue Updates von Red Hat aufgenommen
-
#15
Neue Updates von Oracle Linux aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2026-80758
https://lore.kernel.org/linux-cve-announce/2026090456-CVE-2026-80758-8292@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80759
https://lore.kernel.org/linux-cve-announce/2026090459-CVE-2026-80759-2dfb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80760
https://lore.kernel.org/linux-cve-announce/2026090459-CVE-2026-80760-a01f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80761
https://lore.kernel.org/linux-cve-announce/2026090459-CVE-2026-80761-ffb2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80762
https://lore.kernel.org/linux-cve-announce/2026090459-CVE-2026-80762-e969@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80763
https://lore.kernel.org/linux-cve-announce/2026090400-CVE-2026-80763-e254@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80764
https://lore.kernel.org/linux-cve-announce/2026090400-CVE-2026-80764-f583@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80765
https://lore.kernel.org/linux-cve-announce/2026090400-CVE-2026-80765-9e7e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80766
https://lore.kernel.org/linux-cve-announce/2026090400-CVE-2026-80766-b157@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80767
https://lore.kernel.org/linux-cve-announce/2026090401-CVE-2026-80767-dfe9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80768
https://lore.kernel.org/linux-cve-announce/2026090401-CVE-2026-80768-99af@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80769
https://lore.kernel.org/linux-cve-announce/2026090401-CVE-2026-80769-59d0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80770
https://lore.kernel.org/linux-cve-announce/2026090401-CVE-2026-80770-d0ea@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80771
https://lore.kernel.org/linux-cve-announce/2026090402-CVE-2026-80771-7b60@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80772
https://lore.kernel.org/linux-cve-announce/2026090402-CVE-2026-80772-6497@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80773
https://lore.kernel.org/linux-cve-announce/2026090402-CVE-2026-80773-4ec8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80774
https://lore.kernel.org/linux-cve-announce/2026090402-CVE-2026-80774-1ed5@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80775
https://lore.kernel.org/linux-cve-announce/2026090403-CVE-2026-80775-c289@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80776
https://lore.kernel.org/linux-cve-announce/2026090403-CVE-2026-80776-d5ad@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80777
https://lore.kernel.org/linux-cve-announce/2026090403-CVE-2026-80777-6065@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80778
https://lore.kernel.org/linux-cve-announce/2026090403-CVE-2026-80778-f058@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80779
https://lore.kernel.org/linux-cve-announce/2026090403-CVE-2026-80779-df63@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80780
https://lore.kernel.org/linux-cve-announce/2026090404-CVE-2026-80780-4207@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80781
https://lore.kernel.org/linux-cve-announce/2026090404-CVE-2026-80781-c97d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80782
https://lore.kernel.org/linux-cve-announce/2026090404-CVE-2026-80782-89cf@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80783
https://lore.kernel.org/linux-cve-announce/2026090404-CVE-2026-80783-a7f6@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80784
https://lore.kernel.org/linux-cve-announce/2026090405-CVE-2026-80784-1faf@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80785
https://lore.kernel.org/linux-cve-announce/2026090405-CVE-2026-80785-8738@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80786
https://lore.kernel.org/linux-cve-announce/2026090405-CVE-2026-80786-a9d3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80787
https://lore.kernel.org/linux-cve-announce/2026090405-CVE-2026-80787-d0b7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80788
https://lore.kernel.org/linux-cve-announce/2026090406-CVE-2026-80788-c2b2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80789
https://lore.kernel.org/linux-cve-announce/2026090406-CVE-2026-80789-d7be@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80790
https://lore.kernel.org/linux-cve-announce/2026090406-CVE-2026-80790-7221@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80791
https://lore.kernel.org/linux-cve-announce/2026090406-CVE-2026-80791-c5d1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80792
https://lore.kernel.org/linux-cve-announce/2026090407-CVE-2026-80792-668e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80793
https://lore.kernel.org/linux-cve-announce/2026090407-CVE-2026-80793-8728@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80794
https://lore.kernel.org/linux-cve-announce/2026090407-CVE-2026-80794-2213@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80795
https://lore.kernel.org/linux-cve-announce/2026090407-CVE-2026-80795-b431@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80796
https://lore.kernel.org/linux-cve-announce/2026090407-CVE-2026-80796-9b66@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80797
https://lore.kernel.org/linux-cve-announce/2026090408-CVE-2026-80797-7839@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80798
https://lore.kernel.org/linux-cve-announce/2026090408-CVE-2026-80798-9936@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80799
https://lore.kernel.org/linux-cve-announce/2026090408-CVE-2026-80799-ac42@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80800
https://lore.kernel.org/linux-cve-announce/2026090408-CVE-2026-80800-5b21@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80801
https://lore.kernel.org/linux-cve-announce/2026090409-CVE-2026-80801-fb51@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80802
https://lore.kernel.org/linux-cve-announce/2026090409-CVE-2026-80802-37a0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80803
https://lore.kernel.org/linux-cve-announce/2026090409-CVE-2026-80803-7853@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80804
https://lore.kernel.org/linux-cve-announce/2026090409-CVE-2026-80804-9b92@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80805
https://lore.kernel.org/linux-cve-announce/2026090410-CVE-2026-80805-cbde@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80806
https://lore.kernel.org/linux-cve-announce/2026090410-CVE-2026-80806-ced9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80807
https://lore.kernel.org/linux-cve-announce/2026090410-CVE-2026-80807-6993@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80808
https://lore.kernel.org/linux-cve-announce/2026090410-CVE-2026-80808-8237@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80809
https://lore.kernel.org/linux-cve-announce/2026090411-CVE-2026-80809-1a7b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80810
https://lore.kernel.org/linux-cve-announce/2026090411-CVE-2026-80810-e7ad@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80811
https://lore.kernel.org/linux-cve-announce/2026090411-CVE-2026-80811-cf0f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80812
https://lore.kernel.org/linux-cve-announce/2026090411-CVE-2026-80812-a921@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80813
https://lore.kernel.org/linux-cve-announce/2026090411-CVE-2026-80813-ff96@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80814
https://lore.kernel.org/linux-cve-announce/2026090412-CVE-2026-80814-4889@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80815
https://lore.kernel.org/linux-cve-announce/2026090412-CVE-2026-80815-4fd4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80816
https://lore.kernel.org/linux-cve-announce/2026090412-CVE-2026-80816-eeb9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80817
https://lore.kernel.org/linux-cve-announce/2026090412-CVE-2026-80817-cd66@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80818
https://lore.kernel.org/linux-cve-announce/2026090413-CVE-2026-80818-1a6c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80819
https://lore.kernel.org/linux-cve-announce/2026090413-CVE-2026-80819-ce00@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80820
https://lore.kernel.org/linux-cve-announce/2026090413-CVE-2026-80820-d37e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80821
https://lore.kernel.org/linux-cve-announce/2026090420-CVE-2026-80821-1c7b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80822
https://lore.kernel.org/linux-cve-announce/2026090422-CVE-2026-80822-8ed4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80823
https://lore.kernel.org/linux-cve-announce/2026090422-CVE-2026-80823-fc73@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80824
https://lore.kernel.org/linux-cve-announce/2026090451-CVE-2026-80824-055e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80825
https://lore.kernel.org/linux-cve-announce/2026090454-CVE-2026-80825-3632@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80826
https://lore.kernel.org/linux-cve-announce/2026090454-CVE-2026-80826-8c04@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80827
https://lore.kernel.org/linux-cve-announce/2026090454-CVE-2026-80827-4b14@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80828
https://lore.kernel.org/linux-cve-announce/2026090455-CVE-2026-80828-951f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80829
https://lore.kernel.org/linux-cve-announce/2026090455-CVE-2026-80829-c6d6@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80830
https://lore.kernel.org/linux-cve-announce/2026090455-CVE-2026-80830-ca46@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80831
https://lore.kernel.org/linux-cve-announce/2026090455-CVE-2026-80831-aaf7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80832
https://lore.kernel.org/linux-cve-announce/2026090456-CVE-2026-80832-a194@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80833
https://lore.kernel.org/linux-cve-announce/2026090456-CVE-2026-80833-6996@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80834
https://lore.kernel.org/linux-cve-announce/2026090456-CVE-2026-80834-e881@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80835
https://lore.kernel.org/linux-cve-announce/2026090456-CVE-2026-80835-3dd6@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80836
https://lore.kernel.org/linux-cve-announce/2026090457-CVE-2026-80836-9774@gregkh/