Search
Find a vulnerability
Search criteria
30118 vulnerabilities found for linux by linux
CVE-2026-80724 (GCVE-0-2026-80724)
Vulnerability from nvd – Published: 2026-08-28 07:03 – Updated: 2026-08-28 07:03
VLAI
EPSS
VEX
Title
ptp: vmclock: prevent read-only mappings from becoming writable
Summary
In the Linux kernel, the following vulnerability has been resolved:
ptp: vmclock: prevent read-only mappings from becoming writable
vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock
ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the
page read-only and then upgrade it to writable with mprotect(), after
which the guest can corrupt the host-written timekeeping data (sequence
counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.
Clear VM_MAYWRITE on the read-only path so the mapping cannot be
upgraded, as i915 does for its read-only objects and as fixed in drm/vc4
(CVE-2026-68445) and drm/panthor (CVE-2024-53071).
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
20503272422693d793b84f88bf23fe4e955d3a33 , < 5b4f2bec7bea6c04084d720d731bedee7caf878d
(git)
Affected: 20503272422693d793b84f88bf23fe4e955d3a33 , < 2496e141827102d6af512950057d402a2cfb2bfc (git) Affected: 20503272422693d793b84f88bf23fe4e955d3a33 , < 2e596e7814ba38cdc129991058b6c254ed37cb11 (git) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.18.47 , ≤ 6.18.* (semver) Unaffected: 7.1.11 , ≤ 7.1.* (semver) Unaffected: 7.2.1 , ≤ 7.2.* (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ptp/ptp_vmclock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5b4f2bec7bea6c04084d720d731bedee7caf878d",
"status": "affected",
"version": "20503272422693d793b84f88bf23fe4e955d3a33",
"versionType": "git"
},
{
"lessThan": "2496e141827102d6af512950057d402a2cfb2bfc",
"status": "affected",
"version": "20503272422693d793b84f88bf23fe4e955d3a33",
"versionType": "git"
},
{
"lessThan": "2e596e7814ba38cdc129991058b6c254ed37cb11",
"status": "affected",
"version": "20503272422693d793b84f88bf23fe4e955d3a33",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ptp/ptp_vmclock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: vmclock: prevent read-only mappings from becoming writable\n\nvmclock_miscdev_mmap() rejects writable mappings of the shared vmclock\nABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the\npage read-only and then upgrade it to writable with mprotect(), after\nwhich the guest can corrupt the host-written timekeeping data (sequence\ncounter, UTC time, TSC offset) that the vmclock ABI defines as read-only.\n\nClear VM_MAYWRITE on the read-only path so the mapping cannot be\nupgraded, as i915 does for its read-only objects and as fixed in drm/vc4\n(CVE-2026-68445) and drm/panthor (CVE-2024-53071)."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T07:03:08.410Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b4f2bec7bea6c04084d720d731bedee7caf878d"
},
{
"url": "https://git.kernel.org/stable/c/2496e141827102d6af512950057d402a2cfb2bfc"
},
{
"url": "https://git.kernel.org/stable/c/2e596e7814ba38cdc129991058b6c254ed37cb11"
}
],
"title": "ptp: vmclock: prevent read-only mappings from becoming writable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80724",
"datePublished": "2026-08-28T07:03:08.410Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T07:03:08.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80723 (GCVE-0-2026-80723)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
of: reserved_mem: prevent OOB when too many dynamic regions are defined
Summary
In the Linux kernel, the following vulnerability has been resolved:
of: reserved_mem: prevent OOB when too many dynamic regions are defined
On boot, fdt_scan_reserved_mem() saves each dynamically-placed
/reserved-memory subnode into a local array of size
MAX_RESERVED_REGIONS.
If the device tree defines more than MAX_RESERVED_REGIONS
dynamically-placed regions, fdt_scan_reserved_mem() writes past the
end of the local array.
Add a bounds check that logs an error and skips the excess regions,
restoring the original behavior.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9a0fe62f93ede02c27aaca81112af1e59c8c0979 , < 68d27250c9e81ab7764603e346c2b1017cb53adf
(git)
Affected: 8a6e02d0c00e7b62e6acb74146878bb91e9e7e31 , < cfa7e2734877330d6c10e0f33953905486c4530c (git) Affected: 8a6e02d0c00e7b62e6acb74146878bb91e9e7e31 , < de8ccbd6bf4efe7a059e2c483789936009e10f42 (git) Affected: 8a6e02d0c00e7b62e6acb74146878bb91e9e7e31 , < db3dbdfea1b8f38774419c5c2c14e4b81c48708d (git) Affected: 6.12.13 , < 6.12.103 (semver) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/of/of_reserved_mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68d27250c9e81ab7764603e346c2b1017cb53adf",
"status": "affected",
"version": "9a0fe62f93ede02c27aaca81112af1e59c8c0979",
"versionType": "git"
},
{
"lessThan": "cfa7e2734877330d6c10e0f33953905486c4530c",
"status": "affected",
"version": "8a6e02d0c00e7b62e6acb74146878bb91e9e7e31",
"versionType": "git"
},
{
"lessThan": "de8ccbd6bf4efe7a059e2c483789936009e10f42",
"status": "affected",
"version": "8a6e02d0c00e7b62e6acb74146878bb91e9e7e31",
"versionType": "git"
},
{
"lessThan": "db3dbdfea1b8f38774419c5c2c14e4b81c48708d",
"status": "affected",
"version": "8a6e02d0c00e7b62e6acb74146878bb91e9e7e31",
"versionType": "git"
},
{
"lessThan": "6.12.103",
"status": "affected",
"version": "6.12.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/of/of_reserved_mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.12.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nof: reserved_mem: prevent OOB when too many dynamic regions are defined\n\nOn boot, fdt_scan_reserved_mem() saves each dynamically-placed\n/reserved-memory subnode into a local array of size\nMAX_RESERVED_REGIONS.\n\nIf the device tree defines more than MAX_RESERVED_REGIONS\ndynamically-placed regions, fdt_scan_reserved_mem() writes past the\nend of the local array.\n\nAdd a bounds check that logs an error and skips the excess regions,\nrestoring the original behavior."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:18.485Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68d27250c9e81ab7764603e346c2b1017cb53adf"
},
{
"url": "https://git.kernel.org/stable/c/cfa7e2734877330d6c10e0f33953905486c4530c"
},
{
"url": "https://git.kernel.org/stable/c/de8ccbd6bf4efe7a059e2c483789936009e10f42"
},
{
"url": "https://git.kernel.org/stable/c/db3dbdfea1b8f38774419c5c2c14e4b81c48708d"
}
],
"title": "of: reserved_mem: prevent OOB when too many dynamic regions are defined",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80723",
"datePublished": "2026-08-28T06:53:18.485Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:18.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80722 (GCVE-0-2026-80722)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
wifi: mac80211: validate individual TWT params before driver setup
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: validate individual TWT params before driver setup
ieee80211_process_rx_twt_action() only partially validates a received
S1G TWT setup frame before queueing it.
An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup()
with twt->length too short for the full struct ieee80211_twt_params.
The individual path passes twt to drv_add_twt_setup(). Both the tracepoint
and the driver callback consume the complete parameters block, not merely
req_type. Do not pass a short individual agreement to the driver.
Broadcast agreements remain unchanged because they are rejected locally
after accessing only req_type.
[edit commit message to not overclaim lack of validation nor
understate driver impact]
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f5a4c24e689f54e66201f04d343bdd2e8a1d7923 , < 92fcd0f30dc8e51f252589b082d46851d295cc1a
(git)
Affected: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 , < 09d60d1f72e6598241490eb6c4e97245af895c09 (git) Affected: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 , < ff558072d199c1d641d1561da622e67f780514de (git) Affected: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 , < ade9e2f0f7f4d3089600ac2af8ef0b91746f923b (git) Affected: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 , < b558e07708d886acfcf4b0391ed7a8546e81d326 (git) Affected: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 , < 47fb04c3826e1f90271d405523043d6708b9072a (git) Affected: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 , < 0502d5077e419427d80f4d46ba95d0067f5fb916 (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/s1g.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "92fcd0f30dc8e51f252589b082d46851d295cc1a",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "09d60d1f72e6598241490eb6c4e97245af895c09",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "ff558072d199c1d641d1561da622e67f780514de",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "ade9e2f0f7f4d3089600ac2af8ef0b91746f923b",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "b558e07708d886acfcf4b0391ed7a8546e81d326",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "47fb04c3826e1f90271d405523043d6708b9072a",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "0502d5077e419427d80f4d46ba95d0067f5fb916",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/s1g.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate individual TWT params before driver setup\n\nieee80211_process_rx_twt_action() only partially validates a received\nS1G TWT setup frame before queueing it.\n\nAn individual agreement can therefore reach ieee80211_s1g_rx_twt_setup()\nwith twt-\u003elength too short for the full struct ieee80211_twt_params.\n\nThe individual path passes twt to drv_add_twt_setup(). Both the tracepoint\nand the driver callback consume the complete parameters block, not merely\nreq_type. Do not pass a short individual agreement to the driver.\nBroadcast agreements remain unchanged because they are rejected locally\nafter accessing only req_type.\n\n[edit commit message to not overclaim lack of validation nor\n understate driver impact]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:17.886Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/92fcd0f30dc8e51f252589b082d46851d295cc1a"
},
{
"url": "https://git.kernel.org/stable/c/09d60d1f72e6598241490eb6c4e97245af895c09"
},
{
"url": "https://git.kernel.org/stable/c/ff558072d199c1d641d1561da622e67f780514de"
},
{
"url": "https://git.kernel.org/stable/c/ade9e2f0f7f4d3089600ac2af8ef0b91746f923b"
},
{
"url": "https://git.kernel.org/stable/c/b558e07708d886acfcf4b0391ed7a8546e81d326"
},
{
"url": "https://git.kernel.org/stable/c/47fb04c3826e1f90271d405523043d6708b9072a"
},
{
"url": "https://git.kernel.org/stable/c/0502d5077e419427d80f4d46ba95d0067f5fb916"
}
],
"title": "wifi: mac80211: validate individual TWT params before driver setup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80722",
"datePublished": "2026-08-28T06:53:17.886Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:17.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80721 (GCVE-0-2026-80721)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
Bluetooth: ISO: ensure no dangling hcon references in iso_conn
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: ensure no dangling hcon references in iso_conn
After iso_conn_del(), ISO sockets should not dereference the hcon any
more. Currently, clearing iso_conn::hcon relies on iso_conn_del()
releasing the last reference to the iso_conn.
Simplify this by explicitly clearing conn->hcon in iso_conn_del(), to
avoid more complex reasoning on races about who holds the last
reference.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e941799c31f68e67ce0976efb38a79101f921b64
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cdce8af9291d8a1f8916c271de029bf558d9e8ec (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb (git) Affected: 0 , < 6.18.44 (semver) Affected: 0 , < 7.1.8 (semver) |
|
| Linux | Linux |
Unaffected:
6.18.44 , ≤ 6.18.*
(semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e941799c31f68e67ce0976efb38a79101f921b64",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cdce8af9291d8a1f8916c271de029bf558d9e8ec",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.18.44",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: ensure no dangling hcon references in iso_conn\n\nAfter iso_conn_del(), ISO sockets should not dereference the hcon any\nmore. Currently, clearing iso_conn::hcon relies on iso_conn_del()\nreleasing the last reference to the iso_conn.\n\nSimplify this by explicitly clearing conn-\u003ehcon in iso_conn_del(), to\navoid more complex reasoning on races about who holds the last\nreference."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:17.278Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e941799c31f68e67ce0976efb38a79101f921b64"
},
{
"url": "https://git.kernel.org/stable/c/cdce8af9291d8a1f8916c271de029bf558d9e8ec"
},
{
"url": "https://git.kernel.org/stable/c/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb"
}
],
"title": "Bluetooth: ISO: ensure no dangling hcon references in iso_conn",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80721",
"datePublished": "2026-08-28T06:53:17.278Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:17.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80720 (GCVE-0-2026-80720)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
iomap: add a separate bio_set for iomap_split_ioend
Summary
In the Linux kernel, the following vulnerability has been resolved:
iomap: add a separate bio_set for iomap_split_ioend
iomap_split_ioend can split bios that already come from
iomap_ioend_bioset and thus deadlock when the bioset is exhausted.
Add a separate bio_set to avoid this deadlock.
Christian Brauner <brauner@kernel.org> says:
Mark iomap_ioend_split_bioset static as it is only used in ioend.c,
fixing the sparse warning reported by the kernel test robot.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5fcbd555d48390a8c819ba7fdf55fbfcabe05c80 , < cfc686a1174aa904dcad9b9a7c5e46b484d27e4e
(git)
Affected: 5fcbd555d48390a8c819ba7fdf55fbfcabe05c80 , < 4a869be56e9f6ce7462abcf324ebdefc5de051be (git) Affected: 5fcbd555d48390a8c819ba7fdf55fbfcabe05c80 , < c679ce3be6cb63763d68ab9b5d9d73ddc0a40762 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/iomap/ioend.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cfc686a1174aa904dcad9b9a7c5e46b484d27e4e",
"status": "affected",
"version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80",
"versionType": "git"
},
{
"lessThan": "4a869be56e9f6ce7462abcf324ebdefc5de051be",
"status": "affected",
"version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80",
"versionType": "git"
},
{
"lessThan": "c679ce3be6cb63763d68ab9b5d9d73ddc0a40762",
"status": "affected",
"version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/iomap/ioend.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: add a separate bio_set for iomap_split_ioend\n\niomap_split_ioend can split bios that already come from\niomap_ioend_bioset and thus deadlock when the bioset is exhausted.\n\nAdd a separate bio_set to avoid this deadlock.\n\nChristian Brauner \u003cbrauner@kernel.org\u003e says:\nMark iomap_ioend_split_bioset static as it is only used in ioend.c,\nfixing the sparse warning reported by the kernel test robot."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:16.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cfc686a1174aa904dcad9b9a7c5e46b484d27e4e"
},
{
"url": "https://git.kernel.org/stable/c/4a869be56e9f6ce7462abcf324ebdefc5de051be"
},
{
"url": "https://git.kernel.org/stable/c/c679ce3be6cb63763d68ab9b5d9d73ddc0a40762"
}
],
"title": "iomap: add a separate bio_set for iomap_split_ioend",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80720",
"datePublished": "2026-08-28T06:53:16.683Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:16.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80719 (GCVE-0-2026-80719)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
mm: mglru: fix stale batch updates after memcg reparenting
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm: mglru: fix stale batch updates after memcg reparenting
The mglru page table walker batches per-generation size deltas in
walk->nr_pages while walking page tables without holding the lruvec lock.
The reset_batch_size() later folds those deltas into walk->lruvec under
the lruvec lock.
The page table walker can run concurrently with the memcg reparenting path
as follows:
CPU0 CPU1
==== ====
walk_mm
--> walk_page_range
--> update_batch_size
--> walk->nr_pages += delta
mem_cgroup_css_offline
--> memcg_reparent_objcgs
--> lock lruvec
lru_gen_reparent_memcg
--> reparent child folios to parent
unlock lruvec
lock lruvec
reset_batch_size
--> child lrugen->nr_pages += delta
This will trigger the following warning in lru_gen_exit_memcg():
VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,
sizeof(lruvec->lrugen.nr_pages)));
And the user-visible impact of underestimated nr_pages in MGLRU was
premature OOMs because MGLRU does not try to reclaim memory when nr_pages
reaches zero, but there are still more pages.
To fix it, make reset_batch_size() check CSS_DYING under RCU before
flushing the pending batch. A non-dying memcg keeps the original lruvec
stable against RCU-delayed offlining; a dying memcg redirects the deltas
to the first non-dying ancestor.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f304652609eae3814b0e9d11c75c0e0cb62da31f , < fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101
(git)
Affected: f304652609eae3814b0e9d11c75c0e0cb62da31f , < de4660898b7aa7e03d3b120a6bfa6b26211e4e77 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/memcontrol.h",
"mm/vmscan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101",
"status": "affected",
"version": "f304652609eae3814b0e9d11c75c0e0cb62da31f",
"versionType": "git"
},
{
"lessThan": "de4660898b7aa7e03d3b120a6bfa6b26211e4e77",
"status": "affected",
"version": "f304652609eae3814b0e9d11c75c0e0cb62da31f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/memcontrol.h",
"mm/vmscan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: mglru: fix stale batch updates after memcg reparenting\n\nThe mglru page table walker batches per-generation size deltas in\nwalk-\u003enr_pages while walking page tables without holding the lruvec lock. \nThe reset_batch_size() later folds those deltas into walk-\u003elruvec under\nthe lruvec lock.\n\nThe page table walker can run concurrently with the memcg reparenting path\nas follows:\n\nCPU0 CPU1\n==== ====\n\nwalk_mm\n--\u003e walk_page_range\n --\u003e update_batch_size\n --\u003e walk-\u003enr_pages += delta\n\n mem_cgroup_css_offline\n --\u003e memcg_reparent_objcgs\n --\u003e lock lruvec\n lru_gen_reparent_memcg\n --\u003e reparent child folios to parent\n unlock lruvec\n\n lock lruvec\n reset_batch_size\n --\u003e child lrugen-\u003enr_pages += delta\n\nThis will trigger the following warning in lru_gen_exit_memcg():\n\n\tVM_WARN_ON_ONCE(memchr_inv(lruvec-\u003elrugen.nr_pages, 0,\n\t\t\t\t sizeof(lruvec-\u003elrugen.nr_pages)));\n\nAnd the user-visible impact of underestimated nr_pages in MGLRU was\npremature OOMs because MGLRU does not try to reclaim memory when nr_pages\nreaches zero, but there are still more pages.\n\nTo fix it, make reset_batch_size() check CSS_DYING under RCU before\nflushing the pending batch. A non-dying memcg keeps the original lruvec\nstable against RCU-delayed offlining; a dying memcg redirects the deltas\nto the first non-dying ancestor."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:16.087Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fceb6b7f3ddec6ea9fc11577f4cf1b2da73a3101"
},
{
"url": "https://git.kernel.org/stable/c/de4660898b7aa7e03d3b120a6bfa6b26211e4e77"
}
],
"title": "mm: mglru: fix stale batch updates after memcg reparenting",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80719",
"datePublished": "2026-08-28T06:53:16.087Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:16.087Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80718 (GCVE-0-2026-80718)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
In pcpu_create_chunk(), nr_pages is the total contiguous backing
allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()
uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap.
Since bit N in chunk->populated means page offset N inside every unit is
backed. When nr_units > 1, the function writes beyond chunk->populated.
Fix it by using chunk->nr_pages.
It also fixes the global pcpu_nr_empty_pop_pages accounting, since
pcpu_balance_free() only iterates up to chunk->nr_pages.
Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap
properly") introduced the bitmap overflow issue. Later, commit
b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and
chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the
accounting issue.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a63d4ac4ab6094c051a5a240260d16117a7a2f86 , < 5f43d2c1bea280dcdfabaf156c25e7402fb8039f
(git)
Affected: a63d4ac4ab6094c051a5a240260d16117a7a2f86 , < 92c43ac3c2b09eb16162e8144e73c00b7c3e29d6 (git) Affected: a63d4ac4ab6094c051a5a240260d16117a7a2f86 , < 6fc7da2a052f2825fff785e860e67183f5acaaba (git) Affected: a63d4ac4ab6094c051a5a240260d16117a7a2f86 , < 01504da375f5b19df195cb1cb1cf1dd184318f97 (git) Affected: a63d4ac4ab6094c051a5a240260d16117a7a2f86 , < a6940b84c8c035da465b7165fdfcfb005545724e (git) Affected: a63d4ac4ab6094c051a5a240260d16117a7a2f86 , < 32134cf9211b83bed9076d0739c5906fbea4c763 (git) Affected: a63d4ac4ab6094c051a5a240260d16117a7a2f86 , < 5c7fc39bf19abb38a996aaad77b3e3a8f48581c3 (git) Affected: a63d4ac4ab6094c051a5a240260d16117a7a2f86 , < 89b1b79c308818a715e75f28744b70d8940a07c9 (git) |
|
| Linux | Linux |
Affected:
3.18
Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/percpu-km.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5f43d2c1bea280dcdfabaf156c25e7402fb8039f",
"status": "affected",
"version": "a63d4ac4ab6094c051a5a240260d16117a7a2f86",
"versionType": "git"
},
{
"lessThan": "92c43ac3c2b09eb16162e8144e73c00b7c3e29d6",
"status": "affected",
"version": "a63d4ac4ab6094c051a5a240260d16117a7a2f86",
"versionType": "git"
},
{
"lessThan": "6fc7da2a052f2825fff785e860e67183f5acaaba",
"status": "affected",
"version": "a63d4ac4ab6094c051a5a240260d16117a7a2f86",
"versionType": "git"
},
{
"lessThan": "01504da375f5b19df195cb1cb1cf1dd184318f97",
"status": "affected",
"version": "a63d4ac4ab6094c051a5a240260d16117a7a2f86",
"versionType": "git"
},
{
"lessThan": "a6940b84c8c035da465b7165fdfcfb005545724e",
"status": "affected",
"version": "a63d4ac4ab6094c051a5a240260d16117a7a2f86",
"versionType": "git"
},
{
"lessThan": "32134cf9211b83bed9076d0739c5906fbea4c763",
"status": "affected",
"version": "a63d4ac4ab6094c051a5a240260d16117a7a2f86",
"versionType": "git"
},
{
"lessThan": "5c7fc39bf19abb38a996aaad77b3e3a8f48581c3",
"status": "affected",
"version": "a63d4ac4ab6094c051a5a240260d16117a7a2f86",
"versionType": "git"
},
{
"lessThan": "89b1b79c308818a715e75f28744b70d8940a07c9",
"status": "affected",
"version": "a63d4ac4ab6094c051a5a240260d16117a7a2f86",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/percpu-km.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()\n\nIn pcpu_create_chunk(), nr_pages is the total contiguous backing\nallocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()\nuses it to set chunk-\u003epopulated, whose size is pcpu_unit_pages, bitmap. \nSince bit N in chunk-\u003epopulated means page offset N inside every unit is\nbacked. When nr_units \u003e 1, the function writes beyond chunk-\u003epopulated. \nFix it by using chunk-\u003enr_pages.\n\nIt also fixes the global pcpu_nr_empty_pop_pages accounting, since\npcpu_balance_free() only iterates up to chunk-\u003enr_pages.\n\nCommit a63d4ac4ab609 (\"percpu: make percpu-km set chunk-\u003epopulated bitmap\nproperly\") introduced the bitmap overflow issue. Later, commit\nb539b87fed37f (\"percpu: implmeent pcpu_nr_empty_pop_pages and\nchunk-\u003enr_populated\") added pcpu_nr_empty_pop_pages and caused the\naccounting issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:15.490Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5f43d2c1bea280dcdfabaf156c25e7402fb8039f"
},
{
"url": "https://git.kernel.org/stable/c/92c43ac3c2b09eb16162e8144e73c00b7c3e29d6"
},
{
"url": "https://git.kernel.org/stable/c/6fc7da2a052f2825fff785e860e67183f5acaaba"
},
{
"url": "https://git.kernel.org/stable/c/01504da375f5b19df195cb1cb1cf1dd184318f97"
},
{
"url": "https://git.kernel.org/stable/c/a6940b84c8c035da465b7165fdfcfb005545724e"
},
{
"url": "https://git.kernel.org/stable/c/32134cf9211b83bed9076d0739c5906fbea4c763"
},
{
"url": "https://git.kernel.org/stable/c/5c7fc39bf19abb38a996aaad77b3e3a8f48581c3"
},
{
"url": "https://git.kernel.org/stable/c/89b1b79c308818a715e75f28744b70d8940a07c9"
}
],
"title": "mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80718",
"datePublished": "2026-08-28T06:53:15.490Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:15.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80717 (GCVE-0-2026-80717)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
sctp: validate Adaptation Indication parameter length
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate Adaptation Indication parameter length
The Adaptation Layer Indication parameter contains a fixed 32-bit
Adaptation Code Point after its parameter header. However,
sctp_verify_param() accepts a header-only parameter because the generic
parameter walker only requires the header to be present.
sctp_process_param() then reads adaptation_ind beyond the declared
parameter. When the malformed parameter is last in an INIT, the read
starts at the receive skb tail, and the value is copied into the state
cookie returned in the INIT ACK. This may disclose four receive-buffer
tail bytes.
Require the declared parameter length to match the fixed structure size
and abort the association through the existing invalid parameter length
path otherwise.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fa7861ddbe3b525b5d541c15c3953d3569e6eb0e
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4c92c601c061e5602db2edeea54fef74aa304027 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7b7e4e3640d57bd8857f0052c8b0d8ed4e5e954a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 93942b5772e0eee4147d4799cc1b936ae12fa615 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5fd7cfc708dfc988ae9920c21075e6121bc89926 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 17b412468c7a44f66a385bda48cdc1e94e39bd6d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bfa28cf99eb4d096c87da939f54233444d209ca5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 74b21f52c5c5a71a05c0ff70e513f4f04ff28b17 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fa7861ddbe3b525b5d541c15c3953d3569e6eb0e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4c92c601c061e5602db2edeea54fef74aa304027",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7b7e4e3640d57bd8857f0052c8b0d8ed4e5e954a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "93942b5772e0eee4147d4799cc1b936ae12fa615",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5fd7cfc708dfc988ae9920c21075e6121bc89926",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "17b412468c7a44f66a385bda48cdc1e94e39bd6d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bfa28cf99eb4d096c87da939f54233444d209ca5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "74b21f52c5c5a71a05c0ff70e513f4f04ff28b17",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate Adaptation Indication parameter length\n\nThe Adaptation Layer Indication parameter contains a fixed 32-bit\nAdaptation Code Point after its parameter header. However,\nsctp_verify_param() accepts a header-only parameter because the generic\nparameter walker only requires the header to be present.\n\nsctp_process_param() then reads adaptation_ind beyond the declared\nparameter. When the malformed parameter is last in an INIT, the read\nstarts at the receive skb tail, and the value is copied into the state\ncookie returned in the INIT ACK. This may disclose four receive-buffer\ntail bytes.\n\nRequire the declared parameter length to match the fixed structure size\nand abort the association through the existing invalid parameter length\npath otherwise."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:14.886Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fa7861ddbe3b525b5d541c15c3953d3569e6eb0e"
},
{
"url": "https://git.kernel.org/stable/c/4c92c601c061e5602db2edeea54fef74aa304027"
},
{
"url": "https://git.kernel.org/stable/c/7b7e4e3640d57bd8857f0052c8b0d8ed4e5e954a"
},
{
"url": "https://git.kernel.org/stable/c/93942b5772e0eee4147d4799cc1b936ae12fa615"
},
{
"url": "https://git.kernel.org/stable/c/5fd7cfc708dfc988ae9920c21075e6121bc89926"
},
{
"url": "https://git.kernel.org/stable/c/17b412468c7a44f66a385bda48cdc1e94e39bd6d"
},
{
"url": "https://git.kernel.org/stable/c/bfa28cf99eb4d096c87da939f54233444d209ca5"
},
{
"url": "https://git.kernel.org/stable/c/74b21f52c5c5a71a05c0ff70e513f4f04ff28b17"
}
],
"title": "sctp: validate Adaptation Indication parameter length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80717",
"datePublished": "2026-08-28T06:53:14.886Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:14.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80716 (GCVE-0-2026-80716)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
ALSA: pcm: wake linked drain waiters on unlink
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: wake linked drain waiters on unlink
snd_pcm_drain() on a linked stream parks an on-stack wait entry on the
drained peer's runtime->sleep, and after schedule_timeout() removes it
only if that peer is still found in the caller's group. If group
membership changes during the wait and the sleep ends by signal or
timeout (so autoremove_wake_function() does not run), finish_wait() is
skipped and snd_pcm_drain() returns with the entry still queued on that
stream's sleep list; a later wake_up() then walks a freed stack frame.
This is reachable by unlinking either the drained or the draining stream.
Unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()),
snd_pcm_unlink() never wakes the sleep queues. Wake every group member
under the group lock before the membership change, so a linked drainer is
released and drops its entry while the streams are still grouped.
The window was opened when snd_pcm_link_rwsem stopped being held across
the wait and the removal became conditional on group membership (see
Fixes). The later switch to finish_wait() kept that conditional removal,
so the signal/timeout case remained.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < c172e4c53321ee6429955295ea133bc3597a3ca9
(git)
Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < 3035bb784cea3f338934f5042dd3f35225a51b2e (git) Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < 1c1b7e8e545ce65e40f65b55c432765e058ea98f (git) Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < e8b784a3f4fba3ea9c4d05138ecfa784a069627f (git) Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < e8315330e4ec09c0cac625515400e13d0ee22b81 (git) Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < 2940cc3cf43c72126b74ee6376314c195382023a (git) Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < db09bc4ab19ce548a078240d2374792523953500 (git) Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < f495b6c4c8594122918552c9be2b51eb71647cd9 (git) |
|
| Linux | Linux |
Affected:
5.1
Unaffected: 0 , < 5.1 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/pcm_native.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c172e4c53321ee6429955295ea133bc3597a3ca9",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "3035bb784cea3f338934f5042dd3f35225a51b2e",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "1c1b7e8e545ce65e40f65b55c432765e058ea98f",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "e8b784a3f4fba3ea9c4d05138ecfa784a069627f",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "e8315330e4ec09c0cac625515400e13d0ee22b81",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "2940cc3cf43c72126b74ee6376314c195382023a",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "db09bc4ab19ce548a078240d2374792523953500",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "f495b6c4c8594122918552c9be2b51eb71647cd9",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/pcm_native.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: wake linked drain waiters on unlink\n\nsnd_pcm_drain() on a linked stream parks an on-stack wait entry on the\ndrained peer\u0027s runtime-\u003esleep, and after schedule_timeout() removes it\nonly if that peer is still found in the caller\u0027s group. If group\nmembership changes during the wait and the sleep ends by signal or\ntimeout (so autoremove_wake_function() does not run), finish_wait() is\nskipped and snd_pcm_drain() returns with the entry still queued on that\nstream\u0027s sleep list; a later wake_up() then walks a freed stack frame.\nThis is reachable by unlinking either the drained or the draining stream.\n\nUnlike the close path (snd_pcm_drop() -\u003e snd_pcm_post_stop()),\nsnd_pcm_unlink() never wakes the sleep queues. Wake every group member\nunder the group lock before the membership change, so a linked drainer is\nreleased and drops its entry while the streams are still grouped.\n\nThe window was opened when snd_pcm_link_rwsem stopped being held across\nthe wait and the removal became conditional on group membership (see\nFixes). The later switch to finish_wait() kept that conditional removal,\nso the signal/timeout case remained."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:14.286Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c172e4c53321ee6429955295ea133bc3597a3ca9"
},
{
"url": "https://git.kernel.org/stable/c/3035bb784cea3f338934f5042dd3f35225a51b2e"
},
{
"url": "https://git.kernel.org/stable/c/1c1b7e8e545ce65e40f65b55c432765e058ea98f"
},
{
"url": "https://git.kernel.org/stable/c/e8b784a3f4fba3ea9c4d05138ecfa784a069627f"
},
{
"url": "https://git.kernel.org/stable/c/e8315330e4ec09c0cac625515400e13d0ee22b81"
},
{
"url": "https://git.kernel.org/stable/c/2940cc3cf43c72126b74ee6376314c195382023a"
},
{
"url": "https://git.kernel.org/stable/c/db09bc4ab19ce548a078240d2374792523953500"
},
{
"url": "https://git.kernel.org/stable/c/f495b6c4c8594122918552c9be2b51eb71647cd9"
}
],
"title": "ALSA: pcm: wake linked drain waiters on unlink",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80716",
"datePublished": "2026-08-28T06:53:14.286Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:14.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80715 (GCVE-0-2026-80715)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
igc: remove napi_synchronize() in igc_down()
Summary
In the Linux kernel, the following vulnerability has been resolved:
igc: remove napi_synchronize() in igc_down()
When an AF_XDP zero-copy application is killed abruptly, the XSK pool is
torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the
full budget on every poll, so napi_complete_done() never clears
NAPI_STATE_SCHED.
igc_down() calls napi_synchronize() before napi_disable(), so it spins
forever waiting for that bit and the interface never goes down. Drop the
napi_synchronize() and let napi_disable() do the job -- it sets
NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it
ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after
polling has stopped, matching the recent igb fix b1e067240379.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fc9df2a0b520d7d439ecf464794d53e91be74b93 , < ad6e0df267dc96edb7de1fa0a2fb2a70645bff86
(git)
Affected: fc9df2a0b520d7d439ecf464794d53e91be74b93 , < 605585a8d89aaeb0122e9016fdaa92376897a705 (git) Affected: fc9df2a0b520d7d439ecf464794d53e91be74b93 , < a0f16c337691813f8d8f014c01fff5a368e08898 (git) Affected: fc9df2a0b520d7d439ecf464794d53e91be74b93 , < f929a6fe5b7ae1e72d2c6d18cd69ab90dcf689d2 (git) Affected: fc9df2a0b520d7d439ecf464794d53e91be74b93 , < 3b5aee6fcbf6b58112d40d19c8d31fa3f78ee668 (git) Affected: fc9df2a0b520d7d439ecf464794d53e91be74b93 , < 9a2b637aef4e515c2179774888441d00e8a5ae95 (git) Affected: fc9df2a0b520d7d439ecf464794d53e91be74b93 , < 5ffab5b9589c50e4cfc0cf36ffd76c89422d4019 (git) |
|
| Linux | Linux |
Affected:
5.14
Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/igc/igc_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ad6e0df267dc96edb7de1fa0a2fb2a70645bff86",
"status": "affected",
"version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
"versionType": "git"
},
{
"lessThan": "605585a8d89aaeb0122e9016fdaa92376897a705",
"status": "affected",
"version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
"versionType": "git"
},
{
"lessThan": "a0f16c337691813f8d8f014c01fff5a368e08898",
"status": "affected",
"version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
"versionType": "git"
},
{
"lessThan": "f929a6fe5b7ae1e72d2c6d18cd69ab90dcf689d2",
"status": "affected",
"version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
"versionType": "git"
},
{
"lessThan": "3b5aee6fcbf6b58112d40d19c8d31fa3f78ee668",
"status": "affected",
"version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
"versionType": "git"
},
{
"lessThan": "9a2b637aef4e515c2179774888441d00e8a5ae95",
"status": "affected",
"version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
"versionType": "git"
},
{
"lessThan": "5ffab5b9589c50e4cfc0cf36ffd76c89422d4019",
"status": "affected",
"version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/igc/igc_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: remove napi_synchronize() in igc_down()\n\nWhen an AF_XDP zero-copy application is killed abruptly, the XSK pool is\ntorn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the\nfull budget on every poll, so napi_complete_done() never clears\nNAPI_STATE_SCHED.\n\nigc_down() calls napi_synchronize() before napi_disable(), so it spins\nforever waiting for that bit and the interface never goes down. Drop the\nnapi_synchronize() and let napi_disable() do the job -- it sets\nNAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it\nahead of igc_set_queue_napi() so the NAPI mapping is cleared only after\npolling has stopped, matching the recent igb fix b1e067240379."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:13.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ad6e0df267dc96edb7de1fa0a2fb2a70645bff86"
},
{
"url": "https://git.kernel.org/stable/c/605585a8d89aaeb0122e9016fdaa92376897a705"
},
{
"url": "https://git.kernel.org/stable/c/a0f16c337691813f8d8f014c01fff5a368e08898"
},
{
"url": "https://git.kernel.org/stable/c/f929a6fe5b7ae1e72d2c6d18cd69ab90dcf689d2"
},
{
"url": "https://git.kernel.org/stable/c/3b5aee6fcbf6b58112d40d19c8d31fa3f78ee668"
},
{
"url": "https://git.kernel.org/stable/c/9a2b637aef4e515c2179774888441d00e8a5ae95"
},
{
"url": "https://git.kernel.org/stable/c/5ffab5b9589c50e4cfc0cf36ffd76c89422d4019"
}
],
"title": "igc: remove napi_synchronize() in igc_down()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80715",
"datePublished": "2026-08-28T06:53:13.683Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:13.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80714 (GCVE-0-2026-80714)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
ipvs: do not propagate one-packet flag to synced conns
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: do not propagate one-packet flag to synced conns
Synced connections can be created before their destination exists. When
the destination is later added, ip_vs_bind_dest() copies connection flags
from the destination into cp->flags.
IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced
connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,
expiry can treat it as a one-packet connection and skip unlinking the
existing conn_tab node, leaving stale hash nodes pointing at a freed
struct ip_vs_conn.
Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced
connections.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
26ec037f9841e49cc5c615deb8e1e73e5beab2ca , < 06d1d9b56ef8132fbf85006885eb43d9510b8b02
(git)
Affected: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca , < acbdc276091b308ca7794acb86e761f8203e2f59 (git) Affected: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca , < 300348e3ba1521b003d59825f97e24f9a6859688 (git) Affected: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca , < 44af98cc7d5ef8e730488d5df1eecd5deeaa5947 (git) Affected: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca , < 4649e6faeecdc2d44bfa6ccbe405eef27e55d816 (git) Affected: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca , < b5ee5b266f833601ac4817f6df0bc496fc376a28 (git) Affected: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca , < e7acfc990c29890c883d0d0ce3f737d003a43b44 (git) Affected: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca , < a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b (git) |
|
| Linux | Linux |
Affected:
2.6.36
Unaffected: 0 , < 2.6.36 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06d1d9b56ef8132fbf85006885eb43d9510b8b02",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "acbdc276091b308ca7794acb86e761f8203e2f59",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "300348e3ba1521b003d59825f97e24f9a6859688",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "44af98cc7d5ef8e730488d5df1eecd5deeaa5947",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "4649e6faeecdc2d44bfa6ccbe405eef27e55d816",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "b5ee5b266f833601ac4817f6df0bc496fc376a28",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "e7acfc990c29890c883d0d0ce3f737d003a43b44",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: do not propagate one-packet flag to synced conns\n\nSynced connections can be created before their destination exists. When\nthe destination is later added, ip_vs_bind_dest() copies connection flags\nfrom the destination into cp-\u003eflags.\n\nIP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced\nconnection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,\nexpiry can treat it as a one-packet connection and skip unlinking the\nexisting conn_tab node, leaving stale hash nodes pointing at a freed\nstruct ip_vs_conn.\n\nDrop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced\nconnections."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:13.069Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06d1d9b56ef8132fbf85006885eb43d9510b8b02"
},
{
"url": "https://git.kernel.org/stable/c/acbdc276091b308ca7794acb86e761f8203e2f59"
},
{
"url": "https://git.kernel.org/stable/c/300348e3ba1521b003d59825f97e24f9a6859688"
},
{
"url": "https://git.kernel.org/stable/c/44af98cc7d5ef8e730488d5df1eecd5deeaa5947"
},
{
"url": "https://git.kernel.org/stable/c/4649e6faeecdc2d44bfa6ccbe405eef27e55d816"
},
{
"url": "https://git.kernel.org/stable/c/b5ee5b266f833601ac4817f6df0bc496fc376a28"
},
{
"url": "https://git.kernel.org/stable/c/e7acfc990c29890c883d0d0ce3f737d003a43b44"
},
{
"url": "https://git.kernel.org/stable/c/a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b"
}
],
"title": "ipvs: do not propagate one-packet flag to synced conns",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80714",
"datePublished": "2026-08-28T06:53:13.069Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:13.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80713 (GCVE-0-2026-80713)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
io_uring: preserve task restrictions across exec
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring: preserve task restrictions across exec
Per-task restrictions apply to all rings created by a task. Once
installed, they should not be dropped across exec.
For a task that has used io_uring, the exec cancellation path calls
__io_uring_free(). This frees both the task context and the per-task
restriction, so a ring created after exec is unrestricted.
Split task context cleanup into io_uring_free_tctx(), and use it from
the exec cancellation path. Keep __io_uring_free() for final task
cleanup, where both the context and restriction are released.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ed82f35b926b2e505c14b7006473614b8f58b4f4 , < fcef9325afeecced693a7438e975e4a3f8e2716f
(git)
Affected: ed82f35b926b2e505c14b7006473614b8f58b4f4 , < bc0e8faf90e776a2f1f3967a04e8091e6bdb4977 (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/cancel.c",
"io_uring/tctx.c",
"io_uring/tctx.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fcef9325afeecced693a7438e975e4a3f8e2716f",
"status": "affected",
"version": "ed82f35b926b2e505c14b7006473614b8f58b4f4",
"versionType": "git"
},
{
"lessThan": "bc0e8faf90e776a2f1f3967a04e8091e6bdb4977",
"status": "affected",
"version": "ed82f35b926b2e505c14b7006473614b8f58b4f4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/cancel.c",
"io_uring/tctx.c",
"io_uring/tctx.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: preserve task restrictions across exec\n\nPer-task restrictions apply to all rings created by a task. Once\ninstalled, they should not be dropped across exec.\n\nFor a task that has used io_uring, the exec cancellation path calls\n__io_uring_free(). This frees both the task context and the per-task\nrestriction, so a ring created after exec is unrestricted.\n\nSplit task context cleanup into io_uring_free_tctx(), and use it from\nthe exec cancellation path. Keep __io_uring_free() for final task\ncleanup, where both the context and restriction are released."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:12.438Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fcef9325afeecced693a7438e975e4a3f8e2716f"
},
{
"url": "https://git.kernel.org/stable/c/bc0e8faf90e776a2f1f3967a04e8091e6bdb4977"
}
],
"title": "io_uring: preserve task restrictions across exec",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80713",
"datePublished": "2026-08-28T06:53:12.438Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:12.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80712 (GCVE-0-2026-80712)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
qcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits
the descriptors, which makes the controller execute the command
immediately. For SPINAND_SET_FEATURE the value to be written is only
placed into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a
second submission - so the chip is programmed with whatever that register
happened to hold from a previous operation, and the intended value is only
applied by the *next* SET_FEATURE.
Measured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing
0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the
subsequent write of 0x00 leaves it at 0x40 - every write lands one
operation late.
This stayed unnoticed until v6.18 added SPI-NAND OTP support together
with OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode,
reads, and disables it again, and mtd_otp_nvmem_add() does this during
MTD registration. With the off-by-one, the "disable" write actually
applies the previously requested value, so CFG_OTP_ENABLE ends up set:
the chip stays in OTP mode, every subsequent array read returns the OTP
area instead of the array (UBI reports an empty device) and all writes
fail with -EIO because the OTP area is write protected. On this board
that makes the whole flash unusable and the device unbootable.
Write the feature value into NAND_FLASH_FEATURES as part of the same
transaction, before NAND_EXEC_CMD. While at it, copy only the bytes the
operation actually carries - the previous code dereferenced a 4-byte
pointer on a one-byte buffer (spinand->scratchbuf).
With this patch the flash contents read back bit-identical to a
known-good dump of the same board taken under the vendor firmware
(md5-verified across partitions), and writes work.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7304d1909080ef0c9da703500a97f46c98393fcd , < 581e5166f0780103dc91c0d8ebc801f9af4824b0
(git)
Affected: 7304d1909080ef0c9da703500a97f46c98393fcd , < 3ba021079ef2ac6e21e3547328496ac42d22b56a (git) Affected: 7304d1909080ef0c9da703500a97f46c98393fcd , < 8fd62901d6bf03f274a49dd0060793cc07dd51b0 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-qpic-snand.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "581e5166f0780103dc91c0d8ebc801f9af4824b0",
"status": "affected",
"version": "7304d1909080ef0c9da703500a97f46c98393fcd",
"versionType": "git"
},
{
"lessThan": "3ba021079ef2ac6e21e3547328496ac42d22b56a",
"status": "affected",
"version": "7304d1909080ef0c9da703500a97f46c98393fcd",
"versionType": "git"
},
{
"lessThan": "8fd62901d6bf03f274a49dd0060793cc07dd51b0",
"status": "affected",
"version": "7304d1909080ef0c9da703500a97f46c98393fcd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-qpic-snand.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-qpic-snand: write the feature value before executing SET_FEATURE\n\nqcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits\nthe descriptors, which makes the controller execute the command\nimmediately. For SPINAND_SET_FEATURE the value to be written is only\nplaced into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a\nsecond submission - so the chip is programmed with whatever that register\nhappened to hold from a previous operation, and the intended value is only\napplied by the *next* SET_FEATURE.\n\nMeasured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing\n0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the\nsubsequent write of 0x00 leaves it at 0x40 - every write lands one\noperation late.\n\nThis stayed unnoticed until v6.18 added SPI-NAND OTP support together\nwith OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode,\nreads, and disables it again, and mtd_otp_nvmem_add() does this during\nMTD registration. With the off-by-one, the \"disable\" write actually\napplies the previously requested value, so CFG_OTP_ENABLE ends up set:\nthe chip stays in OTP mode, every subsequent array read returns the OTP\narea instead of the array (UBI reports an empty device) and all writes\nfail with -EIO because the OTP area is write protected. On this board\nthat makes the whole flash unusable and the device unbootable.\n\nWrite the feature value into NAND_FLASH_FEATURES as part of the same\ntransaction, before NAND_EXEC_CMD. While at it, copy only the bytes the\noperation actually carries - the previous code dereferenced a 4-byte\npointer on a one-byte buffer (spinand-\u003escratchbuf).\n\nWith this patch the flash contents read back bit-identical to a\nknown-good dump of the same board taken under the vendor firmware\n(md5-verified across partitions), and writes work."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:11.243Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/581e5166f0780103dc91c0d8ebc801f9af4824b0"
},
{
"url": "https://git.kernel.org/stable/c/3ba021079ef2ac6e21e3547328496ac42d22b56a"
},
{
"url": "https://git.kernel.org/stable/c/8fd62901d6bf03f274a49dd0060793cc07dd51b0"
}
],
"title": "spi: spi-qpic-snand: write the feature value before executing SET_FEATURE",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80712",
"datePublished": "2026-08-28T06:53:11.243Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:11.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80711 (GCVE-0-2026-80711)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
power: supply: max17040: handle missing status supplier
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: max17040: handle missing status supplier
MAX17040 does not report charger state itself, so the driver forwards
POWER_SUPPLY_PROP_STATUS to a supplier power supply. If no supplier is
registered, power_supply_get_property_from_supplier() returns -ENODEV and
leaves the output value untouched.
max17040_get_property() currently ignores that error and returns success,
so userspace can read an uninitialized status value from the battery power
supply. This happens on systems that use the fuel gauge without a charger
supplier relationship in firmware.
Return POWER_SUPPLY_STATUS_UNKNOWN when no supplier provides STATUS, and
propagate other supplier lookup errors.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e , < 91ac995a6f4ddf4f92b231b080544abf23a9b871
(git)
Affected: f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e , < b039f13e095d28a64ca6b21d0ee5440d8b048f37 (git) Affected: f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e , < ee2ea0c452edc0930e7395b080dccd5a1cb965e1 (git) Affected: f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e , < 725668c6b6aa3971fe850659102c250d0d676e18 (git) |
|
| Linux | Linux |
Affected:
6.7
Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/max17040_battery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91ac995a6f4ddf4f92b231b080544abf23a9b871",
"status": "affected",
"version": "f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e",
"versionType": "git"
},
{
"lessThan": "b039f13e095d28a64ca6b21d0ee5440d8b048f37",
"status": "affected",
"version": "f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e",
"versionType": "git"
},
{
"lessThan": "ee2ea0c452edc0930e7395b080dccd5a1cb965e1",
"status": "affected",
"version": "f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e",
"versionType": "git"
},
{
"lessThan": "725668c6b6aa3971fe850659102c250d0d676e18",
"status": "affected",
"version": "f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/max17040_battery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: max17040: handle missing status supplier\n\nMAX17040 does not report charger state itself, so the driver forwards\nPOWER_SUPPLY_PROP_STATUS to a supplier power supply. If no supplier is\nregistered, power_supply_get_property_from_supplier() returns -ENODEV and\nleaves the output value untouched.\n\nmax17040_get_property() currently ignores that error and returns success,\nso userspace can read an uninitialized status value from the battery power\nsupply. This happens on systems that use the fuel gauge without a charger\nsupplier relationship in firmware.\n\nReturn POWER_SUPPLY_STATUS_UNKNOWN when no supplier provides STATUS, and\npropagate other supplier lookup errors."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:10.631Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91ac995a6f4ddf4f92b231b080544abf23a9b871"
},
{
"url": "https://git.kernel.org/stable/c/b039f13e095d28a64ca6b21d0ee5440d8b048f37"
},
{
"url": "https://git.kernel.org/stable/c/ee2ea0c452edc0930e7395b080dccd5a1cb965e1"
},
{
"url": "https://git.kernel.org/stable/c/725668c6b6aa3971fe850659102c250d0d676e18"
}
],
"title": "power: supply: max17040: handle missing status supplier",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80711",
"datePublished": "2026-08-28T06:53:10.631Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-08-28T06:53:10.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80710 (GCVE-0-2026-80710)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
s390/dasd: Fix undersized format-check buffer
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Fix undersized format-check buffer
fmt_buffer_size in dasd_eckd_check_device_format() is declared as
int, even though one of the multiplicands, sizeof(struct eckd_count),
is a size_t. The expression
trkcount * rpt_max * sizeof(struct eckd_count)
is therefore correctly evaluated at 64-bit width, but the result is
silently truncated when it is stored back into the 32-bit
fmt_buffer_size variable. For a sufficiently large track range
(start_unit/stop_unit are caller-controlled) this truncation
yields a buffer size far smaller than the number of tracks actually
requested. kzalloc() then succeeds with an undersized allocation,
while the subsequent channel program build still operates on the
untruncated track count and writes past the end of that buffer.
Compute the buffer size with check_mul_overflow() and keep it in a
size_t, so that a value that no longer fits results in -EINVAL
instead of a silently truncated allocation size.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8fd575200db5b53f6ea6818dd017f1b43190db12 , < aca18289c86f22d3fc2f3f6ff615286e7b1702f6
(git)
Affected: 8fd575200db5b53f6ea6818dd017f1b43190db12 , < 9f88dda2f22927d22498801a92cab6a9424eaf86 (git) Affected: 8fd575200db5b53f6ea6818dd017f1b43190db12 , < e16e0fc54120cee3c6f0362de95aab6792865857 (git) Affected: 8fd575200db5b53f6ea6818dd017f1b43190db12 , < 87f3389cd3920714c53e704778f7ca7f1cf0c39c (git) Affected: 8fd575200db5b53f6ea6818dd017f1b43190db12 , < 7f40b346462f563a0d6e841a77b5163d2a882a04 (git) |
|
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/block/dasd_eckd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aca18289c86f22d3fc2f3f6ff615286e7b1702f6",
"status": "affected",
"version": "8fd575200db5b53f6ea6818dd017f1b43190db12",
"versionType": "git"
},
{
"lessThan": "9f88dda2f22927d22498801a92cab6a9424eaf86",
"status": "affected",
"version": "8fd575200db5b53f6ea6818dd017f1b43190db12",
"versionType": "git"
},
{
"lessThan": "e16e0fc54120cee3c6f0362de95aab6792865857",
"status": "affected",
"version": "8fd575200db5b53f6ea6818dd017f1b43190db12",
"versionType": "git"
},
{
"lessThan": "87f3389cd3920714c53e704778f7ca7f1cf0c39c",
"status": "affected",
"version": "8fd575200db5b53f6ea6818dd017f1b43190db12",
"versionType": "git"
},
{
"lessThan": "7f40b346462f563a0d6e841a77b5163d2a882a04",
"status": "affected",
"version": "8fd575200db5b53f6ea6818dd017f1b43190db12",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/block/dasd_eckd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: Fix undersized format-check buffer\n\nfmt_buffer_size in dasd_eckd_check_device_format() is declared as\nint, even though one of the multiplicands, sizeof(struct eckd_count),\nis a size_t. The expression\n\n trkcount * rpt_max * sizeof(struct eckd_count)\n\nis therefore correctly evaluated at 64-bit width, but the result is\nsilently truncated when it is stored back into the 32-bit\nfmt_buffer_size variable. For a sufficiently large track range\n(start_unit/stop_unit are caller-controlled) this truncation\nyields a buffer size far smaller than the number of tracks actually\nrequested. kzalloc() then succeeds with an undersized allocation,\nwhile the subsequent channel program build still operates on the\nuntruncated track count and writes past the end of that buffer.\n\nCompute the buffer size with check_mul_overflow() and keep it in a\nsize_t, so that a value that no longer fits results in -EINVAL\ninstead of a silently truncated allocation size."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:10.028Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aca18289c86f22d3fc2f3f6ff615286e7b1702f6"
},
{
"url": "https://git.kernel.org/stable/c/9f88dda2f22927d22498801a92cab6a9424eaf86"
},
{
"url": "https://git.kernel.org/stable/c/e16e0fc54120cee3c6f0362de95aab6792865857"
},
{
"url": "https://git.kernel.org/stable/c/87f3389cd3920714c53e704778f7ca7f1cf0c39c"
},
{
"url": "https://git.kernel.org/stable/c/7f40b346462f563a0d6e841a77b5163d2a882a04"
}
],
"title": "s390/dasd: Fix undersized format-check buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80710",
"datePublished": "2026-08-28T06:53:10.028Z",
"dateReserved": "2026-08-26T14:34:25.787Z",
"dateUpdated": "2026-08-28T06:53:10.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80709 (GCVE-0-2026-80709)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
There is a wrong upper limit check for the domain value when an EP11
CPRB is processed for sending to a crypto card. This check is only
active on custom device nodes but may lead to access heap memory
behind perms->adm when an administrative CPRB is sent.
Add correct limit (AP_DOMAINS = 256) checking to fix this.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cfd68b33094e1a92249850ff3c3c92ae9112a541 , < 4589f742718d0256ea6dd1f5a78be6e689bdb8aa
(git)
Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < b505dcc8307d64468b463dfad45a03bf865c637e (git) Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < 13e53d6ae1c3b2ff1be75b9ef09be26f4ec3ce15 (git) Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < 672b12940e3f1336dfed5287412a71500adf2a76 (git) Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < 1223477ca88e2396eca440919d0ca8754df79bd5 (git) Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < 983279d7f86ade73db86f886e09172dd567031b5 (git) |
|
| Linux | Linux |
Affected:
5.18
Unaffected: 0 , < 5.18 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4589f742718d0256ea6dd1f5a78be6e689bdb8aa",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
},
{
"lessThan": "b505dcc8307d64468b463dfad45a03bf865c637e",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
},
{
"lessThan": "13e53d6ae1c3b2ff1be75b9ef09be26f4ec3ce15",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
},
{
"lessThan": "672b12940e3f1336dfed5287412a71500adf2a76",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
},
{
"lessThan": "1223477ca88e2396eca440919d0ca8754df79bd5",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
},
{
"lessThan": "983279d7f86ade73db86f886e09172dd567031b5",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix wrong domain value verification with EP11 CPRBs\n\nThere is a wrong upper limit check for the domain value when an EP11\nCPRB is processed for sending to a crypto card. This check is only\nactive on custom device nodes but may lead to access heap memory\nbehind perms-\u003eadm when an administrative CPRB is sent.\nAdd correct limit (AP_DOMAINS = 256) checking to fix this."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:09.439Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4589f742718d0256ea6dd1f5a78be6e689bdb8aa"
},
{
"url": "https://git.kernel.org/stable/c/b505dcc8307d64468b463dfad45a03bf865c637e"
},
{
"url": "https://git.kernel.org/stable/c/13e53d6ae1c3b2ff1be75b9ef09be26f4ec3ce15"
},
{
"url": "https://git.kernel.org/stable/c/672b12940e3f1336dfed5287412a71500adf2a76"
},
{
"url": "https://git.kernel.org/stable/c/1223477ca88e2396eca440919d0ca8754df79bd5"
},
{
"url": "https://git.kernel.org/stable/c/983279d7f86ade73db86f886e09172dd567031b5"
}
],
"title": "s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80709",
"datePublished": "2026-08-28T06:53:09.439Z",
"dateReserved": "2026-08-26T14:34:25.787Z",
"dateUpdated": "2026-08-28T06:53:09.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80708 (GCVE-0-2026-80708)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
The helper function _ip_cprb_helper() uses internal buffer memory for
building and processing CPRBs. After use this buffer was never
scrubbed which could lead to leaving for example clear key material in
memory which could be exposed via tricky reuse of this same memory.
Extend the _ip_cprb_helper() function with another parameter 'scrub'
used to steer scrubbing of this buffer. So now the caller has the
opportunity to decide if scrubbing is needed or not.
Extend the clear key to secure key token import process in function
cca_clr2cipherkey() to tell the helper function from above to scrub
the cprb buffer when the clear key value is part of the request data.
Add explicit scrubbing on return from function cca_clr2cipherkey() for
the random EXOR buffer and the cprb buffer.
Overall this cleans the internal used buffer in case of clear key
import to prevent sensitive data to get exposed.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 8e1c0def77b7450be0ed607ed0d7bae629d30020
(git)
Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < be7ae07fb745d1cf575b03a178a055b0a2859364 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 4e26d0d72bfdec311f12acfa0c6b7fbeb6a343d3 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 7dd6e556dbfc91d3d511cfd1015d2dad42608010 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < b453003ae6a869f5bdf025b5519cbb38295ae4f1 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < fbb0410986e8ad214121e51a4a28c3d0a10b7644 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < ebfbb9ac7adbb1e3556100b54a27e8a9b102feac (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 01476391aecef36a3b789ee844357b22fbc90665 (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8e1c0def77b7450be0ed607ed0d7bae629d30020",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "be7ae07fb745d1cf575b03a178a055b0a2859364",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "4e26d0d72bfdec311f12acfa0c6b7fbeb6a343d3",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "7dd6e556dbfc91d3d511cfd1015d2dad42608010",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "b453003ae6a869f5bdf025b5519cbb38295ae4f1",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "fbb0410986e8ad214121e51a4a28c3d0a10b7644",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "ebfbb9ac7adbb1e3556100b54a27e8a9b102feac",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "01476391aecef36a3b789ee844357b22fbc90665",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()\n\nThe helper function _ip_cprb_helper() uses internal buffer memory for\nbuilding and processing CPRBs. After use this buffer was never\nscrubbed which could lead to leaving for example clear key material in\nmemory which could be exposed via tricky reuse of this same memory.\n\nExtend the _ip_cprb_helper() function with another parameter \u0027scrub\u0027\nused to steer scrubbing of this buffer. So now the caller has the\nopportunity to decide if scrubbing is needed or not.\n\nExtend the clear key to secure key token import process in function\ncca_clr2cipherkey() to tell the helper function from above to scrub\nthe cprb buffer when the clear key value is part of the request data.\n\nAdd explicit scrubbing on return from function cca_clr2cipherkey() for\nthe random EXOR buffer and the cprb buffer.\n\nOverall this cleans the internal used buffer in case of clear key\nimport to prevent sensitive data to get exposed."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:08.843Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8e1c0def77b7450be0ed607ed0d7bae629d30020"
},
{
"url": "https://git.kernel.org/stable/c/be7ae07fb745d1cf575b03a178a055b0a2859364"
},
{
"url": "https://git.kernel.org/stable/c/4e26d0d72bfdec311f12acfa0c6b7fbeb6a343d3"
},
{
"url": "https://git.kernel.org/stable/c/7dd6e556dbfc91d3d511cfd1015d2dad42608010"
},
{
"url": "https://git.kernel.org/stable/c/b453003ae6a869f5bdf025b5519cbb38295ae4f1"
},
{
"url": "https://git.kernel.org/stable/c/fbb0410986e8ad214121e51a4a28c3d0a10b7644"
},
{
"url": "https://git.kernel.org/stable/c/ebfbb9ac7adbb1e3556100b54a27e8a9b102feac"
},
{
"url": "https://git.kernel.org/stable/c/01476391aecef36a3b789ee844357b22fbc90665"
}
],
"title": "s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80708",
"datePublished": "2026-08-28T06:53:08.843Z",
"dateReserved": "2026-08-26T14:34:25.787Z",
"dateUpdated": "2026-08-28T06:53:08.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80707 (GCVE-0-2026-80707)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
Zero the allocated buffer in j1939_session_fresh_new() to ensure it
contains no residual data.
While there is a potential performance impact if users allocate maximum
sized ETP buffers, most real-world use cases are not noticeably affected
since the maximum known buffer size is typically around 65K.
[mkl: add Message-ID]
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9d71dd0c70099914fcd063135da3c580865e924c , < 348818277a3646d5b9fa60c9d20c00dc4bc86832
(git)
Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < f3e120a34b336079479fa10f706f0636eaa6e751 (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < bbfa49d1e287de44994955b44d19281be3195b44 (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < 194d67e92197eb820f4c2c6605d9721333b3eba0 (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < 038bad8e16c2e28acf31f0b527a816fb23a57269 (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < 8604a3b81b9d0ceaf04fee5f52e701f623a179f9 (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < d5b3613c7d69d8dcb4dd6704f1f463198ce9f6cf (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < eb96c58907922546e415e545fe9a14ea63b02719 (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/j1939/transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "348818277a3646d5b9fa60c9d20c00dc4bc86832",
"status": "affected",
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
"versionType": "git"
},
{
"lessThan": "f3e120a34b336079479fa10f706f0636eaa6e751",
"status": "affected",
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
"versionType": "git"
},
{
"lessThan": "bbfa49d1e287de44994955b44d19281be3195b44",
"status": "affected",
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
"versionType": "git"
},
{
"lessThan": "194d67e92197eb820f4c2c6605d9721333b3eba0",
"status": "affected",
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
"versionType": "git"
},
{
"lessThan": "038bad8e16c2e28acf31f0b527a816fb23a57269",
"status": "affected",
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
"versionType": "git"
},
{
"lessThan": "8604a3b81b9d0ceaf04fee5f52e701f623a179f9",
"status": "affected",
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
"versionType": "git"
},
{
"lessThan": "d5b3613c7d69d8dcb4dd6704f1f463198ce9f6cf",
"status": "affected",
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
"versionType": "git"
},
{
"lessThan": "eb96c58907922546e415e545fe9a14ea63b02719",
"status": "affected",
"version": "9d71dd0c70099914fcd063135da3c580865e924c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/j1939/transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: transport: j1939_session_fresh_new(): initialize receive buffer\n\nZero the allocated buffer in j1939_session_fresh_new() to ensure it\ncontains no residual data.\n\nWhile there is a potential performance impact if users allocate maximum\nsized ETP buffers, most real-world use cases are not noticeably affected\nsince the maximum known buffer size is typically around 65K.\n\n[mkl: add Message-ID]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:08.244Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/348818277a3646d5b9fa60c9d20c00dc4bc86832"
},
{
"url": "https://git.kernel.org/stable/c/f3e120a34b336079479fa10f706f0636eaa6e751"
},
{
"url": "https://git.kernel.org/stable/c/bbfa49d1e287de44994955b44d19281be3195b44"
},
{
"url": "https://git.kernel.org/stable/c/194d67e92197eb820f4c2c6605d9721333b3eba0"
},
{
"url": "https://git.kernel.org/stable/c/038bad8e16c2e28acf31f0b527a816fb23a57269"
},
{
"url": "https://git.kernel.org/stable/c/8604a3b81b9d0ceaf04fee5f52e701f623a179f9"
},
{
"url": "https://git.kernel.org/stable/c/d5b3613c7d69d8dcb4dd6704f1f463198ce9f6cf"
},
{
"url": "https://git.kernel.org/stable/c/eb96c58907922546e415e545fe9a14ea63b02719"
}
],
"title": "can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80707",
"datePublished": "2026-08-28T06:53:08.244Z",
"dateReserved": "2026-08-26T14:34:25.787Z",
"dateUpdated": "2026-08-28T06:53:08.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80706 (GCVE-0-2026-80706)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
can: softing: fw_parse(): validate firmware record spans
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: softing: fw_parse(): validate firmware record spans
fw_parse() reads a fixed record header, a firmware-provided payload,
and a trailing checksum without knowing the end of the firmware blob. A
truncated record can therefore make those reads exceed the blob.
The same record also supplies addresses and lengths for writes into
DPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its
bounds check, while the application loader does not bound the staging
copy at all.
Pass the firmware end to the parser and validate the full source record.
Use a signed wide offset for generic DPRAM records and validate the
application staging span against the mapped DPRAM before copying.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < f6d9a6a9512430b395a1940d7b216394fd02d30b
(git)
Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < 84c850b08fc0d671c245144b619683129b55690a (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50 (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < ae588e5b9cc268de1aabf30f939f0870717ca164 (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < ad331e26fd213a19fee0de18cdacd67b7ff5b478 (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < 2ee477e541a6d5e434d6a4041c6b677ab42e1d82 (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < 808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1 (git) Affected: 03fd3cf5a179da12e6bee5e9d74b648aff68dc4c , < 856d6cb04e5407523566b075841dcd6423757d1c (git) |
|
| Linux | Linux |
Affected:
2.6.38
Unaffected: 0 , < 2.6.38 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/softing/softing_fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f6d9a6a9512430b395a1940d7b216394fd02d30b",
"status": "affected",
"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
"versionType": "git"
},
{
"lessThan": "84c850b08fc0d671c245144b619683129b55690a",
"status": "affected",
"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
"versionType": "git"
},
{
"lessThan": "d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50",
"status": "affected",
"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
"versionType": "git"
},
{
"lessThan": "ae588e5b9cc268de1aabf30f939f0870717ca164",
"status": "affected",
"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
"versionType": "git"
},
{
"lessThan": "ad331e26fd213a19fee0de18cdacd67b7ff5b478",
"status": "affected",
"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
"versionType": "git"
},
{
"lessThan": "2ee477e541a6d5e434d6a4041c6b677ab42e1d82",
"status": "affected",
"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
"versionType": "git"
},
{
"lessThan": "808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1",
"status": "affected",
"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
"versionType": "git"
},
{
"lessThan": "856d6cb04e5407523566b075841dcd6423757d1c",
"status": "affected",
"version": "03fd3cf5a179da12e6bee5e9d74b648aff68dc4c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/softing/softing_fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: softing: fw_parse(): validate firmware record spans\n\nfw_parse() reads a fixed record header, a firmware-provided payload,\nand a trailing checksum without knowing the end of the firmware blob. A\ntruncated record can therefore make those reads exceed the blob.\n\nThe same record also supplies addresses and lengths for writes into\nDPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its\nbounds check, while the application loader does not bound the staging\ncopy at all.\n\nPass the firmware end to the parser and validate the full source record.\nUse a signed wide offset for generic DPRAM records and validate the\napplication staging span against the mapped DPRAM before copying."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:07.640Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f6d9a6a9512430b395a1940d7b216394fd02d30b"
},
{
"url": "https://git.kernel.org/stable/c/84c850b08fc0d671c245144b619683129b55690a"
},
{
"url": "https://git.kernel.org/stable/c/d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50"
},
{
"url": "https://git.kernel.org/stable/c/ae588e5b9cc268de1aabf30f939f0870717ca164"
},
{
"url": "https://git.kernel.org/stable/c/ad331e26fd213a19fee0de18cdacd67b7ff5b478"
},
{
"url": "https://git.kernel.org/stable/c/2ee477e541a6d5e434d6a4041c6b677ab42e1d82"
},
{
"url": "https://git.kernel.org/stable/c/808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1"
},
{
"url": "https://git.kernel.org/stable/c/856d6cb04e5407523566b075841dcd6423757d1c"
}
],
"title": "can: softing: fw_parse(): validate firmware record spans",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80706",
"datePublished": "2026-08-28T06:53:07.640Z",
"dateReserved": "2026-08-26T14:34:25.787Z",
"dateUpdated": "2026-08-28T06:53:07.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80705 (GCVE-0-2026-80705)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
drm/amd/display: check if dml21_add_phantom_plane() is successful
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: check if dml21_add_phantom_plane() is successful
Verify that the phantom plane was allocated to avoid a later
segfault.
(cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
70839da6360500a82e4d5f78499284474cbed7c1 , < 062cfd6c678f6647c8841f684d6dadab08d95512
(git)
Affected: 70839da6360500a82e4d5f78499284474cbed7c1 , < 000acb4ce7fb9feba3072ce468ad681f6585cd5d (git) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "062cfd6c678f6647c8841f684d6dadab08d95512",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
},
{
"lessThan": "000acb4ce7fb9feba3072ce468ad681f6585cd5d",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: check if dml21_add_phantom_plane() is successful\n\nVerify that the phantom plane was allocated to avoid a later\nsegfault.\n\n(cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:07.045Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/062cfd6c678f6647c8841f684d6dadab08d95512"
},
{
"url": "https://git.kernel.org/stable/c/000acb4ce7fb9feba3072ce468ad681f6585cd5d"
}
],
"title": "drm/amd/display: check if dml21_add_phantom_plane() is successful",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80705",
"datePublished": "2026-08-28T06:53:07.045Z",
"dateReserved": "2026-08-26T14:34:25.787Z",
"dateUpdated": "2026-08-28T06:53:07.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80704 (GCVE-0-2026-80704)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
drm/amd/display: use proper context for logging
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: use proper context for logging
The same as the rest of the code, get_ss_info_from_atombios() uses
calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is
initialized only later in calc_pll_max_vco_construct(). Therefore, any
output using DC_LOG_SYNC() leads to a NULL pointer deference in
get_ss_info_from_atombios().
According to Sashiko, the very same problem exists in
dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.
To avoid accessing the NULL context, use clk_src->base.ctx->logger
everywhere. That context in base is initialized earlier in
dce110_clk_src_construct() and dce112_clk_src_construct(). Before
get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions
above are actually called. This is done by redefining DC_LOGGER to
CTX->logger.
Before:
dce110_clk_src_construct() did:
-> sets clk_src->base.ctx = ctx;
-> ss_info_from_atombios_create()
-> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM
-> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx
After:
dce110_clk_src_construct() does:
-> sets clk_src->base.ctx = ctx;
-> ss_info_from_atombios_create()
-> get_ss_info_from_atombios() <- uses clk_src->base.ctx
(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1296423bf23c7a58133970e223b1f47ec6570308 , < a94e62b7c7018fcfe0251e53fa96af30f12d923a
(git)
Affected: 1296423bf23c7a58133970e223b1f47ec6570308 , < 02647d98340738f918690ed227fdcf154db1b84a (git) Affected: 1296423bf23c7a58133970e223b1f47ec6570308 , < f556bc844cc4423e5ad41ae41a4c24f1cf75b978 (git) Affected: 1296423bf23c7a58133970e223b1f47ec6570308 , < 114b42507b6a23d9d24e24e4ef165233332c64d4 (git) |
|
| Linux | Linux |
Affected:
4.17
Unaffected: 0 , < 4.17 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a94e62b7c7018fcfe0251e53fa96af30f12d923a",
"status": "affected",
"version": "1296423bf23c7a58133970e223b1f47ec6570308",
"versionType": "git"
},
{
"lessThan": "02647d98340738f918690ed227fdcf154db1b84a",
"status": "affected",
"version": "1296423bf23c7a58133970e223b1f47ec6570308",
"versionType": "git"
},
{
"lessThan": "f556bc844cc4423e5ad41ae41a4c24f1cf75b978",
"status": "affected",
"version": "1296423bf23c7a58133970e223b1f47ec6570308",
"versionType": "git"
},
{
"lessThan": "114b42507b6a23d9d24e24e4ef165233332c64d4",
"status": "affected",
"version": "1296423bf23c7a58133970e223b1f47ec6570308",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: use proper context for logging\n\nThe same as the rest of the code, get_ss_info_from_atombios() uses\ncalc_pll_cs-\u003ectx-\u003elogger for logging. But calc_pll_cs-\u003ectx is\ninitialized only later in calc_pll_max_vco_construct(). Therefore, any\noutput using DC_LOG_SYNC() leads to a NULL pointer deference in\nget_ss_info_from_atombios().\n\nAccording to Sashiko, the very same problem exists in\ndce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.\n\nTo avoid accessing the NULL context, use clk_src-\u003ebase.ctx-\u003elogger\neverywhere. That context in base is initialized earlier in\ndce110_clk_src_construct() and dce112_clk_src_construct(). Before\nget_ss_info_from_atombios() or Sashiko\u0027s get_pix_clk_dividers functions\nabove are actually called. This is done by redefining DC_LOGGER to\nCTX-\u003elogger.\n\nBefore:\ndce110_clk_src_construct() did:\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\n -\u003e ss_info_from_atombios_create()\n -\u003e get_ss_info_from_atombios() \u003c- uses calc_pll_cs-\u003ectx # BOOM\n -\u003e calc_pll_max_vco_construct() \u003c- sets calc_pll_cs-\u003ectx\n\nAfter:\ndce110_clk_src_construct() does:\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\n -\u003e ss_info_from_atombios_create()\n -\u003e get_ss_info_from_atombios() \u003c- uses clk_src-\u003ebase.ctx\n\n(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:06.442Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a94e62b7c7018fcfe0251e53fa96af30f12d923a"
},
{
"url": "https://git.kernel.org/stable/c/02647d98340738f918690ed227fdcf154db1b84a"
},
{
"url": "https://git.kernel.org/stable/c/f556bc844cc4423e5ad41ae41a4c24f1cf75b978"
},
{
"url": "https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4"
}
],
"title": "drm/amd/display: use proper context for logging",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80704",
"datePublished": "2026-08-28T06:53:06.442Z",
"dateReserved": "2026-08-26T14:34:25.786Z",
"dateUpdated": "2026-08-28T06:53:06.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80703 (GCVE-0-2026-80703)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
Prevent unauthorized termination of active GPU debug sessions.
Previously, users with /dev/kfd access could terminate another process's
debug session without proper ownership or ptrace authorization.
(cherry picked from commit 4db4c5ffd5585b72622ecf6ffedf2da258ee23f5)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ce813614f63b020a826071276a92f2cfae7cba79
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b8c05061997408bf81759f2dd31cd5f66771d15f (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9e52212aff8ed1fd9087728f61243ce3efd9d0ac (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4070909ac042f44654aac72f7986ea550c96f591 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 99b2fe4f19e3be0a8d0a0b5ea98d855970889653 (git) Affected: 0 , < 6.6.151 (semver) Affected: 0 , < 6.12.103 (semver) Affected: 0 , < 6.18.44 (semver) Affected: 0 , < 7.1.8 (semver) |
|
| Linux | Linux |
Unaffected:
6.6.151 , ≤ 6.6.*
(semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce813614f63b020a826071276a92f2cfae7cba79",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b8c05061997408bf81759f2dd31cd5f66771d15f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9e52212aff8ed1fd9087728f61243ce3efd9d0ac",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4070909ac042f44654aac72f7986ea550c96f591",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "99b2fe4f19e3be0a8d0a0b5ea98d855970889653",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.6.151",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.103",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.44",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE\n\nPrevent unauthorized termination of active GPU debug sessions.\nPreviously, users with /dev/kfd access could terminate another process\u0027s\ndebug session without proper ownership or ptrace authorization.\n\n(cherry picked from commit 4db4c5ffd5585b72622ecf6ffedf2da258ee23f5)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:05.851Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce813614f63b020a826071276a92f2cfae7cba79"
},
{
"url": "https://git.kernel.org/stable/c/b8c05061997408bf81759f2dd31cd5f66771d15f"
},
{
"url": "https://git.kernel.org/stable/c/9e52212aff8ed1fd9087728f61243ce3efd9d0ac"
},
{
"url": "https://git.kernel.org/stable/c/4070909ac042f44654aac72f7986ea550c96f591"
},
{
"url": "https://git.kernel.org/stable/c/99b2fe4f19e3be0a8d0a0b5ea98d855970889653"
}
],
"title": "drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80703",
"datePublished": "2026-08-28T06:53:05.851Z",
"dateReserved": "2026-08-26T14:34:25.786Z",
"dateUpdated": "2026-08-28T06:53:05.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80702 (GCVE-0-2026-80702)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
Two sites in vmwgfx_resource.c assign boolean literals to
res->guest_memory_size, which is an unsigned long allocation-size
field; the intended target is the adjacent res->guest_memory_dirty
bitfield. After the assignments the field holds 0 or 1 instead of
the resource's MOB allocation size:
- vmw_resource_release() writes 0 (false), and
- vmw_resource_unbind_list() writes 1 (true).
Subsequent revalidation paths read guest_memory_size when computing
the dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer
allocation size (vmw_resource_buf_alloc()), producing zero-length
walks or wrap-around ranges that read or write past the MOB bitmap.
The dirty-tracking intent of the original code (mark the resource as
dirtied since the last sync) is also lost, since guest_memory_dirty
is never updated.
Rename both assignments to guest_memory_dirty.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
668b206601c5f5063e03b76784a0d3024fa2b249 , < 21bbe38faee4a195d33a93e3908e307807f7745d
(git)
Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6 (git) Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 282f261cb035e5f01a486f76d356b7e9dbfba73f (git) Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 3b2bb16a5b622867140d69925db411ac8ecb3b2b (git) Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21bbe38faee4a195d33a93e3908e307807f7745d",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "282f261cb035e5f01a486f76d356b7e9dbfba73f",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "3b2bb16a5b622867140d69925db411ac8ecb3b2b",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size\n\nTwo sites in vmwgfx_resource.c assign boolean literals to\nres-\u003eguest_memory_size, which is an unsigned long allocation-size\nfield; the intended target is the adjacent res-\u003eguest_memory_dirty\nbitfield. After the assignments the field holds 0 or 1 instead of\nthe resource\u0027s MOB allocation size:\n\n - vmw_resource_release() writes 0 (false), and\n - vmw_resource_unbind_list() writes 1 (true).\n\nSubsequent revalidation paths read guest_memory_size when computing\nthe dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer\nallocation size (vmw_resource_buf_alloc()), producing zero-length\nwalks or wrap-around ranges that read or write past the MOB bitmap.\nThe dirty-tracking intent of the original code (mark the resource as\ndirtied since the last sync) is also lost, since guest_memory_dirty\nis never updated.\n\nRename both assignments to guest_memory_dirty."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:05.253Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21bbe38faee4a195d33a93e3908e307807f7745d"
},
{
"url": "https://git.kernel.org/stable/c/9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6"
},
{
"url": "https://git.kernel.org/stable/c/282f261cb035e5f01a486f76d356b7e9dbfba73f"
},
{
"url": "https://git.kernel.org/stable/c/3b2bb16a5b622867140d69925db411ac8ecb3b2b"
},
{
"url": "https://git.kernel.org/stable/c/83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa"
}
],
"title": "drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80702",
"datePublished": "2026-08-28T06:53:05.253Z",
"dateReserved": "2026-08-26T14:34:25.786Z",
"dateUpdated": "2026-08-28T06:53:05.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80701 (GCVE-0-2026-80701)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
drm/vmwgfx: enforce cursor size limits for MOB cursors
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: enforce cursor size limits for MOB cursors
vmw_cursor_plane_atomic_check() bounds cursor width and height only
on the legacy update path; the SVGA_CAP2_CURSOR_MOB path -- the
default on modern hosts -- accepts any size. When the requested size
exceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE,
vmw_cursor_mob_get() returns -EINVAL and leaves vps->cursor.mob NULL.
Its return value is then discarded in vmw_cursor_plane_prepare_fb(),
so the subsequent vmw_cursor_update_mob() calls
vmw_bo_map_and_cache(NULL) and oopses inside
vmw_bo_map_and_cache_size() on the tbo.base.size load.
Reachable from any DRM master via DRM_IOCTL_MODE_CURSOR2 with a
sufficiently large width or height (e.g. cursor_max_dim + 1).
Reject oversized cursors in atomic_check for both MOB-backed cursor
update types. The MOB byte-size limit only applies to the
SVGA_CAP2_CURSOR_MOB path (vmw_cursor_mob_size() returns 0 for
GB_ONLY); compute the required MOB size in 64-bit to avoid overflow
when very large dimensions are requested.
In prepare_fb only call vmw_cursor_mob_get()/_map() for
VMW_CURSOR_UPDATE_MOB -- the GB_ONLY path uses bo->map.virtual
directly and would otherwise be silently downgraded to NONE on hosts
without SVGA_CAP2_CURSOR_MOB (where vmw_cursor_mob_get() always
returns -EINVAL). Degrade the update to NONE if vmw_cursor_mob_get()
or vmw_cursor_mob_map() fails so the update path does not run with a
NULL backing MOB.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
965544150d1cadf0e8f5bb6c13c19697e46e1429 , < 1eb4f796695be39e0b5c4383350033ced9ade703
(git)
Affected: 965544150d1cadf0e8f5bb6c13c19697e46e1429 , < 9109b7935b9c058b75348610ef8437c52f9020e3 (git) Affected: 965544150d1cadf0e8f5bb6c13c19697e46e1429 , < d5ed8749168ad13c0dbaa8300f68d854b6076966 (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1eb4f796695be39e0b5c4383350033ced9ade703",
"status": "affected",
"version": "965544150d1cadf0e8f5bb6c13c19697e46e1429",
"versionType": "git"
},
{
"lessThan": "9109b7935b9c058b75348610ef8437c52f9020e3",
"status": "affected",
"version": "965544150d1cadf0e8f5bb6c13c19697e46e1429",
"versionType": "git"
},
{
"lessThan": "d5ed8749168ad13c0dbaa8300f68d854b6076966",
"status": "affected",
"version": "965544150d1cadf0e8f5bb6c13c19697e46e1429",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: enforce cursor size limits for MOB cursors\n\nvmw_cursor_plane_atomic_check() bounds cursor width and height only\non the legacy update path; the SVGA_CAP2_CURSOR_MOB path -- the\ndefault on modern hosts -- accepts any size. When the requested size\nexceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE,\nvmw_cursor_mob_get() returns -EINVAL and leaves vps-\u003ecursor.mob NULL.\nIts return value is then discarded in vmw_cursor_plane_prepare_fb(),\nso the subsequent vmw_cursor_update_mob() calls\nvmw_bo_map_and_cache(NULL) and oopses inside\nvmw_bo_map_and_cache_size() on the tbo.base.size load.\n\nReachable from any DRM master via DRM_IOCTL_MODE_CURSOR2 with a\nsufficiently large width or height (e.g. cursor_max_dim + 1).\n\nReject oversized cursors in atomic_check for both MOB-backed cursor\nupdate types. The MOB byte-size limit only applies to the\nSVGA_CAP2_CURSOR_MOB path (vmw_cursor_mob_size() returns 0 for\nGB_ONLY); compute the required MOB size in 64-bit to avoid overflow\nwhen very large dimensions are requested.\n\nIn prepare_fb only call vmw_cursor_mob_get()/_map() for\nVMW_CURSOR_UPDATE_MOB -- the GB_ONLY path uses bo-\u003emap.virtual\ndirectly and would otherwise be silently downgraded to NONE on hosts\nwithout SVGA_CAP2_CURSOR_MOB (where vmw_cursor_mob_get() always\nreturns -EINVAL). Degrade the update to NONE if vmw_cursor_mob_get()\nor vmw_cursor_mob_map() fails so the update path does not run with a\nNULL backing MOB."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:04.652Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1eb4f796695be39e0b5c4383350033ced9ade703"
},
{
"url": "https://git.kernel.org/stable/c/9109b7935b9c058b75348610ef8437c52f9020e3"
},
{
"url": "https://git.kernel.org/stable/c/d5ed8749168ad13c0dbaa8300f68d854b6076966"
}
],
"title": "drm/vmwgfx: enforce cursor size limits for MOB cursors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80701",
"datePublished": "2026-08-28T06:53:04.652Z",
"dateReserved": "2026-08-26T14:34:25.786Z",
"dateUpdated": "2026-08-28T06:53:04.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80700 (GCVE-0-2026-80700)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
drm/vmwgfx: validate external BO copy bounds for both stride paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: validate external BO copy bounds for both stride paths
vmw_external_bo_copy() trusts caller-supplied offsets, strides, and
heights and operates on imported dma-buf vmaps:
- The equal-stride memcpy() bound was clamped after subtracting the
offsets from dst_size and src_size; an offset larger than the BO
size wraps the unsigned subtraction to a huge value and the
resulting memcpy() runs off the end of the vmap. dst_stride *
height is also a u32 multiplication that can overflow.
- The non-equal-stride row-by-row path had no bound at all. The
loop touches bytes through offset + (height - 1) * stride +
width_in_bytes, with only a WARN_ON(dst_stride < width_in_bytes),
and could likewise step past the end of either mapping.
The offsets and strides are derived from STDU/SOU plane state, so a
configured CRTC submitting a crafted atomic commit on an imported
framebuffer can reach this path.
Validate the exact row-copy endpoint against each BO's size up front
using check_mul_overflow() and check_add_overflow(). Use the bulk
memcpy() path only when width_in_bytes covers the whole stride;
otherwise copy one row at a time so partial-row updates near the bottom
of a framebuffer remain valid. Also reject zero strides and stride <
width_in_bytes, both of which the row-by-row path cannot represent
safely.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4 , < 4e0f669e2951b742239c6fe847fcc406fe78748d
(git)
Affected: 50f1199250912568606b3778dc56646c10cb7b04 , < e7b25a6011781ebfdbc458552cae6d4156732771 (git) Affected: 50f1199250912568606b3778dc56646c10cb7b04 , < 042ca38779554687fc32b66a28328e0d9a36c58f (git) Affected: 50f1199250912568606b3778dc56646c10cb7b04 , < 5e4a2d15637a906cbd9bc98e0bf969f5f713e344 (git) Affected: 50f1199250912568606b3778dc56646c10cb7b04 , < 706c93c5813caabbb0d0a576c017d15aeec2c113 (git) Affected: 5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854 (git) Affected: 6.6.49 , < 6.6.151 (semver) Affected: 6.10.8 , < 6.11 (semver) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_blit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e0f669e2951b742239c6fe847fcc406fe78748d",
"status": "affected",
"version": "9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4",
"versionType": "git"
},
{
"lessThan": "e7b25a6011781ebfdbc458552cae6d4156732771",
"status": "affected",
"version": "50f1199250912568606b3778dc56646c10cb7b04",
"versionType": "git"
},
{
"lessThan": "042ca38779554687fc32b66a28328e0d9a36c58f",
"status": "affected",
"version": "50f1199250912568606b3778dc56646c10cb7b04",
"versionType": "git"
},
{
"lessThan": "5e4a2d15637a906cbd9bc98e0bf969f5f713e344",
"status": "affected",
"version": "50f1199250912568606b3778dc56646c10cb7b04",
"versionType": "git"
},
{
"lessThan": "706c93c5813caabbb0d0a576c017d15aeec2c113",
"status": "affected",
"version": "50f1199250912568606b3778dc56646c10cb7b04",
"versionType": "git"
},
{
"status": "affected",
"version": "5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854",
"versionType": "git"
},
{
"lessThan": "6.6.151",
"status": "affected",
"version": "6.6.49",
"versionType": "semver"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_blit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.6.49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate external BO copy bounds for both stride paths\n\nvmw_external_bo_copy() trusts caller-supplied offsets, strides, and\nheights and operates on imported dma-buf vmaps:\n\n - The equal-stride memcpy() bound was clamped after subtracting the\n offsets from dst_size and src_size; an offset larger than the BO\n size wraps the unsigned subtraction to a huge value and the\n resulting memcpy() runs off the end of the vmap. dst_stride *\n height is also a u32 multiplication that can overflow.\n - The non-equal-stride row-by-row path had no bound at all. The\n loop touches bytes through offset + (height - 1) * stride +\n width_in_bytes, with only a WARN_ON(dst_stride \u003c width_in_bytes),\n and could likewise step past the end of either mapping.\n\nThe offsets and strides are derived from STDU/SOU plane state, so a\nconfigured CRTC submitting a crafted atomic commit on an imported\nframebuffer can reach this path.\n\nValidate the exact row-copy endpoint against each BO\u0027s size up front\nusing check_mul_overflow() and check_add_overflow(). Use the bulk\nmemcpy() path only when width_in_bytes covers the whole stride;\notherwise copy one row at a time so partial-row updates near the bottom\nof a framebuffer remain valid. Also reject zero strides and stride \u003c\nwidth_in_bytes, both of which the row-by-row path cannot represent\nsafely."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:04.050Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e0f669e2951b742239c6fe847fcc406fe78748d"
},
{
"url": "https://git.kernel.org/stable/c/e7b25a6011781ebfdbc458552cae6d4156732771"
},
{
"url": "https://git.kernel.org/stable/c/042ca38779554687fc32b66a28328e0d9a36c58f"
},
{
"url": "https://git.kernel.org/stable/c/5e4a2d15637a906cbd9bc98e0bf969f5f713e344"
},
{
"url": "https://git.kernel.org/stable/c/706c93c5813caabbb0d0a576c017d15aeec2c113"
}
],
"title": "drm/vmwgfx: validate external BO copy bounds for both stride paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80700",
"datePublished": "2026-08-28T06:53:04.050Z",
"dateReserved": "2026-08-26T14:34:25.786Z",
"dateUpdated": "2026-08-28T06:53:04.050Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80699 (GCVE-0-2026-80699)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
In the nested state, the physical interrupt has already been
deactivated through the HW bit in the LR. The extra deactivation
would be harmless but can hit an errata case on AmpereOne, so
avoid it here.
On AmpereOne, deactivating a physical interrupt through
ICC_DIR_EL1 or ICC_EOIR1_EL1 (depending on EOImode) which is not
active, but is the highest priority pending interrupt causes the
cpu to lose the interrupt pending state and also prevents the
delivery of future interrupts.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6dd333c8942b2e5bb5927af843b56ec2857db7c7 , < f78f08b38a7f121c7d6b3e41002d9de7fd3c9189
(git)
Affected: 6dd333c8942b2e5bb5927af843b56ec2857db7c7 , < 8a570b19b4b16a8a3b5ffa2b332bd5613110b2d8 (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Documentation/arch/arm64/silicon-errata.rst",
"arch/arm64/kvm/vgic/vgic-v3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f78f08b38a7f121c7d6b3e41002d9de7fd3c9189",
"status": "affected",
"version": "6dd333c8942b2e5bb5927af843b56ec2857db7c7",
"versionType": "git"
},
{
"lessThan": "8a570b19b4b16a8a3b5ffa2b332bd5613110b2d8",
"status": "affected",
"version": "6dd333c8942b2e5bb5927af843b56ec2857db7c7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Documentation/arch/arm64/silicon-errata.rst",
"arch/arm64/kvm/vgic/vgic-v3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context\n\nIn the nested state, the physical interrupt has already been\ndeactivated through the HW bit in the LR. The extra deactivation\nwould be harmless but can hit an errata case on AmpereOne, so\navoid it here.\n\nOn AmpereOne, deactivating a physical interrupt through\nICC_DIR_EL1 or ICC_EOIR1_EL1 (depending on EOImode) which is not\nactive, but is the highest priority pending interrupt causes the\ncpu to lose the interrupt pending state and also prevents the\ndelivery of future interrupts."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:03.430Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f78f08b38a7f121c7d6b3e41002d9de7fd3c9189"
},
{
"url": "https://git.kernel.org/stable/c/8a570b19b4b16a8a3b5ffa2b332bd5613110b2d8"
}
],
"title": "KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80699",
"datePublished": "2026-08-28T06:53:03.430Z",
"dateReserved": "2026-08-26T14:34:25.786Z",
"dateUpdated": "2026-08-28T06:53:03.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80698 (GCVE-0-2026-80698)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
dmaengine: idxd: fix double free of wq, engine, and group structs
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: fix double free of wq, engine, and group structs
The release callbacks for wq, engine, and group devices
(idxd_conf_wq_release, idxd_conf_engine_release,
idxd_conf_group_release) each call kfree() on the enclosing struct.
The setup error paths and cleanup functions also call kfree()
explicitly after put_device(), producing a double free whenever
put_device() drops the reference count to zero and fires the release.
In the setup functions, device_initialize() is called before
device_add(), so the reference count is exactly 1 at the error sites.
put_device() unconditionally fires the release, which frees the struct;
the subsequent explicit kfree() then operates on freed memory.
For idxd_setup_wqs(), the wq release callback also owns opcap_bmap
and wqcfg. The error unwind additionally freed those fields explicitly
before calling put_device(), causing further double frees on both.
Remove the redundant explicit kfree() calls from all setup error paths
and cleanup functions for wq, engine, and group structs, delegating
sole ownership of those allocations to the release callbacks.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 , < c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c
(git)
Affected: 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 , < ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c (git) Affected: 394e179f51fce06d6bb8ca5af8fa53f33c718cf4 (git) Affected: b09ad63775f58a8de3e228f59fb9543bfd964c9c (git) Affected: 26c219e7522c494f7865a928c81ced84cc7db3ae (git) Affected: 35ea8721d9e6e74c6847cf4d6c27e883b00b0331 (git) Affected: e6f86fe368cdc14764833a6e8bb59f7a85a40e06 (git) Affected: 1c28fd5f94d8996f7dd3805bd6a16ed46a5d0886 (git) Affected: 5.11.22 , < 5.12 (semver) Affected: 5.12.5 , < 5.13 (semver) |
|
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c",
"status": "affected",
"version": "7c5dd23e57c14cf7177b8a5e0fd08916e0c60005",
"versionType": "git"
},
{
"lessThan": "ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c",
"status": "affected",
"version": "7c5dd23e57c14cf7177b8a5e0fd08916e0c60005",
"versionType": "git"
},
{
"status": "affected",
"version": "394e179f51fce06d6bb8ca5af8fa53f33c718cf4",
"versionType": "git"
},
{
"status": "affected",
"version": "b09ad63775f58a8de3e228f59fb9543bfd964c9c",
"versionType": "git"
},
{
"status": "affected",
"version": "26c219e7522c494f7865a928c81ced84cc7db3ae",
"versionType": "git"
},
{
"status": "affected",
"version": "35ea8721d9e6e74c6847cf4d6c27e883b00b0331",
"versionType": "git"
},
{
"status": "affected",
"version": "e6f86fe368cdc14764833a6e8bb59f7a85a40e06",
"versionType": "git"
},
{
"status": "affected",
"version": "1c28fd5f94d8996f7dd3805bd6a16ed46a5d0886",
"versionType": "git"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.22",
"versionType": "semver"
},
{
"lessThan": "5.13",
"status": "affected",
"version": "5.12.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix double free of wq, engine, and group structs\n\nThe release callbacks for wq, engine, and group devices\n(idxd_conf_wq_release, idxd_conf_engine_release,\nidxd_conf_group_release) each call kfree() on the enclosing struct.\nThe setup error paths and cleanup functions also call kfree()\nexplicitly after put_device(), producing a double free whenever\nput_device() drops the reference count to zero and fires the release.\n\nIn the setup functions, device_initialize() is called before\ndevice_add(), so the reference count is exactly 1 at the error sites.\nput_device() unconditionally fires the release, which frees the struct;\nthe subsequent explicit kfree() then operates on freed memory.\n\nFor idxd_setup_wqs(), the wq release callback also owns opcap_bmap\nand wqcfg. The error unwind additionally freed those fields explicitly\nbefore calling put_device(), causing further double frees on both.\n\nRemove the redundant explicit kfree() calls from all setup error paths\nand cleanup functions for wq, engine, and group structs, delegating\nsole ownership of those allocations to the release callbacks."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:02.829Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c"
},
{
"url": "https://git.kernel.org/stable/c/ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c"
}
],
"title": "dmaengine: idxd: fix double free of wq, engine, and group structs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80698",
"datePublished": "2026-08-28T06:53:02.829Z",
"dateReserved": "2026-08-26T14:34:25.786Z",
"dateUpdated": "2026-08-28T06:53:02.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80697 (GCVE-0-2026-80697)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 12:08
VLAI
EPSS
VEX
Title
erofs: ensure valid f_path for page cache sharing
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: ensure valid f_path for page cache sharing
Previously, backing files for page cache sharing were set up with
f_path left as NULL (only f_inode was valid). It worked, but a recent
mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on
7.2-rc4):
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP PTI
CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)
Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
RIP: 0010:__do_sys_mincore+0xc0/0x2c0
...
Specify valid paths using valid disconnected dentries together with
erofs_ishare_mnt instead of leaving f_path empty, so they are more
like real backing files in a pseudo filesystem and standard
backing_file_open() can be used directly.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5ef3208e3be50aa08b4e7a2832f34e16d42c08b3 , < 3879657c4ffd81b9a42cf575fc6cb60201032587
(git)
Affected: 5ef3208e3be50aa08b4e7a2832f34e16d42c08b3 , < 96b2dbbe58a1ea5df8d29c2fe24b5f04715f4443 (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/Kconfig",
"fs/erofs/internal.h",
"fs/erofs/ishare.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3879657c4ffd81b9a42cf575fc6cb60201032587",
"status": "affected",
"version": "5ef3208e3be50aa08b4e7a2832f34e16d42c08b3",
"versionType": "git"
},
{
"lessThan": "96b2dbbe58a1ea5df8d29c2fe24b5f04715f4443",
"status": "affected",
"version": "5ef3208e3be50aa08b4e7a2832f34e16d42c08b3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/Kconfig",
"fs/erofs/internal.h",
"fs/erofs/ishare.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: ensure valid f_path for page cache sharing\n\nPreviously, backing files for page cache sharing were set up with\nf_path left as NULL (only f_inode was valid). It worked, but a recent\nmincore fix relies on f_path.mnt and crashes (found by \"erofs/028\" on\n7.2-rc4):\n\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP PTI\n CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)\n Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014\n RIP: 0010:__do_sys_mincore+0xc0/0x2c0\n ...\n\nSpecify valid paths using valid disconnected dentries together with\nerofs_ishare_mnt instead of leaving f_path empty, so they are more\nlike real backing files in a pseudo filesystem and standard\nbacking_file_open() can be used directly."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T12:08:17.218Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3879657c4ffd81b9a42cf575fc6cb60201032587"
},
{
"url": "https://git.kernel.org/stable/c/96b2dbbe58a1ea5df8d29c2fe24b5f04715f4443"
}
],
"title": "erofs: ensure valid f_path for page cache sharing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80697",
"datePublished": "2026-08-28T06:53:02.236Z",
"dateReserved": "2026-08-26T14:34:25.786Z",
"dateUpdated": "2026-08-28T12:08:17.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80696 (GCVE-0-2026-80696)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
hwmon: (ltc4282) Fix reading the minimum alarm voltage
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (ltc4282) Fix reading the minimum alarm voltage
Coverity reports an out-of-bounds access when reading the minimum alarm
voltage for the VGPIO channel. Add the missing return statement to fix
the problem.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cbc29538dbf7d7400f1ffc5dd5713e6a551463a0 , < 338d655fe09b95a88788c6ac8b1651ca8db9ae51
(git)
Affected: cbc29538dbf7d7400f1ffc5dd5713e6a551463a0 , < 08aee6d45eefc9e0b94c21bd442f47b21d64fa2c (git) Affected: cbc29538dbf7d7400f1ffc5dd5713e6a551463a0 , < a0668ac20feaa3fff9e0c0548556368dbbd2d439 (git) Affected: cbc29538dbf7d7400f1ffc5dd5713e6a551463a0 , < 00feb1cce93dab948a299b69753d99c681d45a0b (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/ltc4282.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "338d655fe09b95a88788c6ac8b1651ca8db9ae51",
"status": "affected",
"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
"versionType": "git"
},
{
"lessThan": "08aee6d45eefc9e0b94c21bd442f47b21d64fa2c",
"status": "affected",
"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
"versionType": "git"
},
{
"lessThan": "a0668ac20feaa3fff9e0c0548556368dbbd2d439",
"status": "affected",
"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
"versionType": "git"
},
{
"lessThan": "00feb1cce93dab948a299b69753d99c681d45a0b",
"status": "affected",
"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/ltc4282.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ltc4282) Fix reading the minimum alarm voltage\n\nCoverity reports an out-of-bounds access when reading the minimum alarm\nvoltage for the VGPIO channel. Add the missing return statement to fix\nthe problem."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:01.632Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/338d655fe09b95a88788c6ac8b1651ca8db9ae51"
},
{
"url": "https://git.kernel.org/stable/c/08aee6d45eefc9e0b94c21bd442f47b21d64fa2c"
},
{
"url": "https://git.kernel.org/stable/c/a0668ac20feaa3fff9e0c0548556368dbbd2d439"
},
{
"url": "https://git.kernel.org/stable/c/00feb1cce93dab948a299b69753d99c681d45a0b"
}
],
"title": "hwmon: (ltc4282) Fix reading the minimum alarm voltage",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80696",
"datePublished": "2026-08-28T06:53:01.632Z",
"dateReserved": "2026-08-26T14:34:25.785Z",
"dateUpdated": "2026-08-28T06:53:01.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80695 (GCVE-0-2026-80695)
Vulnerability from nvd – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
hwmon: (sht3x) Fix unaligned accesses
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (sht3x) Fix unaligned accesses
Sashiko reports:
In sht3x_update_client(), the 16-bit temperature and humidity values are
extracted from a stack-allocated byte array using be16_to_cpup(). The
pointers passed to this function are calculated as buf and buf + 3. Since
the difference between the two pointers is an odd number of bytes, at
least one of them is guaranteed to be at an unaligned offset.
This will trigger an alignment fault on strict-alignment architectures
such as ARMv5 or SPARC, resulting in a kernel panic.
Fix the problem by using get_unaligned_be16() instead of be16_to_cpup(),
and put_unaligned_be16() instead of cpu_to_be16().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7c84f7f80d6fcea36246b793d06c3555ca53ddcd , < 81529add4a2e3cca9240e0e2342973d62f88f02e
(git)
Affected: 7c84f7f80d6fcea36246b793d06c3555ca53ddcd , < c498adfd4c3e85306ccdc19b76e639bfc215f0e7 (git) Affected: 7c84f7f80d6fcea36246b793d06c3555ca53ddcd , < 1fb41650bc3e14d2a5ddb4bb25e96811e5afe881 (git) Affected: 7c84f7f80d6fcea36246b793d06c3555ca53ddcd , < f46d5ab43a572b84773015a76966f5da56fc1748 (git) |
|
| Linux | Linux |
Affected:
4.8
Unaffected: 0 , < 4.8 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/sht3x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81529add4a2e3cca9240e0e2342973d62f88f02e",
"status": "affected",
"version": "7c84f7f80d6fcea36246b793d06c3555ca53ddcd",
"versionType": "git"
},
{
"lessThan": "c498adfd4c3e85306ccdc19b76e639bfc215f0e7",
"status": "affected",
"version": "7c84f7f80d6fcea36246b793d06c3555ca53ddcd",
"versionType": "git"
},
{
"lessThan": "1fb41650bc3e14d2a5ddb4bb25e96811e5afe881",
"status": "affected",
"version": "7c84f7f80d6fcea36246b793d06c3555ca53ddcd",
"versionType": "git"
},
{
"lessThan": "f46d5ab43a572b84773015a76966f5da56fc1748",
"status": "affected",
"version": "7c84f7f80d6fcea36246b793d06c3555ca53ddcd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/sht3x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (sht3x) Fix unaligned accesses\n\nSashiko reports:\n\nIn sht3x_update_client(), the 16-bit temperature and humidity values are\nextracted from a stack-allocated byte array using be16_to_cpup(). The\npointers passed to this function are calculated as buf and buf + 3. Since\nthe difference between the two pointers is an odd number of bytes, at\nleast one of them is guaranteed to be at an unaligned offset.\n\nThis will trigger an alignment fault on strict-alignment architectures\nsuch as ARMv5 or SPARC, resulting in a kernel panic.\n\nFix the problem by using get_unaligned_be16() instead of be16_to_cpup(),\nand put_unaligned_be16() instead of cpu_to_be16()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:01.037Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81529add4a2e3cca9240e0e2342973d62f88f02e"
},
{
"url": "https://git.kernel.org/stable/c/c498adfd4c3e85306ccdc19b76e639bfc215f0e7"
},
{
"url": "https://git.kernel.org/stable/c/1fb41650bc3e14d2a5ddb4bb25e96811e5afe881"
},
{
"url": "https://git.kernel.org/stable/c/f46d5ab43a572b84773015a76966f5da56fc1748"
}
],
"title": "hwmon: (sht3x) Fix unaligned accesses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80695",
"datePublished": "2026-08-28T06:53:01.037Z",
"dateReserved": "2026-08-26T14:34:25.785Z",
"dateUpdated": "2026-08-28T06:53:01.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}