Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
31108 vulnerabilities found for Linux by Linux
CVE-2026-80925 (GCVE-0-2026-80925)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
VLAI
EPSS
VEX
Title
vlan: fix skb_under_panic and races when toggling HW VLAN offload
Summary
In the Linux kernel, the following vulnerability has been resolved:
vlan: fix skb_under_panic and races when toggling HW VLAN offload
Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),
which dynamically changed vlandev->hard_header_len.
This causes two issues:
1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)
read dev->hard_header_len without holding RTNL lock. Mutating
hard_header_len dynamically under RTNL creates a data race where upper
layers reserve insufficient headroom based on a stale hard_header_len,
resulting in skb_under_panic when vlan_dev_hard_header() is called.
2. In addition, vlan_transfer_features() updated hard_header_len without
updating header_ops, causing a mismatch between allocated headroom
and header creation.
Always setting dev->hard_header_len = real_dev->hard_header_len and
dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally
ensures:
- dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len,
eliminating all dynamic runtime updates and data races on hard_header_len.
- Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve
sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len +
real_dev->needed_headroom + VLAN_HLEN).
- vlandev inherits real_dev->needed_tailroom so underlying trailer/padding/ICV
requirements are honored.
- AF_PACKET SOCK_RAW network header offsets remain correctly aligned at
real_dev->hard_header_len.
- vlan_header_ops is used unconditionally.
Note to stable teams: Make sure to backport these commits:
e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev")
cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a29f3b884ba50217e6f50414f568073221e2bb07
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 447cbe95ebb95392b5d8f6a01c0556826919ce23 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 7.2.3 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/8021q/vlan_dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a29f3b884ba50217e6f50414f568073221e2bb07",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "447cbe95ebb95392b5d8f6a01c0556826919ce23",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/8021q/vlan_dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: fix skb_under_panic and races when toggling HW VLAN offload\n\nToggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or\nNETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),\nwhich dynamically changed vlandev-\u003ehard_header_len.\n\nThis causes two issues:\n1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)\n read dev-\u003ehard_header_len without holding RTNL lock. Mutating\n hard_header_len dynamically under RTNL creates a data race where upper\n layers reserve insufficient headroom based on a stale hard_header_len,\n resulting in skb_under_panic when vlan_dev_hard_header() is called.\n2. In addition, vlan_transfer_features() updated hard_header_len without\n updating header_ops, causing a mismatch between allocated headroom\n and header creation.\n\nAlways setting dev-\u003ehard_header_len = real_dev-\u003ehard_header_len and\ndev-\u003eneeded_headroom = real_dev-\u003eneeded_headroom + VLAN_HLEN unconditionally\nensures:\n- dev-\u003ehard_header_len remains 100% static and immutable at real_dev-\u003ehard_header_len,\n eliminating all dynamic runtime updates and data races on hard_header_len.\n- Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve\n sufficient headroom for software VLAN tag insertion (real_dev-\u003ehard_header_len +\n real_dev-\u003eneeded_headroom + VLAN_HLEN).\n- vlandev inherits real_dev-\u003eneeded_tailroom so underlying trailer/padding/ICV\n requirements are honored.\n- AF_PACKET SOCK_RAW network header offsets remain correctly aligned at\n real_dev-\u003ehard_header_len.\n- vlan_header_ops is used unconditionally.\n\nNote to stable teams: Make sure to backport these commits:\n\ne16e960d55a4 (\"ipvlan: inherit needed_headroom and needed_tailroom from phy_dev\")\ncef51860becd (\"macvlan: inherit needed_headroom and needed_tailroom from lowerdev\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:19:44.748Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a29f3b884ba50217e6f50414f568073221e2bb07"
},
{
"url": "https://git.kernel.org/stable/c/447cbe95ebb95392b5d8f6a01c0556826919ce23"
}
],
"title": "vlan: fix skb_under_panic and races when toggling HW VLAN offload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80925",
"datePublished": "2026-09-09T16:19:44.748Z",
"dateReserved": "2026-08-26T14:34:25.802Z",
"dateUpdated": "2026-09-09T16:19:44.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80924 (GCVE-0-2026-80924)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
VLAI
EPSS
VEX
Title
crypto: krb5 - use kfree_sensitive() for derived key buffers
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: krb5 - use kfree_sensitive() for derived key buffers
crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum()
free the buffer holding the freshly derived keys with plain kfree(),
leaving the key material behind in the freed slab object.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3936f02bf2d3308a7359dd37dd96cd60603d8170 , < 731a5b6fb4c1705f9405d9029dd64ea81e336207
(git)
Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < 91b96dc9cc250cd16751f53de525cf3442ca0962 (git) Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < a1bf79365794783b19f5b09e8a23f7ee311e8931 (git) Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < f7d53dd3f267e46a784f219a75072f2f400d42b9 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2.3 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/krb5/krb5_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "731a5b6fb4c1705f9405d9029dd64ea81e336207",
"status": "affected",
"version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
"versionType": "git"
},
{
"lessThan": "91b96dc9cc250cd16751f53de525cf3442ca0962",
"status": "affected",
"version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
"versionType": "git"
},
{
"lessThan": "a1bf79365794783b19f5b09e8a23f7ee311e8931",
"status": "affected",
"version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
"versionType": "git"
},
{
"lessThan": "f7d53dd3f267e46a784f219a75072f2f400d42b9",
"status": "affected",
"version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/krb5/krb5_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.3",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: krb5 - use kfree_sensitive() for derived key buffers\n\ncrypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum()\nfree the buffer holding the freshly derived keys with plain kfree(),\nleaving the key material behind in the freed slab object."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:19:44.150Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/731a5b6fb4c1705f9405d9029dd64ea81e336207"
},
{
"url": "https://git.kernel.org/stable/c/91b96dc9cc250cd16751f53de525cf3442ca0962"
},
{
"url": "https://git.kernel.org/stable/c/a1bf79365794783b19f5b09e8a23f7ee311e8931"
},
{
"url": "https://git.kernel.org/stable/c/f7d53dd3f267e46a784f219a75072f2f400d42b9"
}
],
"title": "crypto: krb5 - use kfree_sensitive() for derived key buffers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80924",
"datePublished": "2026-09-09T16:19:44.150Z",
"dateReserved": "2026-08-26T14:34:25.802Z",
"dateUpdated": "2026-09-09T16:19:44.150Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80923 (GCVE-0-2026-80923)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
VLAI
EPSS
VEX
Title
xhci: dbgtty: Fix unregister on tty_register_driver() failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
xhci: dbgtty: Fix unregister on tty_register_driver() failure
If tty_register_driver() fails, it drops the reference, but fails to set
the global dbc_tty_driver to NULL, causing the unregister to be called
again when module exits.
On module unload dbc_tty_exit() only gates its cleanup on the driver
pointer being non-NULL, so it operates on the already-freed driver:
module_init(xhci_hcd_init)
xhci_hcd_init()
xhci_dbc_init() [return value ignored]
dbc_tty_init()
tty_register_driver() fails
tty_driver_kref_put() -> driver freed
(dbc_tty_driver left dangling)
...
module_exit(xhci_hcd_fini)
xhci_hcd_fini()
xhci_dbc_exit()
dbc_tty_exit()
if (dbc_tty_driver) -> true (dangling)
tty_unregister_driver() -> use-after-free
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4521f16139409cdf9462c7325d43454462cff6c3 , < 01b7bc0938061f2fd46e0094f6483d8c6c02f7d3
(git)
Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 43635ff6401ca0e0ed21875379eeded921321525 (git) Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < eaca2814f32b9872a332326324b9e83e01f156d2 (git) Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 943f976c93e70563b132f5585ff68b08c89641a2 (git) Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922 (git) Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 33ed35ca629477f57e0dd1d77d6df96cf5a9eb55 (git) Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 0e469b94fbba8eb03666da41dd1082b793c50c1a (git) Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < a916fa66a43e10f63198b6ce978badffc678821a (git) |
|
| Linux | Linux |
Affected:
5.9
Unaffected: 0 , < 5.9 (semver) Unaffected: 5.15.220 , ≤ 5.15.* (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.156 , ≤ 6.6.* (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2.3 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci-dbgtty.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "01b7bc0938061f2fd46e0094f6483d8c6c02f7d3",
"status": "affected",
"version": "4521f16139409cdf9462c7325d43454462cff6c3",
"versionType": "git"
},
{
"lessThan": "43635ff6401ca0e0ed21875379eeded921321525",
"status": "affected",
"version": "4521f16139409cdf9462c7325d43454462cff6c3",
"versionType": "git"
},
{
"lessThan": "eaca2814f32b9872a332326324b9e83e01f156d2",
"status": "affected",
"version": "4521f16139409cdf9462c7325d43454462cff6c3",
"versionType": "git"
},
{
"lessThan": "943f976c93e70563b132f5585ff68b08c89641a2",
"status": "affected",
"version": "4521f16139409cdf9462c7325d43454462cff6c3",
"versionType": "git"
},
{
"lessThan": "0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922",
"status": "affected",
"version": "4521f16139409cdf9462c7325d43454462cff6c3",
"versionType": "git"
},
{
"lessThan": "33ed35ca629477f57e0dd1d77d6df96cf5a9eb55",
"status": "affected",
"version": "4521f16139409cdf9462c7325d43454462cff6c3",
"versionType": "git"
},
{
"lessThan": "0e469b94fbba8eb03666da41dd1082b793c50c1a",
"status": "affected",
"version": "4521f16139409cdf9462c7325d43454462cff6c3",
"versionType": "git"
},
{
"lessThan": "a916fa66a43e10f63198b6ce978badffc678821a",
"status": "affected",
"version": "4521f16139409cdf9462c7325d43454462cff6c3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci-dbgtty.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.220",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.156",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.3",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: dbgtty: Fix unregister on tty_register_driver() failure\n\nIf tty_register_driver() fails, it drops the reference, but fails to set\nthe global dbc_tty_driver to NULL, causing the unregister to be called\nagain when module exits.\n\nOn module unload dbc_tty_exit() only gates its cleanup on the driver\npointer being non-NULL, so it operates on the already-freed driver:\n\n module_init(xhci_hcd_init)\n xhci_hcd_init()\n xhci_dbc_init() [return value ignored]\n dbc_tty_init()\n tty_register_driver() fails\n tty_driver_kref_put() -\u003e driver freed\n (dbc_tty_driver left dangling)\n ...\n module_exit(xhci_hcd_fini)\n xhci_hcd_fini()\n xhci_dbc_exit()\n dbc_tty_exit()\n if (dbc_tty_driver) -\u003e true (dangling)\n tty_unregister_driver() -\u003e use-after-free"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:19:43.538Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/01b7bc0938061f2fd46e0094f6483d8c6c02f7d3"
},
{
"url": "https://git.kernel.org/stable/c/43635ff6401ca0e0ed21875379eeded921321525"
},
{
"url": "https://git.kernel.org/stable/c/eaca2814f32b9872a332326324b9e83e01f156d2"
},
{
"url": "https://git.kernel.org/stable/c/943f976c93e70563b132f5585ff68b08c89641a2"
},
{
"url": "https://git.kernel.org/stable/c/0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922"
},
{
"url": "https://git.kernel.org/stable/c/33ed35ca629477f57e0dd1d77d6df96cf5a9eb55"
},
{
"url": "https://git.kernel.org/stable/c/0e469b94fbba8eb03666da41dd1082b793c50c1a"
},
{
"url": "https://git.kernel.org/stable/c/a916fa66a43e10f63198b6ce978badffc678821a"
}
],
"title": "xhci: dbgtty: Fix unregister on tty_register_driver() failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80923",
"datePublished": "2026-09-09T16:19:43.538Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:19:43.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80922 (GCVE-0-2026-80922)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
VLAI
EPSS
VEX
Title
crypto: qcom-rng - Allow zero as a random number
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: qcom-rng - Allow zero as a random number
Zero is a valid random number and needs to be allowed. Otherwise the
output is distinguishable from random.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f29cd5bb64c258f29b4c49452532481f50eb43ca , < 813e6718a199befc4f26f54bdd899fbfa11515e5
(git)
Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 4c0018320942003bfedd0a1c4cce3f036d363a7f (git) Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 143c74034a1c47b0a1a64e7ca7153e7739bd1244 (git) Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 3c7101cfc52e378bcb0a46962145e39c9051dd5d (git) Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 4ef04bdc0c9f98836d1638be516f6bf1bad55f69 (git) |
|
| Linux | Linux |
Affected:
6.7
Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2.3 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/qcom-rng.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "813e6718a199befc4f26f54bdd899fbfa11515e5",
"status": "affected",
"version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
"versionType": "git"
},
{
"lessThan": "4c0018320942003bfedd0a1c4cce3f036d363a7f",
"status": "affected",
"version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
"versionType": "git"
},
{
"lessThan": "143c74034a1c47b0a1a64e7ca7153e7739bd1244",
"status": "affected",
"version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
"versionType": "git"
},
{
"lessThan": "3c7101cfc52e378bcb0a46962145e39c9051dd5d",
"status": "affected",
"version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
"versionType": "git"
},
{
"lessThan": "4ef04bdc0c9f98836d1638be516f6bf1bad55f69",
"status": "affected",
"version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/qcom-rng.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.3",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qcom-rng - Allow zero as a random number\n\nZero is a valid random number and needs to be allowed. Otherwise the\noutput is distinguishable from random."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:19:42.937Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/813e6718a199befc4f26f54bdd899fbfa11515e5"
},
{
"url": "https://git.kernel.org/stable/c/4c0018320942003bfedd0a1c4cce3f036d363a7f"
},
{
"url": "https://git.kernel.org/stable/c/143c74034a1c47b0a1a64e7ca7153e7739bd1244"
},
{
"url": "https://git.kernel.org/stable/c/3c7101cfc52e378bcb0a46962145e39c9051dd5d"
},
{
"url": "https://git.kernel.org/stable/c/4ef04bdc0c9f98836d1638be516f6bf1bad55f69"
}
],
"title": "crypto: qcom-rng - Allow zero as a random number",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80922",
"datePublished": "2026-09-09T16:19:42.937Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:19:42.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80921 (GCVE-0-2026-80921)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
VLAI
EPSS
VEX
Title
KVM: s390: vsie: zero stale crypto bits
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: vsie: zero stale crypto bits
When shadowing crypto access bits from a format0 apcb (crycb 0 or 1),
the bits 64..255 are unchanged from whatever is in the vsie page in the
crycb and thus in the apcb. This gives a nested guest potential access
to a device no longer available. Zero out the remaining bits.
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < d110b3297f11ef227098b8a82ade2d5f123b7d2f
(git)
Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 59d51550b5cb916bda037673a721a404b3b47a0d (git) Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < f6079dca67eccb5eabef9f72437948c66dc5131f (git) Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 087c19cc60a8caa1a08e1e434c8be2caf6c27733 (git) Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 7d23489f51109e3ebba5b5db8c5f0185af7b7fdf (git) Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 935eeba276012916c76243e5cbb843efd8fdb75d (git) Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < d4bcd2df6d0d2af916b4fe1a533958778ea7c45b (git) Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6 (git) Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 34d5b5b646c91cfb9338d7a12c955a70ffb8c66b (git) |
|
| Linux | Linux |
Affected:
4.20
Unaffected: 0 , < 4.20 (semver) Unaffected: 5.10.269 , ≤ 5.10.* (semver) Unaffected: 5.15.220 , ≤ 5.15.* (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.156 , ≤ 6.6.* (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2.3 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/vsie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d110b3297f11ef227098b8a82ade2d5f123b7d2f",
"status": "affected",
"version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
"versionType": "git"
},
{
"lessThan": "59d51550b5cb916bda037673a721a404b3b47a0d",
"status": "affected",
"version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
"versionType": "git"
},
{
"lessThan": "f6079dca67eccb5eabef9f72437948c66dc5131f",
"status": "affected",
"version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
"versionType": "git"
},
{
"lessThan": "087c19cc60a8caa1a08e1e434c8be2caf6c27733",
"status": "affected",
"version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
"versionType": "git"
},
{
"lessThan": "7d23489f51109e3ebba5b5db8c5f0185af7b7fdf",
"status": "affected",
"version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
"versionType": "git"
},
{
"lessThan": "935eeba276012916c76243e5cbb843efd8fdb75d",
"status": "affected",
"version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
"versionType": "git"
},
{
"lessThan": "d4bcd2df6d0d2af916b4fe1a533958778ea7c45b",
"status": "affected",
"version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
"versionType": "git"
},
{
"lessThan": "29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6",
"status": "affected",
"version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
"versionType": "git"
},
{
"lessThan": "34d5b5b646c91cfb9338d7a12c955a70ffb8c66b",
"status": "affected",
"version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/vsie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.269",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.269",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.220",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.156",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.3",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: vsie: zero stale crypto bits\n\nWhen shadowing crypto access bits from a format0 apcb (crycb 0 or 1),\nthe bits 64..255 are unchanged from whatever is in the vsie page in the\ncrycb and thus in the apcb. This gives a nested guest potential access\nto a device no longer available. Zero out the remaining bits."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:19:42.335Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d110b3297f11ef227098b8a82ade2d5f123b7d2f"
},
{
"url": "https://git.kernel.org/stable/c/59d51550b5cb916bda037673a721a404b3b47a0d"
},
{
"url": "https://git.kernel.org/stable/c/f6079dca67eccb5eabef9f72437948c66dc5131f"
},
{
"url": "https://git.kernel.org/stable/c/087c19cc60a8caa1a08e1e434c8be2caf6c27733"
},
{
"url": "https://git.kernel.org/stable/c/7d23489f51109e3ebba5b5db8c5f0185af7b7fdf"
},
{
"url": "https://git.kernel.org/stable/c/935eeba276012916c76243e5cbb843efd8fdb75d"
},
{
"url": "https://git.kernel.org/stable/c/d4bcd2df6d0d2af916b4fe1a533958778ea7c45b"
},
{
"url": "https://git.kernel.org/stable/c/29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6"
},
{
"url": "https://git.kernel.org/stable/c/34d5b5b646c91cfb9338d7a12c955a70ffb8c66b"
}
],
"title": "KVM: s390: vsie: zero stale crypto bits",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80921",
"datePublished": "2026-09-09T16:19:42.335Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:19:42.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80920 (GCVE-0-2026-80920)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
VLAI
EPSS
VEX
Title
io_uring: defer eventfd signaling when queued from a wakeup handler
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring: defer eventfd signaling when queued from a wakeup handler
io_req_local_work_add() signals the CQ ring eventfd inline when it is the
one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that
add is frequently done from a waitqueue wakeup handler, where an
arbitrary waitqueue lock is held.
eventfd_signal_mask() only refuses to recurse when current->in_eventfd
is set, but that bit is set by eventfd_signal_mask() itself. If the wake
chain starts somewhere else, signal goes out inline and can feed back
into epoll.
Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three
waitqueue callbacks, and use it to force io_eventfd_signal() down the
existing call_rcu_hurry() deferral instead of signaling inline.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
21a091b970cdbcf3e8ff829234b51be6f9192766 , < e22f4494cc9487d326e5e3067f33dea7c1e442b2
(git)
Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f (git) Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < 40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a (git) Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e (git) |
|
| Linux | Linux |
Affected:
6.1
Unaffected: 0 , < 6.1 (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.11 , ≤ 7.1.* (semver) Unaffected: 7.2.1 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/io_uring_types.h",
"io_uring/eventfd.c",
"io_uring/eventfd.h",
"io_uring/futex.c",
"io_uring/io_uring.c",
"io_uring/poll.c",
"io_uring/tw.c",
"io_uring/waitid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e22f4494cc9487d326e5e3067f33dea7c1e442b2",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/io_uring_types.h",
"io_uring/eventfd.c",
"io_uring/eventfd.h",
"io_uring/futex.c",
"io_uring/io_uring.c",
"io_uring/poll.c",
"io_uring/tw.c",
"io_uring/waitid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: defer eventfd signaling when queued from a wakeup handler\n\nio_req_local_work_add() signals the CQ ring eventfd inline when it is the\none to push the first entry onto -\u003ework_list. For DEFER_TASKRUN rings that\nadd is frequently done from a waitqueue wakeup handler, where an\narbitrary waitqueue lock is held.\n\neventfd_signal_mask() only refuses to recurse when current-\u003ein_eventfd\nis set, but that bit is set by eventfd_signal_mask() itself. If the wake\nchain starts somewhere else, signal goes out inline and can feed back\ninto epoll.\n\nAdd IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three\nwaitqueue callbacks, and use it to force io_eventfd_signal() down the\nexisting call_rcu_hurry() deferral instead of signaling inline."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:13:17.023Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e22f4494cc9487d326e5e3067f33dea7c1e442b2"
},
{
"url": "https://git.kernel.org/stable/c/b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f"
},
{
"url": "https://git.kernel.org/stable/c/40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a"
},
{
"url": "https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e"
}
],
"title": "io_uring: defer eventfd signaling when queued from a wakeup handler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80920",
"datePublished": "2026-09-09T16:13:17.023Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:13:17.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80919 (GCVE-0-2026-80919)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
VLAI
EPSS
VEX
Title
drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
When dumping IB contents from a hung job, amdgpu_devcoredump_format()
acquired the VM root PD's reservation via amdgpu_vm_lock_by_pasid() and
then, for each IB, called amdgpu_bo_reserve() on the BO backing the IB.
Both reservations are reservation_ww_class_mutex objects and neither
used a ww_acquire_ctx, which trips lockdep:
WARNING: possible recursive locking detected
--------------------------------------------
kworker/u128:0 is trying to acquire lock:
ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4},
at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]
but task is already holding lock:
ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4},
at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]
Possible unsafe locking scenario:
CPU0
----
lock(reservation_ww_class_mutex);
lock(reservation_ww_class_mutex);
*** DEADLOCK ***
May be due to missing lock nesting notation
Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu]
Call Trace:
__ww_mutex_lock.constprop.0
ww_mutex_lock
amdgpu_bo_reserve
amdgpu_devcoredump_format+0x1594 [amdgpu]
amdgpu_devcoredump_deferred_work+0xea [amdgpu]
The two reservations are on different BOs in the captured trace, so the
splat is a lockdep-correctness warning, not an observed deadlock. It
becomes a real self-deadlock whenever the IB BO shares its dma_resv with
the root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()):
amdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket
and blocks forever. With amdgpu.gpu_recovery=0 the timeout handler
refires every ~2 s and each invocation produces this splat, drowning the
kernel ring buffer.
Now that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB
dumping into a separate helper that locks the root PD and every IB BO
together in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles
IB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed
by the same BO). Every lock is now a top-level acquire under one
ww_acquire_ctx, so the recursive ww_mutex condition is gone, and the
per-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO
refcount leak on the amdgpu_bo_reserve() failure path -- is removed.
(cherry picked from commit d6bf4242731219ee08ce54c365631e395486651e)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7b15fc2d1f1a00fb99f0146e404ff2600999ec74 , < 4e9b4dee0777ec9c835a4746e2d30382dd9d1044
(git)
Affected: 7b15fc2d1f1a00fb99f0146e404ff2600999ec74 , < 7152b248dc3c8d5fa8629e99ed5655dd41b51562 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.11 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e9b4dee0777ec9c835a4746e2d30382dd9d1044",
"status": "affected",
"version": "7b15fc2d1f1a00fb99f0146e404ff2600999ec74",
"versionType": "git"
},
{
"lessThan": "7152b248dc3c8d5fa8629e99ed5655dd41b51562",
"status": "affected",
"version": "7b15fc2d1f1a00fb99f0146e404ff2600999ec74",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format\n\nWhen dumping IB contents from a hung job, amdgpu_devcoredump_format()\nacquired the VM root PD\u0027s reservation via amdgpu_vm_lock_by_pasid() and\nthen, for each IB, called amdgpu_bo_reserve() on the BO backing the IB.\nBoth reservations are reservation_ww_class_mutex objects and neither\nused a ww_acquire_ctx, which trips lockdep:\n\n WARNING: possible recursive locking detected\n --------------------------------------------\n kworker/u128:0 is trying to acquire lock:\n ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4},\n at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]\n\n but task is already holding lock:\n ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4},\n at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]\n\n Possible unsafe locking scenario:\n CPU0\n ----\n lock(reservation_ww_class_mutex);\n lock(reservation_ww_class_mutex);\n\n *** DEADLOCK ***\n May be due to missing lock nesting notation\n\n Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu]\n Call Trace:\n __ww_mutex_lock.constprop.0\n ww_mutex_lock\n amdgpu_bo_reserve\n amdgpu_devcoredump_format+0x1594 [amdgpu]\n amdgpu_devcoredump_deferred_work+0xea [amdgpu]\n\nThe two reservations are on different BOs in the captured trace, so the\nsplat is a lockdep-correctness warning, not an observed deadlock. It\nbecomes a real self-deadlock whenever the IB BO shares its dma_resv with\nthe root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()):\namdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket\nand blocks forever. With amdgpu.gpu_recovery=0 the timeout handler\nrefires every ~2 s and each invocation produces this splat, drowning the\nkernel ring buffer.\n\nNow that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB\ndumping into a separate helper that locks the root PD and every IB BO\ntogether in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles\nIB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed\nby the same BO). Every lock is now a top-level acquire under one\nww_acquire_ctx, so the recursive ww_mutex condition is gone, and the\nper-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO\nrefcount leak on the amdgpu_bo_reserve() failure path -- is removed.\n\n(cherry picked from commit d6bf4242731219ee08ce54c365631e395486651e)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:13:16.415Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e9b4dee0777ec9c835a4746e2d30382dd9d1044"
},
{
"url": "https://git.kernel.org/stable/c/7152b248dc3c8d5fa8629e99ed5655dd41b51562"
}
],
"title": "drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80919",
"datePublished": "2026-09-09T16:13:16.415Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:13:16.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80918 (GCVE-0-2026-80918)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
VLAI
EPSS
VEX
Title
HID: core: fix number/pointer type confusion on long items
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: core: fix number/pointer type confusion on long items
When fetch_item() is called by hid_scan_report() on an item with
HID_ITEM_TAG_LONG, it stores a pointer to the item data in
item->data.longdata instead of storing a value directly in
item->data.{u8/u16/u32}.
When item_udata() or item_sdata() encounters such an item, it incorrectly
assumes that the item is in short format, and therefore returns the lower
part of a kernel pointer reinterpreted as a number.
When a HID device is connected whose descriptor contains a
HID_GLOBAL_ITEM_TAG_REPORT_SIZE encoded in long format with size=4, this
causes the lower half of a kernel pointer to be printed into dmesg as a
number, like this:
hid (null): invalid report_size 107953555
To fix it, let item_udata() and item_sdata() verify that the item is in
short format.
Note that this bug only affects hid_scan_report(), while the main parsing
pass hid_parse_collections() will always bail out when encountering a long
item.
Sidenote: There are currently no users of data.longdata; maybe we should
just remove any parsing of long-format descriptors as a follow-up.
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3dc8fc083dbfeede7b63a0c07581192e97711365 , < bed7fe3a936b6bdd84671385951397ca673cf6e7
(git)
Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < aec2c2ec87d4ec1f098979f68cd81b29f031c8cb (git) Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < 634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996 (git) Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < abec577de5fc16cd5caae42f97cdcd0983c06d66 (git) Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e (git) Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < 1fa1591efd417e39e5e164bebea8ca7a3837c469 (git) Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < e60159f5ea60254a5c3de4ea4f2f939f0171031b (git) Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < e542edada3f79387c0ac2a528cebf01f4ef47df8 (git) Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < 28abce951343fcec26e397610868efa4e1395c3f (git) |
|
| Linux | Linux |
Affected:
3.12
Unaffected: 0 , < 3.12 (semver) Unaffected: 5.10.267 , ≤ 5.10.* (semver) Unaffected: 5.15.218 , ≤ 5.15.* (semver) Unaffected: 6.1.185 , ≤ 6.1.* (semver) Unaffected: 6.6.154 , ≤ 6.6.* (semver) Unaffected: 6.12.106 , ≤ 6.12.* (semver) Unaffected: 6.18.47 , ≤ 6.18.* (semver) Unaffected: 7.1.11 , ≤ 7.1.* (semver) Unaffected: 7.2.1 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bed7fe3a936b6bdd84671385951397ca673cf6e7",
"status": "affected",
"version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
"versionType": "git"
},
{
"lessThan": "aec2c2ec87d4ec1f098979f68cd81b29f031c8cb",
"status": "affected",
"version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
"versionType": "git"
},
{
"lessThan": "634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996",
"status": "affected",
"version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
"versionType": "git"
},
{
"lessThan": "abec577de5fc16cd5caae42f97cdcd0983c06d66",
"status": "affected",
"version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
"versionType": "git"
},
{
"lessThan": "dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e",
"status": "affected",
"version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
"versionType": "git"
},
{
"lessThan": "1fa1591efd417e39e5e164bebea8ca7a3837c469",
"status": "affected",
"version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
"versionType": "git"
},
{
"lessThan": "e60159f5ea60254a5c3de4ea4f2f939f0171031b",
"status": "affected",
"version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
"versionType": "git"
},
{
"lessThan": "e542edada3f79387c0ac2a528cebf01f4ef47df8",
"status": "affected",
"version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
"versionType": "git"
},
{
"lessThan": "28abce951343fcec26e397610868efa4e1395c3f",
"status": "affected",
"version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: fix number/pointer type confusion on long items\n\nWhen fetch_item() is called by hid_scan_report() on an item with\nHID_ITEM_TAG_LONG, it stores a pointer to the item data in\nitem-\u003edata.longdata instead of storing a value directly in\nitem-\u003edata.{u8/u16/u32}.\n\nWhen item_udata() or item_sdata() encounters such an item, it incorrectly\nassumes that the item is in short format, and therefore returns the lower\npart of a kernel pointer reinterpreted as a number.\n\nWhen a HID device is connected whose descriptor contains a\nHID_GLOBAL_ITEM_TAG_REPORT_SIZE encoded in long format with size=4, this\ncauses the lower half of a kernel pointer to be printed into dmesg as a\nnumber, like this:\n\n hid (null): invalid report_size 107953555\n\nTo fix it, let item_udata() and item_sdata() verify that the item is in\nshort format.\n\nNote that this bug only affects hid_scan_report(), while the main parsing\npass hid_parse_collections() will always bail out when encountering a long\nitem.\n\nSidenote: There are currently no users of data.longdata; maybe we should\njust remove any parsing of long-format descriptors as a follow-up."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:13:15.799Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bed7fe3a936b6bdd84671385951397ca673cf6e7"
},
{
"url": "https://git.kernel.org/stable/c/aec2c2ec87d4ec1f098979f68cd81b29f031c8cb"
},
{
"url": "https://git.kernel.org/stable/c/634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996"
},
{
"url": "https://git.kernel.org/stable/c/abec577de5fc16cd5caae42f97cdcd0983c06d66"
},
{
"url": "https://git.kernel.org/stable/c/dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e"
},
{
"url": "https://git.kernel.org/stable/c/1fa1591efd417e39e5e164bebea8ca7a3837c469"
},
{
"url": "https://git.kernel.org/stable/c/e60159f5ea60254a5c3de4ea4f2f939f0171031b"
},
{
"url": "https://git.kernel.org/stable/c/e542edada3f79387c0ac2a528cebf01f4ef47df8"
},
{
"url": "https://git.kernel.org/stable/c/28abce951343fcec26e397610868efa4e1395c3f"
}
],
"title": "HID: core: fix number/pointer type confusion on long items",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80918",
"datePublished": "2026-09-09T16:13:15.799Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:13:15.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80917 (GCVE-0-2026-80917)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
VLAI
EPSS
VEX
Title
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
On 32-bit systems the config space is too large to ioremap in one go, so
pci_ecam_create() maps each bus segment separately and relies on the
->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in
cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for
every config access.
The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus
and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c
do not. As a result, on a 32-bit host using "pci-host-cam-generic" the
per-bus mapping is never set up and the first config read dereferences a
NULL base, crashing during bus enumeration:
Unable to handle kernel NULL pointer dereference at virtual address 00000800
Oops [#1]
CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43
Hardware name: Digilent Nexys-Video-A7 RV32 (DT)
epc : pci_generic_config_read+0x40/0xb0
ra : pci_generic_config_read+0x2c/0xb0
[<c038db9c>] pci_generic_config_read+0x40/0xb0
[<c038da04>] pci_bus_read_config_dword+0x50/0xb0
[<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec
[<c039245c>] pci_scan_single_device+0xa4/0x11c
[<c0392570>] pci_scan_slot+0x9c/0x23c
[<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4
[<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8
[<c0393e54>] pci_host_probe+0x20/0xc8
[<c03bc6f4>] pci_host_common_probe+0x144/0x1e4
Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks.
Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c,
move the CAM ops definition there as pci_generic_cam_ops (mirroring
pci_generic_ecam_ops) and export it for pci-host-generic.c to reference.
[mani: removed timestamp from log]
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8fe55ef23387ce3c7488375b1fd539420d7654bb , < 5e52eb0290f66ba0732956dcb1e365b5ca3c5108
(git)
Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < baf9b0383ff770fdff123d3a832f3a99641d96dd (git) Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 8d08713ec83a18526d1ed1fd5f0d2b901d103a10 (git) Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 74456843f18ba7f3045974d7e8b88ab993152b8c (git) Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 0c55707bd5d0d7670704cfd0dda933809b052f67 (git) Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < a199293f3038db8d31d47aa60f1e18272cd82354 (git) Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 0916948026f623844acd08888f7cbedbf1c48d6b (git) Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 008cb88edb41f3c7c8e0ed763ff9f26719830984 (git) Affected: 0b5877a1aeacdbf32b3bea91326592004ec7806f (git) Affected: a037ebbe72a4f98495b193112e2b2000e5e09eb5 (git) Affected: 5.12.19 , < 5.13 (semver) Affected: 5.13.4 , < 5.14 (semver) |
|
| Linux | Linux |
Affected:
5.14
Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.218 , ≤ 5.15.* (semver) Unaffected: 6.1.185 , ≤ 6.1.* (semver) Unaffected: 6.6.154 , ≤ 6.6.* (semver) Unaffected: 6.12.106 , ≤ 6.12.* (semver) Unaffected: 6.18.47 , ≤ 6.18.* (semver) Unaffected: 7.1.11 , ≤ 7.1.* (semver) Unaffected: 7.2.1 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/pci-host-generic.c",
"drivers/pci/ecam.c",
"include/linux/pci-ecam.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5e52eb0290f66ba0732956dcb1e365b5ca3c5108",
"status": "affected",
"version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
"versionType": "git"
},
{
"lessThan": "baf9b0383ff770fdff123d3a832f3a99641d96dd",
"status": "affected",
"version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
"versionType": "git"
},
{
"lessThan": "8d08713ec83a18526d1ed1fd5f0d2b901d103a10",
"status": "affected",
"version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
"versionType": "git"
},
{
"lessThan": "74456843f18ba7f3045974d7e8b88ab993152b8c",
"status": "affected",
"version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
"versionType": "git"
},
{
"lessThan": "0c55707bd5d0d7670704cfd0dda933809b052f67",
"status": "affected",
"version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
"versionType": "git"
},
{
"lessThan": "a199293f3038db8d31d47aa60f1e18272cd82354",
"status": "affected",
"version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
"versionType": "git"
},
{
"lessThan": "0916948026f623844acd08888f7cbedbf1c48d6b",
"status": "affected",
"version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
"versionType": "git"
},
{
"lessThan": "008cb88edb41f3c7c8e0ed763ff9f26719830984",
"status": "affected",
"version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
"versionType": "git"
},
{
"status": "affected",
"version": "0b5877a1aeacdbf32b3bea91326592004ec7806f",
"versionType": "git"
},
{
"status": "affected",
"version": "a037ebbe72a4f98495b193112e2b2000e5e09eb5",
"versionType": "git"
},
{
"lessThan": "5.13",
"status": "affected",
"version": "5.12.19",
"versionType": "semver"
},
{
"lessThan": "5.14",
"status": "affected",
"version": "5.13.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/pci-host-generic.c",
"drivers/pci/ecam.c",
"include/linux/pci-ecam.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.13.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems\n\nOn 32-bit systems the config space is too large to ioremap in one go, so\npci_ecam_create() maps each bus segment separately and relies on the\n-\u003eadd_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in\ncfg-\u003ewinp[]. pci_ecam_map_bus() then uses that mapping as the base for\nevery config access.\n\nThe generic ECAM ops (pci_generic_ecam_ops) already provide the -\u003eadd_bus\nand -\u003eremove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c\ndo not. As a result, on a 32-bit host using \"pci-host-cam-generic\" the\nper-bus mapping is never set up and the first config read dereferences a\nNULL base, crashing during bus enumeration:\n\n Unable to handle kernel NULL pointer dereference at virtual address 00000800\n Oops [#1]\n CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43\n Hardware name: Digilent Nexys-Video-A7 RV32 (DT)\n epc : pci_generic_config_read+0x40/0xb0\n ra : pci_generic_config_read+0x2c/0xb0\n [\u003cc038db9c\u003e] pci_generic_config_read+0x40/0xb0\n [\u003cc038da04\u003e] pci_bus_read_config_dword+0x50/0xb0\n [\u003cc0391e94\u003e] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec\n [\u003cc039245c\u003e] pci_scan_single_device+0xa4/0x11c\n [\u003cc0392570\u003e] pci_scan_slot+0x9c/0x23c\n [\u003cc039388c\u003e] pci_scan_child_bus_extend+0x58/0x2f4\n [\u003cc0393db0\u003e] pci_scan_root_bus_bridge+0x64/0xe8\n [\u003cc0393e54\u003e] pci_host_probe+0x20/0xc8\n [\u003cc03bc6f4\u003e] pci_host_common_probe+0x144/0x1e4\n\nFix this by giving the CAM ops the same -\u003eadd_bus/-\u003eremove_bus callbacks.\nSince pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c,\nmove the CAM ops definition there as pci_generic_cam_ops (mirroring\npci_generic_ecam_ops) and export it for pci-host-generic.c to reference.\n\n[mani: removed timestamp from log]"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:13:15.202Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5e52eb0290f66ba0732956dcb1e365b5ca3c5108"
},
{
"url": "https://git.kernel.org/stable/c/baf9b0383ff770fdff123d3a832f3a99641d96dd"
},
{
"url": "https://git.kernel.org/stable/c/8d08713ec83a18526d1ed1fd5f0d2b901d103a10"
},
{
"url": "https://git.kernel.org/stable/c/74456843f18ba7f3045974d7e8b88ab993152b8c"
},
{
"url": "https://git.kernel.org/stable/c/0c55707bd5d0d7670704cfd0dda933809b052f67"
},
{
"url": "https://git.kernel.org/stable/c/a199293f3038db8d31d47aa60f1e18272cd82354"
},
{
"url": "https://git.kernel.org/stable/c/0916948026f623844acd08888f7cbedbf1c48d6b"
},
{
"url": "https://git.kernel.org/stable/c/008cb88edb41f3c7c8e0ed763ff9f26719830984"
}
],
"title": "PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80917",
"datePublished": "2026-09-09T16:13:15.202Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:13:15.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80916 (GCVE-0-2026-80916)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
VLAI
EPSS
VEX
Title
kcov: fix data corruption and race conditions on PREEMPT_RT
Summary
In the Linux kernel, the following vulnerability has been resolved:
kcov: fix data corruption and race conditions on PREEMPT_RT
syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the
temporary storage used for saving/restoring remote KCOV state is currently
allocated as the per-CPU area.
On PREEMPT_RT kernels, softirq handlers run as preemptible task threads
(e.g., ksoftirqd). If a softirq context preempts a task running a remote
KCOV session, it safely saves the task's state into the per-CPU area.
However, if that softirq thread is subsequently preempted by a higher-
priority softirq thread on the same CPU, the second softirq will overwrite
the same per-CPU area, permanently destroying the original task's KCOV
state.
Fix this data corruption by moving the temporary storage from the per-CPU
area to the per-thread area. Since each softirq thread now owns its own
task context, nested softirq preemption no longer causes data overwrites.
Note that while the temporary storage is now on a per-thread basis, the
per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that
kcov_remote_start() and kcov_remote_stop() operate atomically without
racing against asynchronous interrupts that manipulate the current task's
KCOV state.
It is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init()
has already called panic() before returning NULL, for there will be no
OOM-killable userspace processes when __init function of built-in module
runs. But this patch also fixes crashing the kernel when vmalloc_node()
in kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL
but kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in
(1) doing vmalloc() in kcov_remote_start() despite !in_task() context
(2) out-of-array-bounds access if (1) succeeded but
kcov->remote_size < CONFIG_KCOV_IRQ_AREA_SIZE
(3) always leak memory allocated by (1), eventually killing all
OOM-killable userspace processes
problems.
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < ef7048d8a614c5f5a9b20513a5428101a744514e
(git)
Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 8ed3ddf23d39bf5338406bd9f8863d44748cf6ce (git) Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 5dc59fc959b2b5742985d7ef24bccd1868217dc2 (git) Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < a2fb8222cde23b0001812ed3acb7c0ea36dd94e2 (git) Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 18799e858b407bf355383c9dd6c06477aa437134 (git) Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < e11f5b48c82703242a3be7a7ae4b4940b4cb4610 (git) Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 22670d1552fe155822b2abf91f920925f7d067b4 (git) Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761 (git) Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c (git) |
|
| Linux | Linux |
Affected:
5.8
Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.269 , ≤ 5.10.* (semver) Unaffected: 5.15.220 , ≤ 5.15.* (semver) Unaffected: 6.1.185 , ≤ 6.1.* (semver) Unaffected: 6.6.154 , ≤ 6.6.* (semver) Unaffected: 6.12.106 , ≤ 6.12.* (semver) Unaffected: 6.18.47 , ≤ 6.18.* (semver) Unaffected: 7.1.11 , ≤ 7.1.* (semver) Unaffected: 7.2.1 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/sched.h",
"kernel/kcov.c",
"lib/Kconfig.debug"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ef7048d8a614c5f5a9b20513a5428101a744514e",
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"versionType": "git"
},
{
"lessThan": "8ed3ddf23d39bf5338406bd9f8863d44748cf6ce",
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"versionType": "git"
},
{
"lessThan": "5dc59fc959b2b5742985d7ef24bccd1868217dc2",
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"versionType": "git"
},
{
"lessThan": "a2fb8222cde23b0001812ed3acb7c0ea36dd94e2",
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"versionType": "git"
},
{
"lessThan": "18799e858b407bf355383c9dd6c06477aa437134",
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"versionType": "git"
},
{
"lessThan": "e11f5b48c82703242a3be7a7ae4b4940b4cb4610",
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"versionType": "git"
},
{
"lessThan": "22670d1552fe155822b2abf91f920925f7d067b4",
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"versionType": "git"
},
{
"lessThan": "f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761",
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"versionType": "git"
},
{
"lessThan": "2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c",
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/sched.h",
"kernel/kcov.c",
"lib/Kconfig.debug"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.269",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.269",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.220",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcov: fix data corruption and race conditions on PREEMPT_RT\n\nsyzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the\ntemporary storage used for saving/restoring remote KCOV state is currently\nallocated as the per-CPU area.\n\nOn PREEMPT_RT kernels, softirq handlers run as preemptible task threads\n(e.g., ksoftirqd). If a softirq context preempts a task running a remote\nKCOV session, it safely saves the task\u0027s state into the per-CPU area.\nHowever, if that softirq thread is subsequently preempted by a higher-\npriority softirq thread on the same CPU, the second softirq will overwrite\nthe same per-CPU area, permanently destroying the original task\u0027s KCOV\nstate.\n\nFix this data corruption by moving the temporary storage from the per-CPU\narea to the per-thread area. Since each softirq thread now owns its own\ntask context, nested softirq preemption no longer causes data overwrites.\n\nNote that while the temporary storage is now on a per-thread basis, the\nper-CPU kcov_percpu_data.lock must be retained, for we need to ensure that\nkcov_remote_start() and kcov_remote_stop() operate atomically without\nracing against asynchronous interrupts that manipulate the current task\u0027s\nKCOV state.\n\nIt is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init()\nhas already called panic() before returning NULL, for there will be no\nOOM-killable userspace processes when __init function of built-in module\nruns. But this patch also fixes crashing the kernel when vmalloc_node()\nin kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL\nbut kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in\n\n (1) doing vmalloc() in kcov_remote_start() despite !in_task() context\n\n (2) out-of-array-bounds access if (1) succeeded but\n kcov-\u003eremote_size \u003c CONFIG_KCOV_IRQ_AREA_SIZE\n\n (3) always leak memory allocated by (1), eventually killing all\n OOM-killable userspace processes\n\nproblems."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:13:14.587Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ef7048d8a614c5f5a9b20513a5428101a744514e"
},
{
"url": "https://git.kernel.org/stable/c/8ed3ddf23d39bf5338406bd9f8863d44748cf6ce"
},
{
"url": "https://git.kernel.org/stable/c/5dc59fc959b2b5742985d7ef24bccd1868217dc2"
},
{
"url": "https://git.kernel.org/stable/c/a2fb8222cde23b0001812ed3acb7c0ea36dd94e2"
},
{
"url": "https://git.kernel.org/stable/c/18799e858b407bf355383c9dd6c06477aa437134"
},
{
"url": "https://git.kernel.org/stable/c/e11f5b48c82703242a3be7a7ae4b4940b4cb4610"
},
{
"url": "https://git.kernel.org/stable/c/22670d1552fe155822b2abf91f920925f7d067b4"
},
{
"url": "https://git.kernel.org/stable/c/f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761"
},
{
"url": "https://git.kernel.org/stable/c/2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c"
}
],
"title": "kcov: fix data corruption and race conditions on PREEMPT_RT",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80916",
"datePublished": "2026-09-09T16:13:14.587Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:13:14.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80915 (GCVE-0-2026-80915)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
VLAI
EPSS
VEX
Title
drm/xe: Fix DPT allocation paths.
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix DPT allocation paths.
Remove the fallback for VRAM to system memory, I tested it and that
doesn't work at all, only a black screen with pipe fault errors were
observed.
On systems with media GT, extra latency is added when accessing stolen
memory when the GT is in MC6. Since we additionally aren't counting how
much memory is used for stolen and we could in theory fill up the
entire stolen area with DPT's, avoid using stolen and only use the
default memory region.
Using stolen may also result in random system hangs under load.
(cherry picked from commit a196406a3831291598fe8e73245914f7acffdfe0)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
775d0adc01a55fe0458139330415d86bb3533efe , < 491c499295fb0b90308b230b0a1075dcdf7f4d12
(git)
Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < f03415030579163f791c978741af7f1f2f6510b7 (git) Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < c457e2c845ccbf2224386029f3da4937ba424db0 (git) Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < fc648757908304aedbad74f74bf58192aec383db (git) Affected: 4854ac2f88e2168ee4da2b152c6711772a8149aa (git) Affected: 6.11.3 , < 6.12 (semver) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.106 , ≤ 6.12.* (semver) Unaffected: 6.18.47 , ≤ 6.18.* (semver) Unaffected: 7.1.11 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/display/xe_fb_pin.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "491c499295fb0b90308b230b0a1075dcdf7f4d12",
"status": "affected",
"version": "775d0adc01a55fe0458139330415d86bb3533efe",
"versionType": "git"
},
{
"lessThan": "f03415030579163f791c978741af7f1f2f6510b7",
"status": "affected",
"version": "775d0adc01a55fe0458139330415d86bb3533efe",
"versionType": "git"
},
{
"lessThan": "c457e2c845ccbf2224386029f3da4937ba424db0",
"status": "affected",
"version": "775d0adc01a55fe0458139330415d86bb3533efe",
"versionType": "git"
},
{
"lessThan": "fc648757908304aedbad74f74bf58192aec383db",
"status": "affected",
"version": "775d0adc01a55fe0458139330415d86bb3533efe",
"versionType": "git"
},
{
"status": "affected",
"version": "4854ac2f88e2168ee4da2b152c6711772a8149aa",
"versionType": "git"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/display/xe_fb_pin.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix DPT allocation paths.\n\nRemove the fallback for VRAM to system memory, I tested it and that\ndoesn\u0027t work at all, only a black screen with pipe fault errors were\nobserved.\n\nOn systems with media GT, extra latency is added when accessing stolen\nmemory when the GT is in MC6. Since we additionally aren\u0027t counting how\nmuch memory is used for stolen and we could in theory fill up the\nentire stolen area with DPT\u0027s, avoid using stolen and only use the\ndefault memory region.\n\nUsing stolen may also result in random system hangs under load.\n\n(cherry picked from commit a196406a3831291598fe8e73245914f7acffdfe0)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:13:13.979Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/491c499295fb0b90308b230b0a1075dcdf7f4d12"
},
{
"url": "https://git.kernel.org/stable/c/f03415030579163f791c978741af7f1f2f6510b7"
},
{
"url": "https://git.kernel.org/stable/c/c457e2c845ccbf2224386029f3da4937ba424db0"
},
{
"url": "https://git.kernel.org/stable/c/fc648757908304aedbad74f74bf58192aec383db"
}
],
"title": "drm/xe: Fix DPT allocation paths.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80915",
"datePublished": "2026-09-09T16:13:13.979Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:13:13.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80914 (GCVE-0-2026-80914)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:10 – Updated: 2026-09-09 16:10
VLAI
EPSS
VEX
Title
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
iso_conn_ready() looks up the BIS listener socket with iso_get_sock(),
which takes a reference, and then, without re-checking its state,
creates a child socket from it:
parent = iso_get_sock(hdev, ...);
if (!parent)
return;
lock_sock(parent);
sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);
...
iso_chan_add(conn, sk, parent);
...
release_sock(parent);
sock_put(parent);
If the listener socket is closed concurrently, between iso_get_sock()
and lock_sock(), the reference taken by iso_get_sock() may be the last
one: the close path drops the link-list reference, and once
iso_conn_ready() drops its own reference at the end of the function the
socket is freed. The child socket, however, is already linked to the
freed parent, and a later disconnect of the child runs iso_chan_del()
-> bt_accept_unlink(), which dereferences the dangling parent pointer
into the freed accept queue (a use-after-free). The same dangling
pointer is also dereferenced through parent->***() in
iso_chan_del().
Fix it the same way the connected (non-BIS) path was fixed in commit
0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"):
after taking the socket lock, re-check that the parent is still a
listening, alive socket, and bail out otherwise.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 2387cd06a2c0b416f05028b02bba1089f54c28d9
(git)
Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 49fd7116f76b860b230843700fb7423ab5331e1f (git) Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 03288b7447c9e572f8ab82fc29cfb4ca719ab210 (git) Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 560bef609fa5992745929e8d7d458b9d88dd2830 (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2387cd06a2c0b416f05028b02bba1089f54c28d9",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
},
{
"lessThan": "49fd7116f76b860b230843700fb7423ab5331e1f",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
},
{
"lessThan": "03288b7447c9e572f8ab82fc29cfb4ca719ab210",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
},
{
"lessThan": "560bef609fa5992745929e8d7d458b9d88dd2830",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready\n\niso_conn_ready() looks up the BIS listener socket with iso_get_sock(),\nwhich takes a reference, and then, without re-checking its state,\ncreates a child socket from it:\n\n parent = iso_get_sock(hdev, ...);\n if (!parent)\n return;\n\n lock_sock(parent);\n sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);\n ...\n iso_chan_add(conn, sk, parent);\n ...\n release_sock(parent);\n sock_put(parent);\n\nIf the listener socket is closed concurrently, between iso_get_sock()\nand lock_sock(), the reference taken by iso_get_sock() may be the last\none: the close path drops the link-list reference, and once\niso_conn_ready() drops its own reference at the end of the function the\nsocket is freed. The child socket, however, is already linked to the\nfreed parent, and a later disconnect of the child runs iso_chan_del()\n-\u003e bt_accept_unlink(), which dereferences the dangling parent pointer\ninto the freed accept queue (a use-after-free). The same dangling\npointer is also dereferenced through parent-\u003e***() in\niso_chan_del().\n\nFix it the same way the connected (non-BIS) path was fixed in commit\n0d255e63fcf3 (\"Bluetooth: ISO: hold sk properly in iso_conn_ready\"):\nafter taking the socket lock, re-check that the parent is still a\nlistening, alive socket, and bail out otherwise."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:10:58.675Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2387cd06a2c0b416f05028b02bba1089f54c28d9"
},
{
"url": "https://git.kernel.org/stable/c/49fd7116f76b860b230843700fb7423ab5331e1f"
},
{
"url": "https://git.kernel.org/stable/c/03288b7447c9e572f8ab82fc29cfb4ca719ab210"
},
{
"url": "https://git.kernel.org/stable/c/560bef609fa5992745929e8d7d458b9d88dd2830"
}
],
"title": "Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80914",
"datePublished": "2026-09-09T16:10:58.675Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:10:58.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80913 (GCVE-0-2026-80913)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
selinux: require every boolean value to be defined
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: require every boolean value to be defined
p_bools.nprim comes from the policy image independently of how many
booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at
value - 1, so a count larger than the values present leaves NULL entries.
Every user of that array then walks it by index and dereferences each
entry: cond_evaluate_expr() on the access-vector path,
security_get_bools() and security_get_bool_value() behind selinuxfs, and
security_set_bools(). A sparse class value is absorbed by
policydb_class_isvalid() and its siblings; booleans have no such
predicate, and no consumer that could use one.
Reject a boolean value that no boolean defines, once, where the array is
built. Conforming policies define every boolean they declare and are
unaffected.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4d0ece18e648bd4362704fd087249ac697f2b7fb
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4dfb997c60f7951011d3dcbee926e3a7f80d8a76 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 740012aebdb8311332bf66e2aabf453ba73c2c45 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 42a7107f99d86a7524c37f108047dfa3db096ab5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a93d37a09b863810653f93d371fb197457d59deb (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/policydb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4d0ece18e648bd4362704fd087249ac697f2b7fb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4dfb997c60f7951011d3dcbee926e3a7f80d8a76",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "740012aebdb8311332bf66e2aabf453ba73c2c45",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "42a7107f99d86a7524c37f108047dfa3db096ab5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a93d37a09b863810653f93d371fb197457d59deb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/policydb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: require every boolean value to be defined\n\np_bools.nprim comes from the policy image independently of how many\nbooleans follow it, and cond_index_bool() fills bool_val_to_struct[] at\nvalue - 1, so a count larger than the values present leaves NULL entries.\nEvery user of that array then walks it by index and dereferences each\nentry: cond_evaluate_expr() on the access-vector path,\nsecurity_get_bools() and security_get_bool_value() behind selinuxfs, and\nsecurity_set_bools(). A sparse class value is absorbed by\npolicydb_class_isvalid() and its siblings; booleans have no such\npredicate, and no consumer that could use one.\n\nReject a boolean value that no boolean defines, once, where the array is\nbuilt. Conforming policies define every boolean they declare and are\nunaffected."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:23.975Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4d0ece18e648bd4362704fd087249ac697f2b7fb"
},
{
"url": "https://git.kernel.org/stable/c/3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8"
},
{
"url": "https://git.kernel.org/stable/c/4dfb997c60f7951011d3dcbee926e3a7f80d8a76"
},
{
"url": "https://git.kernel.org/stable/c/3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40"
},
{
"url": "https://git.kernel.org/stable/c/740012aebdb8311332bf66e2aabf453ba73c2c45"
},
{
"url": "https://git.kernel.org/stable/c/42a7107f99d86a7524c37f108047dfa3db096ab5"
},
{
"url": "https://git.kernel.org/stable/c/ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec"
},
{
"url": "https://git.kernel.org/stable/c/a93d37a09b863810653f93d371fb197457d59deb"
}
],
"title": "selinux: require every boolean value to be defined",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80913",
"datePublished": "2026-09-04T17:19:23.975Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-04T17:19:23.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80912 (GCVE-0-2026-80912)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
selinux: reject an unclaimed class value in security_get_classes()
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: reject an unclaimed class value in security_get_classes()
security_get_classes() sizes an array by p_classes.nprim and fills it at
value - 1, so a class value the policy never defines leaves a NULL.
sel_make_classes() passes every entry to sel_make_dir(), reaching the same
d_alloc_name() dereference as the permission array. The class symbol table
is allowed to be sparse (policydb_class_isvalid() exists to absorb that),
but this getter builds its own array straight from the hash table and has
no such predicate.
Fail the lookup when a value went unclaimed instead of handing out the
NULL. Conforming policies define every class they declare and are
unaffected.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < e0285bb152211c00900136b66d4b420c14a59094
(git)
Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 099869e9343a5f8c22b58497f074b34f63cbf856 (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 841aea4d5a25e16273d04cd07a74142b4687e03b (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < d8a10899ea3c84b80de72ca8ee9039e9a5156c9a (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd (git) |
|
| Linux | Linux |
Affected:
2.6.23
Unaffected: 0 , < 2.6.23 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/services.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e0285bb152211c00900136b66d4b420c14a59094",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "099869e9343a5f8c22b58497f074b34f63cbf856",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "841aea4d5a25e16273d04cd07a74142b4687e03b",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "d8a10899ea3c84b80de72ca8ee9039e9a5156c9a",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/services.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: reject an unclaimed class value in security_get_classes()\n\nsecurity_get_classes() sizes an array by p_classes.nprim and fills it at\nvalue - 1, so a class value the policy never defines leaves a NULL.\nsel_make_classes() passes every entry to sel_make_dir(), reaching the same\nd_alloc_name() dereference as the permission array. The class symbol table\nis allowed to be sparse (policydb_class_isvalid() exists to absorb that),\nbut this getter builds its own array straight from the hash table and has\nno such predicate.\n\nFail the lookup when a value went unclaimed instead of handing out the\nNULL. Conforming policies define every class they declare and are\nunaffected."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:23.066Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e0285bb152211c00900136b66d4b420c14a59094"
},
{
"url": "https://git.kernel.org/stable/c/099869e9343a5f8c22b58497f074b34f63cbf856"
},
{
"url": "https://git.kernel.org/stable/c/841aea4d5a25e16273d04cd07a74142b4687e03b"
},
{
"url": "https://git.kernel.org/stable/c/d8a10899ea3c84b80de72ca8ee9039e9a5156c9a"
},
{
"url": "https://git.kernel.org/stable/c/22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd"
}
],
"title": "selinux: reject an unclaimed class value in security_get_classes()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80912",
"datePublished": "2026-09-04T17:19:23.066Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-04T17:19:23.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80911 (GCVE-0-2026-80911)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
If either tplg_ops->dai_config or widget_kcontrol_setup fail during widget
setup we would double decrement the use_count of the widget because the
sof_widget_free_unlocked() would be called twice, similarly the core_put
would be invoked twice as well.
Since the use_count and core_put() is handled within the widget_free
function we need to return without falling through the pipe_widget_free
label.
The fixes tag is picked to the last change around this part of the code
which is adequately old enough for backporting purposes.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3c124f09b7ff0434b076a8dec1ed446a6170b549 , < b270ed327380428581bbcbd85707f62e942428d7
(git)
Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < c06995637f6a4667f2b540ac65315bfc8196a099 (git) Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < 8cba53b862e1437257ec206d303ff942684284f1 (git) Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < d48691e70d4a9434b71039d4ed12bb0df4601acf (git) Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < e780e4917d43683224812400fe3dc4816fceba75 (git) Affected: 6.6.13 , < 6.6.153 (semver) |
|
| Linux | Linux |
Affected:
6.7
Unaffected: 0 , < 6.7 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/sof-audio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b270ed327380428581bbcbd85707f62e942428d7",
"status": "affected",
"version": "3c124f09b7ff0434b076a8dec1ed446a6170b549",
"versionType": "git"
},
{
"lessThan": "c06995637f6a4667f2b540ac65315bfc8196a099",
"status": "affected",
"version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
"versionType": "git"
},
{
"lessThan": "8cba53b862e1437257ec206d303ff942684284f1",
"status": "affected",
"version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
"versionType": "git"
},
{
"lessThan": "d48691e70d4a9434b71039d4ed12bb0df4601acf",
"status": "affected",
"version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
"versionType": "git"
},
{
"lessThan": "e780e4917d43683224812400fe3dc4816fceba75",
"status": "affected",
"version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
"versionType": "git"
},
{
"lessThan": "6.6.153",
"status": "affected",
"version": "6.6.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/sof-audio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "6.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()\n\nIf either tplg_ops-\u003edai_config or widget_kcontrol_setup fail during widget\nsetup we would double decrement the use_count of the widget because the\nsof_widget_free_unlocked() would be called twice, similarly the core_put\nwould be invoked twice as well.\n\nSince the use_count and core_put() is handled within the widget_free\nfunction we need to return without falling through the pipe_widget_free\nlabel.\n\nThe fixes tag is picked to the last change around this part of the code\nwhich is adequately old enough for backporting purposes."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:22.045Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b270ed327380428581bbcbd85707f62e942428d7"
},
{
"url": "https://git.kernel.org/stable/c/c06995637f6a4667f2b540ac65315bfc8196a099"
},
{
"url": "https://git.kernel.org/stable/c/8cba53b862e1437257ec206d303ff942684284f1"
},
{
"url": "https://git.kernel.org/stable/c/d48691e70d4a9434b71039d4ed12bb0df4601acf"
},
{
"url": "https://git.kernel.org/stable/c/e780e4917d43683224812400fe3dc4816fceba75"
}
],
"title": "ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80911",
"datePublished": "2026-09-04T17:19:22.045Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-04T17:19:22.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80910 (GCVE-0-2026-80910)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated,
but their get and put callbacks access the value through
ucontrol->value.integer.value[0] (a long) instead of
ucontrol->value.enumerated.item[0] (an unsigned int).
This same pattern was fixed in the sibling drivers by
commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array
out of bounds for enum type") and
commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array
out of bounds for enum type"), but wsa-macro was missed.
On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value
sanity check and every read of these controls fails with -EINVAL.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
809bcbcecebff86003e13f07444d21b9d6652a64 , < bd4e5f9c3b764dc0e2a5662f92d63d2f3767a78d
(git)
Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 4bcac4bf304a3ec746192e49a669c236aaf27dbf (git) Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 891129df5de79cd533ae335c6eab24df2ff2b0fd (git) Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 524aa7b9954b0a43dd13f71ecbbac52a151c326d (git) Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 2fe7a89b2b5b73be35c1e493d0246314ba54e427 (git) Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 7bcdde412e6c744f6135e02b12a735e2e37b639f (git) Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 56f24311fd5607588a47e44675195a9efb200f29 (git) |
|
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/lpass-wsa-macro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bd4e5f9c3b764dc0e2a5662f92d63d2f3767a78d",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "4bcac4bf304a3ec746192e49a669c236aaf27dbf",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "891129df5de79cd533ae335c6eab24df2ff2b0fd",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "524aa7b9954b0a43dd13f71ecbbac52a151c326d",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "2fe7a89b2b5b73be35c1e493d0246314ba54e427",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "7bcdde412e6c744f6135e02b12a735e2e37b639f",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "56f24311fd5607588a47e44675195a9efb200f29",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/lpass-wsa-macro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses\n\nEAR SPKR PA Gain\" and the four \"WSA RX* Mux\" controls are enumerated,\nbut their get and put callbacks access the value through\nucontrol-\u003evalue.integer.value[0] (a long) instead of\nucontrol-\u003evalue.enumerated.item[0] (an unsigned int).\n\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but wsa-macro was missed.\n\nOn 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value\nsanity check and every read of these controls fails with -EINVAL."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:21.079Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bd4e5f9c3b764dc0e2a5662f92d63d2f3767a78d"
},
{
"url": "https://git.kernel.org/stable/c/4bcac4bf304a3ec746192e49a669c236aaf27dbf"
},
{
"url": "https://git.kernel.org/stable/c/891129df5de79cd533ae335c6eab24df2ff2b0fd"
},
{
"url": "https://git.kernel.org/stable/c/524aa7b9954b0a43dd13f71ecbbac52a151c326d"
},
{
"url": "https://git.kernel.org/stable/c/2fe7a89b2b5b73be35c1e493d0246314ba54e427"
},
{
"url": "https://git.kernel.org/stable/c/7bcdde412e6c744f6135e02b12a735e2e37b639f"
},
{
"url": "https://git.kernel.org/stable/c/56f24311fd5607588a47e44675195a9efb200f29"
}
],
"title": "ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80910",
"datePublished": "2026-09-04T17:19:21.079Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-04T17:19:21.079Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80909 (GCVE-0-2026-80909)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-07 14:21
VLAI
EPSS
VEX
Title
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Same change as for h264, avoids overflow later when calculating
min dpb size.
(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < 1facad2a78c1a8aeecc36eb4d560c7f1e10ce198
(git)
Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < 499907e5d46e575e96967c0230a0a6af980a17ab (git) Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < cbf1c84bf5cac2b3742ea3d2085fa713424465cc (git) Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < a930c54cb67200de8bc0de87480d09ece7dcd85d (git) Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < 2abcdc5f738574e7fcdd9417575dffb877fdc26f (git) Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < e304c3e0d9ce251887be1f274aa0ed52219d5fd7 (git) Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < 0acdf1a575f59bd46717d5c487d84575af5bee8f (git) Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < 9fca434208f1f9ab977feac62df8ebb1cc7ce893 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1facad2a78c1a8aeecc36eb4d560c7f1e10ce198",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "499907e5d46e575e96967c0230a0a6af980a17ab",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "cbf1c84bf5cac2b3742ea3d2085fa713424465cc",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "a930c54cb67200de8bc0de87480d09ece7dcd85d",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "2abcdc5f738574e7fcdd9417575dffb877fdc26f",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "e304c3e0d9ce251887be1f274aa0ed52219d5fd7",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "0acdf1a575f59bd46717d5c487d84575af5bee8f",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "9fca434208f1f9ab977feac62df8ebb1cc7ce893",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Reject UVD message with invalid number of h265 refs\n\nSame change as for h264, avoids overflow later when calculating\nmin dpb size.\n\n(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T14:21:32.011Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1facad2a78c1a8aeecc36eb4d560c7f1e10ce198"
},
{
"url": "https://git.kernel.org/stable/c/499907e5d46e575e96967c0230a0a6af980a17ab"
},
{
"url": "https://git.kernel.org/stable/c/cbf1c84bf5cac2b3742ea3d2085fa713424465cc"
},
{
"url": "https://git.kernel.org/stable/c/a930c54cb67200de8bc0de87480d09ece7dcd85d"
},
{
"url": "https://git.kernel.org/stable/c/2abcdc5f738574e7fcdd9417575dffb877fdc26f"
},
{
"url": "https://git.kernel.org/stable/c/e304c3e0d9ce251887be1f274aa0ed52219d5fd7"
},
{
"url": "https://git.kernel.org/stable/c/0acdf1a575f59bd46717d5c487d84575af5bee8f"
},
{
"url": "https://git.kernel.org/stable/c/9fca434208f1f9ab977feac62df8ebb1cc7ce893"
}
],
"title": "drm/amdgpu: Reject UVD message with invalid number of h265 refs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80909",
"datePublished": "2026-09-04T17:19:20.085Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-07T14:21:32.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80908 (GCVE-0-2026-80908)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-07 14:21
VLAI
EPSS
VEX
Title
drm/amdgpu: Reject UVD message with dimensions above 4096
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Reject UVD message with dimensions above 4096
Fixes potential overflow in DPB size calculations.
(cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 8bae80eaed00e7ae28412a3cdf590f4beca72294
(git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 9adc5e25f31d7ee7dfc18814499b6e3a6d402904 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 382bef781ff441ce8055bdada57b8c291dc0fd30 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 8435d41afcf2bc31ecee213ef651c12bd1a16d38 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < f7af372d3b892b95dd3cd1c6acf29daa39ba076d (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 339deb76ee4859ea973e435c9a9a4a4fefc29338 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 17fbb996c05f2190e0fa20927ca0b9804d481b02 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 8c9aebcdd9f46f7a14b98d6ab18574b7a48fbb08 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8bae80eaed00e7ae28412a3cdf590f4beca72294",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "9adc5e25f31d7ee7dfc18814499b6e3a6d402904",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "382bef781ff441ce8055bdada57b8c291dc0fd30",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "8435d41afcf2bc31ecee213ef651c12bd1a16d38",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "f7af372d3b892b95dd3cd1c6acf29daa39ba076d",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "339deb76ee4859ea973e435c9a9a4a4fefc29338",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "17fbb996c05f2190e0fa20927ca0b9804d481b02",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "8c9aebcdd9f46f7a14b98d6ab18574b7a48fbb08",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Reject UVD message with dimensions above 4096\n\nFixes potential overflow in DPB size calculations.\n\n(cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T14:21:30.299Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8bae80eaed00e7ae28412a3cdf590f4beca72294"
},
{
"url": "https://git.kernel.org/stable/c/9adc5e25f31d7ee7dfc18814499b6e3a6d402904"
},
{
"url": "https://git.kernel.org/stable/c/382bef781ff441ce8055bdada57b8c291dc0fd30"
},
{
"url": "https://git.kernel.org/stable/c/8435d41afcf2bc31ecee213ef651c12bd1a16d38"
},
{
"url": "https://git.kernel.org/stable/c/f7af372d3b892b95dd3cd1c6acf29daa39ba076d"
},
{
"url": "https://git.kernel.org/stable/c/339deb76ee4859ea973e435c9a9a4a4fefc29338"
},
{
"url": "https://git.kernel.org/stable/c/17fbb996c05f2190e0fa20927ca0b9804d481b02"
},
{
"url": "https://git.kernel.org/stable/c/8c9aebcdd9f46f7a14b98d6ab18574b7a48fbb08"
}
],
"title": "drm/amdgpu: Reject UVD message with dimensions above 4096",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80908",
"datePublished": "2026-09-04T17:19:19.155Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-07T14:21:30.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80907 (GCVE-0-2026-80907)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-07 14:21
VLAI
EPSS
VEX
Title
drm/amdgpu: Fix UVD dpb min size calculation for H264
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix UVD dpb min size calculation for H264
This should use actual number of references from the decode
message, instead of maximum derived from level.
(cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < fa96c24485942e277483cc70d9551d9e0111d7c5
(git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 33f4ef585368fe93523dca1e5440e006f6e5146e (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 38914cb2c6afb5fe00241ea3438e655822196378 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < ff4361816b6ba4bd29b548b17d993056a1ae2502 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 21a8084cd76223a13493237e04d45f5226d7cee6 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fa96c24485942e277483cc70d9551d9e0111d7c5",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "33f4ef585368fe93523dca1e5440e006f6e5146e",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "38914cb2c6afb5fe00241ea3438e655822196378",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "ff4361816b6ba4bd29b548b17d993056a1ae2502",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "21a8084cd76223a13493237e04d45f5226d7cee6",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix UVD dpb min size calculation for H264\n\nThis should use actual number of references from the decode\nmessage, instead of maximum derived from level.\n\n(cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T14:21:28.637Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fa96c24485942e277483cc70d9551d9e0111d7c5"
},
{
"url": "https://git.kernel.org/stable/c/33f4ef585368fe93523dca1e5440e006f6e5146e"
},
{
"url": "https://git.kernel.org/stable/c/38914cb2c6afb5fe00241ea3438e655822196378"
},
{
"url": "https://git.kernel.org/stable/c/ff4361816b6ba4bd29b548b17d993056a1ae2502"
},
{
"url": "https://git.kernel.org/stable/c/21a8084cd76223a13493237e04d45f5226d7cee6"
}
],
"title": "drm/amdgpu: Fix UVD dpb min size calculation for H264",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80907",
"datePublished": "2026-09-04T17:19:18.052Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-07T14:21:28.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80906 (GCVE-0-2026-80906)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
net: packet: fix wrong transport_header when sending VLAN-tagged frame
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: packet: fix wrong transport_header when sending VLAN-tagged frame
In packet_parse_headers(), when processing a VLAN-tagged frame,
skb_set_network_header() is called to advance network_header past the
VLAN tag to the inner protocol header. skb_probe_transport_header() is
then called with skb->protocol still set to the outer VLAN EtherType
(e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset())
already points past the VLAN tag to the inner protocol header.
In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff
points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it
reads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that
offset contains the inner protocol header (e.g. an IP header). The bytes
are misinterpreted as a VLAN header, yielding a garbage encapsulated
EtherType that matches no known protocol. The dissector returns false,
so skb_probe_transport_header() never calls skb_set_transport_header(),
leaving transport_header at its uninitialized sentinel value (~0U).
Move skb_probe_transport_header() to before skb_set_network_header(). At
the time skb_probe_transport_header() is called, network_header still
points to the VLAN header, so nhoff correctly points to the VLAN header.
The flow dissector can then parse the VLAN header, extract the inner
EtherType, and advance nhoff to the inner protocol header, allowing
transport_header to be set correctly.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c2137d565ceb505de69593c181a0543bc4083838 , < a4b82de96d465ddb44bc931145c0fa80c4fe9c9c
(git)
Affected: 9ff46c36df2e0a1ac352f2f4038eaf3f0f7361b8 , < fa86bc52ea8ba981f74f851fd61e2a3d3bc0feac (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < 5479eb9b355f44745d7ccfe112386bd4f96eceea (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < e451e20adb869a983a21dda158625f024142e61f (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < 6971cf319263d6a1b4096f9248aca9e57d77a1eb (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < f9297abbcaba760b7a7b9d63b839f607f738013e (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < 6386a6ffa2efba2965ed8e4fa303582c0b76a215 (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < 01fdecc0480d916c799dbee584833a4a37e94d06 (git) Affected: ad3f90a9c4a2c74bb3711f2031bffda4ec44c849 (git) Affected: 5.10.163 , < 5.10.266 (semver) Affected: 5.15.87 , < 5.15.217 (semver) Affected: 5.4.229 , < 5.5 (semver) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a4b82de96d465ddb44bc931145c0fa80c4fe9c9c",
"status": "affected",
"version": "c2137d565ceb505de69593c181a0543bc4083838",
"versionType": "git"
},
{
"lessThan": "fa86bc52ea8ba981f74f851fd61e2a3d3bc0feac",
"status": "affected",
"version": "9ff46c36df2e0a1ac352f2f4038eaf3f0f7361b8",
"versionType": "git"
},
{
"lessThan": "5479eb9b355f44745d7ccfe112386bd4f96eceea",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"lessThan": "e451e20adb869a983a21dda158625f024142e61f",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"lessThan": "6971cf319263d6a1b4096f9248aca9e57d77a1eb",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"lessThan": "f9297abbcaba760b7a7b9d63b839f607f738013e",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"lessThan": "6386a6ffa2efba2965ed8e4fa303582c0b76a215",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"lessThan": "01fdecc0480d916c799dbee584833a4a37e94d06",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"status": "affected",
"version": "ad3f90a9c4a2c74bb3711f2031bffda4ec44c849",
"versionType": "git"
},
{
"lessThan": "5.10.266",
"status": "affected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThan": "5.15.217",
"status": "affected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.229",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.10.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.15.87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.229",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: packet: fix wrong transport_header when sending VLAN-tagged frame\n\nIn packet_parse_headers(), when processing a VLAN-tagged frame,\nskb_set_network_header() is called to advance network_header past the\nVLAN tag to the inner protocol header. skb_probe_transport_header() is\nthen called with skb-\u003eprotocol still set to the outer VLAN EtherType\n(e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset())\nalready points past the VLAN tag to the inner protocol header.\n\nIn __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff\npoints past the VLAN tag. When the dissector hits case ETH_P_8021Q, it\nreads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that\noffset contains the inner protocol header (e.g. an IP header). The bytes\nare misinterpreted as a VLAN header, yielding a garbage encapsulated\nEtherType that matches no known protocol. The dissector returns false,\nso skb_probe_transport_header() never calls skb_set_transport_header(),\nleaving transport_header at its uninitialized sentinel value (~0U).\n\nMove skb_probe_transport_header() to before skb_set_network_header(). At\nthe time skb_probe_transport_header() is called, network_header still\npoints to the VLAN header, so nhoff correctly points to the VLAN header.\nThe flow dissector can then parse the VLAN header, extract the inner\nEtherType, and advance nhoff to the inner protocol header, allowing\ntransport_header to be set correctly."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:16.531Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a4b82de96d465ddb44bc931145c0fa80c4fe9c9c"
},
{
"url": "https://git.kernel.org/stable/c/fa86bc52ea8ba981f74f851fd61e2a3d3bc0feac"
},
{
"url": "https://git.kernel.org/stable/c/5479eb9b355f44745d7ccfe112386bd4f96eceea"
},
{
"url": "https://git.kernel.org/stable/c/e451e20adb869a983a21dda158625f024142e61f"
},
{
"url": "https://git.kernel.org/stable/c/6971cf319263d6a1b4096f9248aca9e57d77a1eb"
},
{
"url": "https://git.kernel.org/stable/c/f9297abbcaba760b7a7b9d63b839f607f738013e"
},
{
"url": "https://git.kernel.org/stable/c/6386a6ffa2efba2965ed8e4fa303582c0b76a215"
},
{
"url": "https://git.kernel.org/stable/c/01fdecc0480d916c799dbee584833a4a37e94d06"
}
],
"title": "net: packet: fix wrong transport_header when sending VLAN-tagged frame",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80906",
"datePublished": "2026-09-04T17:19:16.531Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:19:16.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80905 (GCVE-0-2026-80905)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
net: tap: fix wrong transport_header when sending VLAN-tagged frame
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: tap: fix wrong transport_header when sending VLAN-tagged frame
In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g.
ETH_P_8021Q), skb_set_network_header() is called first to advance
network_header past the VLAN tag to the inner protocol header.
skb_probe_transport_header() is then called with skb->protocol still
set to ETH_P_8021Q, while nhoff (derived from skb_network_offset())
already points past the VLAN tag to the inner protocol header.
In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff
points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it
reads a struct vlan_hdr at the current nhoff via __skb_header_pointer(),
but that offset contains the inner protocol header (e.g. an IP header).
The bytes are misinterpreted as a VLAN header, yielding a garbage
encapsulated EtherType that matches no known protocol. The dissector
returns false, so skb_probe_transport_header() never calls
skb_set_transport_header(), leaving transport_header at its uninitialized
sentinel value (~0U).
Move skb_set_network_header() to after skb_probe_transport_header(). At
the time skb_probe_transport_header() is called, network_header still
points to the VLAN header (offset ETH_HLEN), so nhoff is correct and the
flow dissector can parse the VLAN header, extract the inner EtherType,
and advance nhoff to the inner protocol header, allowing transport_header
to be set correctly.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8c76e77f9069f10505c08e02646c3ee11ad79038 , < 5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b
(git)
Affected: 8c76e77f9069f10505c08e02646c3ee11ad79038 , < 88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3 (git) Affected: 8c76e77f9069f10505c08e02646c3ee11ad79038 , < cbb35cbe8db268fefe34c23df15348cf99025298 (git) Affected: 3cae5ef1f37a475faf7c40bc6a3c170779f3e0b1 (git) Affected: 4.20.1 , < 4.21 (semver) |
|
| Linux | Linux |
Affected:
5.0
Unaffected: 0 , < 5.0 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/tap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"lessThan": "88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"lessThan": "cbb35cbe8db268fefe34c23df15348cf99025298",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"status": "affected",
"version": "3cae5ef1f37a475faf7c40bc6a3c170779f3e0b1",
"versionType": "git"
},
{
"lessThan": "4.21",
"status": "affected",
"version": "4.20.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/tap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.20.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tap: fix wrong transport_header when sending VLAN-tagged frame\n\nIn tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g.\nETH_P_8021Q), skb_set_network_header() is called first to advance\nnetwork_header past the VLAN tag to the inner protocol header.\nskb_probe_transport_header() is then called with skb-\u003eprotocol still\nset to ETH_P_8021Q, while nhoff (derived from skb_network_offset())\nalready points past the VLAN tag to the inner protocol header.\n\nIn __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff\npoints past the VLAN tag. When the dissector hits case ETH_P_8021Q, it\nreads a struct vlan_hdr at the current nhoff via __skb_header_pointer(),\nbut that offset contains the inner protocol header (e.g. an IP header).\nThe bytes are misinterpreted as a VLAN header, yielding a garbage\nencapsulated EtherType that matches no known protocol. The dissector\nreturns false, so skb_probe_transport_header() never calls\nskb_set_transport_header(), leaving transport_header at its uninitialized\nsentinel value (~0U).\n\nMove skb_set_network_header() to after skb_probe_transport_header(). At\nthe time skb_probe_transport_header() is called, network_header still\npoints to the VLAN header (offset ETH_HLEN), so nhoff is correct and the\nflow dissector can parse the VLAN header, extract the inner EtherType,\nand advance nhoff to the inner protocol header, allowing transport_header\nto be set correctly."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:15.289Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b"
},
{
"url": "https://git.kernel.org/stable/c/88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3"
},
{
"url": "https://git.kernel.org/stable/c/cbb35cbe8db268fefe34c23df15348cf99025298"
}
],
"title": "net: tap: fix wrong transport_header when sending VLAN-tagged frame",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80905",
"datePublished": "2026-09-04T17:19:15.289Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:19:15.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80904 (GCVE-0-2026-80904)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
When an async decrypt fails, tls_decrypt_done() records the error in
ctx->async_wait.err and calls tls_err_abort(), which stores it in
sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read
async_wait.err once they hold the reader lock and fail the call: a
record that did not authenticate breaks the connection.
tls_sw_splice_read() has no such check, and sk_err does not stand in
for one. tls_rx_rec_wait() tests sk_err only inside the loop it
skips whenever a record is already parsed, and the first reader to
reach sock_error() clears it, while async_wait.err persists. A
splice therefore keeps delivering records on a connection that
recvmsg() and read_sock() refuse to read.
Read async_wait.err in tls_sw_splice_read() as the other two readers
do.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f314bfee81b1bf8e01168177b2f65f24eb8da63a , < a808aadff634c7a408b2ab84d5919e9a741fdb5b
(git)
Affected: f314bfee81b1bf8e01168177b2f65f24eb8da63a , < 06c2a53604fa1dc4820063828d7dadb3675b7af8 (git) Affected: f314bfee81b1bf8e01168177b2f65f24eb8da63a , < 18ae1e95f20867106a28820c208a9cec99dda861 (git) Affected: f314bfee81b1bf8e01168177b2f65f24eb8da63a , < 82d9269f01ebfd835b6256aa17016a974cbbc647 (git) Affected: f314bfee81b1bf8e01168177b2f65f24eb8da63a , < 4b177911eb9f799e9841c2f87c75b08cb112757a (git) Affected: f314bfee81b1bf8e01168177b2f65f24eb8da63a , < 976df67f463db1fddaf2a32fb04f57ad2891a23d (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a808aadff634c7a408b2ab84d5919e9a741fdb5b",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
},
{
"lessThan": "06c2a53604fa1dc4820063828d7dadb3675b7af8",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
},
{
"lessThan": "18ae1e95f20867106a28820c208a9cec99dda861",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
},
{
"lessThan": "82d9269f01ebfd835b6256aa17016a974cbbc647",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
},
{
"lessThan": "4b177911eb9f799e9841c2f87c75b08cb112757a",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
},
{
"lessThan": "976df67f463db1fddaf2a32fb04f57ad2891a23d",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: Fail tls_sw_splice_read() after a failed async decrypt\n\nWhen an async decrypt fails, tls_decrypt_done() records the error in\nctx-\u003easync_wait.err and calls tls_err_abort(), which stores it in\nsk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read\nasync_wait.err once they hold the reader lock and fail the call: a\nrecord that did not authenticate breaks the connection.\n\ntls_sw_splice_read() has no such check, and sk_err does not stand in\nfor one. tls_rx_rec_wait() tests sk_err only inside the loop it\nskips whenever a record is already parsed, and the first reader to\nreach sock_error() clears it, while async_wait.err persists. A\nsplice therefore keeps delivering records on a connection that\nrecvmsg() and read_sock() refuse to read.\n\nRead async_wait.err in tls_sw_splice_read() as the other two readers\ndo."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:14.391Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a808aadff634c7a408b2ab84d5919e9a741fdb5b"
},
{
"url": "https://git.kernel.org/stable/c/06c2a53604fa1dc4820063828d7dadb3675b7af8"
},
{
"url": "https://git.kernel.org/stable/c/18ae1e95f20867106a28820c208a9cec99dda861"
},
{
"url": "https://git.kernel.org/stable/c/82d9269f01ebfd835b6256aa17016a974cbbc647"
},
{
"url": "https://git.kernel.org/stable/c/4b177911eb9f799e9841c2f87c75b08cb112757a"
},
{
"url": "https://git.kernel.org/stable/c/976df67f463db1fddaf2a32fb04f57ad2891a23d"
}
],
"title": "net/tls: Fail tls_sw_splice_read() after a failed async decrypt",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80904",
"datePublished": "2026-09-04T17:19:14.391Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:19:14.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80903 (GCVE-0-2026-80903)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
drm/xe/oa: Fix sync entry leak on OA config emit failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Fix sync entry leak on OA config emit failure
xe_oa_emit_oa_config() releases the sync entries and the syncs array
only on its success path. When it fails before the point of no return
(fence allocation, config buffer allocation or batch submission), it
returns without touching stream->syncs.
The stream open path handles such failures in the caller, but
xe_oa_config_locked() propagates the error without any cleanup, so the
syncs array and the fence references held by the parsed entries are
leaked. The next config ioctl overwrites stream->syncs, making the
memory unreachable for good.
Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching
the cleanup done by the stream open error path.
(cherry picked from commit 8af97b3da2cfce04e6b457c6eb17ed3c1daf912b)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f0ab9cd205d852a9024b73c71c8d8b217a04e8f0 , < fcf7943b0a38568c547d7b5702de1d8190480616
(git)
Affected: 9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0 , < 948f346fe36e1d02353c3d61b1f6b66c6af91996 (git) Affected: 9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0 , < 027150e24e173a5dffe7f5ab3a6600618f634da2 (git) Affected: 9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0 , < 8d33c4987cd162527375a3905017ae129ba7c3fe (git) Affected: 6.12.18 , < 6.12.105 (semver) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_oa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fcf7943b0a38568c547d7b5702de1d8190480616",
"status": "affected",
"version": "f0ab9cd205d852a9024b73c71c8d8b217a04e8f0",
"versionType": "git"
},
{
"lessThan": "948f346fe36e1d02353c3d61b1f6b66c6af91996",
"status": "affected",
"version": "9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0",
"versionType": "git"
},
{
"lessThan": "027150e24e173a5dffe7f5ab3a6600618f634da2",
"status": "affected",
"version": "9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0",
"versionType": "git"
},
{
"lessThan": "8d33c4987cd162527375a3905017ae129ba7c3fe",
"status": "affected",
"version": "9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0",
"versionType": "git"
},
{
"lessThan": "6.12.105",
"status": "affected",
"version": "6.12.18",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_oa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.12.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix sync entry leak on OA config emit failure\n\nxe_oa_emit_oa_config() releases the sync entries and the syncs array\nonly on its success path. When it fails before the point of no return\n(fence allocation, config buffer allocation or batch submission), it\nreturns without touching stream-\u003esyncs.\n\nThe stream open path handles such failures in the caller, but\nxe_oa_config_locked() propagates the error without any cleanup, so the\nsyncs array and the fence references held by the parsed entries are\nleaked. The next config ioctl overwrites stream-\u003esyncs, making the\nmemory unreachable for good.\n\nClean up the parsed syncs when xe_oa_emit_oa_config() fails, matching\nthe cleanup done by the stream open error path.\n\n(cherry picked from commit 8af97b3da2cfce04e6b457c6eb17ed3c1daf912b)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:13.464Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fcf7943b0a38568c547d7b5702de1d8190480616"
},
{
"url": "https://git.kernel.org/stable/c/948f346fe36e1d02353c3d61b1f6b66c6af91996"
},
{
"url": "https://git.kernel.org/stable/c/027150e24e173a5dffe7f5ab3a6600618f634da2"
},
{
"url": "https://git.kernel.org/stable/c/8d33c4987cd162527375a3905017ae129ba7c3fe"
}
],
"title": "drm/xe/oa: Fix sync entry leak on OA config emit failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80903",
"datePublished": "2026-09-04T17:19:13.464Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:19:13.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80902 (GCVE-0-2026-80902)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
When terminating DMA transfers, active descriptors are not properly
reclaimed. Only cyclic descriptors were handled, leaving non-cyclic
descriptors and their LLI chains to be permanently leaked.
Fix by using vchan_terminate_vdesc() which handles both cyclic and
non-cyclic descriptors by adding them to desc_terminated queue for
proper cleanup.
Add pchan->desc != pchan->done check to prevent double-adding completed
descriptors, which would corrupt the list.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
555859308723d8d5b828304f5eb9281143fd86b5 , < bb87440561eb72b47a2b848b5373b86433b247e6
(git)
Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < 004a7a02982bed0a727a4ac7be400f00f353e7a2 (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < b150f603083cc8b72b0cbf13ec3e91f85b4390a0 (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < 27806fe7b9701af0963dcd510e30e7d0cc314c43 (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < 1ccc5c059d067c5358682ad5352e7d7e9239ed9b (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < 9086b488f2737d5dcee86852b83f2059f1cdfabf (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < d4ba6aa65fcd797152d3aebd428a7b2da49cd5eb (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < ab1150115e68a46b687eb38c1ab92782018c9f2c (git) |
|
| Linux | Linux |
Affected:
3.17
Unaffected: 0 , < 3.17 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/sun6i-dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb87440561eb72b47a2b848b5373b86433b247e6",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "004a7a02982bed0a727a4ac7be400f00f353e7a2",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "b150f603083cc8b72b0cbf13ec3e91f85b4390a0",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "27806fe7b9701af0963dcd510e30e7d0cc314c43",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "1ccc5c059d067c5358682ad5352e7d7e9239ed9b",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "9086b488f2737d5dcee86852b83f2059f1cdfabf",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "d4ba6aa65fcd797152d3aebd428a7b2da49cd5eb",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "ab1150115e68a46b687eb38c1ab92782018c9f2c",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/sun6i-dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA\n\nWhen terminating DMA transfers, active descriptors are not properly\nreclaimed. Only cyclic descriptors were handled, leaving non-cyclic\ndescriptors and their LLI chains to be permanently leaked.\n\nFix by using vchan_terminate_vdesc() which handles both cyclic and\nnon-cyclic descriptors by adding them to desc_terminated queue for\nproper cleanup.\n\nAdd pchan-\u003edesc != pchan-\u003edone check to prevent double-adding completed\ndescriptors, which would corrupt the list."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:17.510Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb87440561eb72b47a2b848b5373b86433b247e6"
},
{
"url": "https://git.kernel.org/stable/c/004a7a02982bed0a727a4ac7be400f00f353e7a2"
},
{
"url": "https://git.kernel.org/stable/c/b150f603083cc8b72b0cbf13ec3e91f85b4390a0"
},
{
"url": "https://git.kernel.org/stable/c/27806fe7b9701af0963dcd510e30e7d0cc314c43"
},
{
"url": "https://git.kernel.org/stable/c/1ccc5c059d067c5358682ad5352e7d7e9239ed9b"
},
{
"url": "https://git.kernel.org/stable/c/9086b488f2737d5dcee86852b83f2059f1cdfabf"
},
{
"url": "https://git.kernel.org/stable/c/d4ba6aa65fcd797152d3aebd428a7b2da49cd5eb"
},
{
"url": "https://git.kernel.org/stable/c/ab1150115e68a46b687eb38c1ab92782018c9f2c"
}
],
"title": "dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80902",
"datePublished": "2026-09-04T17:11:17.510Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:17.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80901 (GCVE-0-2026-80901)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
ipvs: fix the checksum validations
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix the checksum validations
ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6
packets from clients. In fact, as for TCP/UDP we should
validate the checksum for ICMP packets only when we
mangle the packets on MASQ or on reply for tunnel.
Also, Sashiko points out that handle_response_icmp() being
common for IPv4 and IPv6 is missing the pseudo-header
calculation while validating ICMPv6 messages from real
servers which is a problem if checksum is not validated
by the hardware.
Fix the problems by creating ip_vs_checksum_common_check()
helper and use it for TCP/UDP/ICMP both for IPv4 and IPv6.
Rely on the nf_checksum() for validating the ICMP messages
but use it also for TCP and UDP.
Use correct IP offset for IP_VS_DBG_RL_PKT for TCP/UDP/SCTP.
IPVS packets (TCP/UDP/SCTP/ICMP) do not need checksum
validation on LOCAL_OUT (local clients or local real
servers) and on FORWARD (traffic from servers on LAN).
Do it only on LOCAL_IN, in case nf_checksum() is not
called on PRE_ROUTING.
Also, ip_vs_checksum_complete() can be marked static.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2a3b791e6e1169f374224d164738e9f7be703d77 , < d418d73acf8be62744dc47359dfdde8c2148845d
(git)
Affected: 2a3b791e6e1169f374224d164738e9f7be703d77 , < b3869d9b54e76dff64118dee4c8fd9302fcd5171 (git) Affected: 2a3b791e6e1169f374224d164738e9f7be703d77 , < 9cbe2c0fdb71904ee929b1851cdc1c73341a03c0 (git) Affected: 2a3b791e6e1169f374224d164738e9f7be703d77 , < 00eb23829fd08df1b5e057cb6b625996a70e7e65 (git) Affected: 2a3b791e6e1169f374224d164738e9f7be703d77 , < 5558a85add073215b298f3e044ff9a6d86d714ae (git) Affected: 2a3b791e6e1169f374224d164738e9f7be703d77 , < e876b75b9020a97bbdc79721e7fc749024891c65 (git) |
|
| Linux | Linux |
Affected:
2.6.28
Unaffected: 0 , < 2.6.28 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ip_vs.h",
"net/netfilter/ipvs/ip_vs_core.c",
"net/netfilter/ipvs/ip_vs_proto_sctp.c",
"net/netfilter/ipvs/ip_vs_proto_tcp.c",
"net/netfilter/ipvs/ip_vs_proto_udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d418d73acf8be62744dc47359dfdde8c2148845d",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
},
{
"lessThan": "b3869d9b54e76dff64118dee4c8fd9302fcd5171",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
},
{
"lessThan": "9cbe2c0fdb71904ee929b1851cdc1c73341a03c0",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
},
{
"lessThan": "00eb23829fd08df1b5e057cb6b625996a70e7e65",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
},
{
"lessThan": "5558a85add073215b298f3e044ff9a6d86d714ae",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
},
{
"lessThan": "e876b75b9020a97bbdc79721e7fc749024891c65",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ip_vs.h",
"net/netfilter/ipvs/ip_vs_core.c",
"net/netfilter/ipvs/ip_vs_proto_sctp.c",
"net/netfilter/ipvs/ip_vs_proto_tcp.c",
"net/netfilter/ipvs/ip_vs_proto_udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix the checksum validations\n\nip_vs_in_icmp_v6() is missing checksum validation for ICMPv6\npackets from clients. In fact, as for TCP/UDP we should\nvalidate the checksum for ICMP packets only when we\nmangle the packets on MASQ or on reply for tunnel.\n\nAlso, Sashiko points out that handle_response_icmp() being\ncommon for IPv4 and IPv6 is missing the pseudo-header\ncalculation while validating ICMPv6 messages from real\nservers which is a problem if checksum is not validated\nby the hardware.\n\nFix the problems by creating ip_vs_checksum_common_check()\nhelper and use it for TCP/UDP/ICMP both for IPv4 and IPv6.\nRely on the nf_checksum() for validating the ICMP messages\nbut use it also for TCP and UDP.\n\nUse correct IP offset for IP_VS_DBG_RL_PKT for TCP/UDP/SCTP.\n\nIPVS packets (TCP/UDP/SCTP/ICMP) do not need checksum\nvalidation on LOCAL_OUT (local clients or local real\nservers) and on FORWARD (traffic from servers on LAN).\nDo it only on LOCAL_IN, in case nf_checksum() is not\ncalled on PRE_ROUTING.\n\nAlso, ip_vs_checksum_complete() can be marked static."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:15.780Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d418d73acf8be62744dc47359dfdde8c2148845d"
},
{
"url": "https://git.kernel.org/stable/c/b3869d9b54e76dff64118dee4c8fd9302fcd5171"
},
{
"url": "https://git.kernel.org/stable/c/9cbe2c0fdb71904ee929b1851cdc1c73341a03c0"
},
{
"url": "https://git.kernel.org/stable/c/00eb23829fd08df1b5e057cb6b625996a70e7e65"
},
{
"url": "https://git.kernel.org/stable/c/5558a85add073215b298f3e044ff9a6d86d714ae"
},
{
"url": "https://git.kernel.org/stable/c/e876b75b9020a97bbdc79721e7fc749024891c65"
}
],
"title": "ipvs: fix the checksum validations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80901",
"datePublished": "2026-09-04T17:11:15.780Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:15.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80900 (GCVE-0-2026-80900)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
ASoC: SDCA: Make UMP message size check more robust
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SDCA: Make UMP message size check more robust
If message offset was larger than the buffer length the size
check will pass incorrectly. Refactor the check such that it is
more robust to invalid sizes.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
daab108504be73182c16a72b9cfe47ac3b1928ca , < fe5c53a952970ba15be8f512babd922e273579de
(git)
Affected: daab108504be73182c16a72b9cfe47ac3b1928ca , < 556d872e7c2a0b570c5b0974813847ef0d0cd637 (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sdca/sdca_ump.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fe5c53a952970ba15be8f512babd922e273579de",
"status": "affected",
"version": "daab108504be73182c16a72b9cfe47ac3b1928ca",
"versionType": "git"
},
{
"lessThan": "556d872e7c2a0b570c5b0974813847ef0d0cd637",
"status": "affected",
"version": "daab108504be73182c16a72b9cfe47ac3b1928ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sdca/sdca_ump.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Make UMP message size check more robust\n\nIf message offset was larger than the buffer length the size\ncheck will pass incorrectly. Refactor the check such that it is\nmore robust to invalid sizes."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:14.939Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fe5c53a952970ba15be8f512babd922e273579de"
},
{
"url": "https://git.kernel.org/stable/c/556d872e7c2a0b570c5b0974813847ef0d0cd637"
}
],
"title": "ASoC: SDCA: Make UMP message size check more robust",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80900",
"datePublished": "2026-09-04T17:11:14.939Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:14.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80899 (GCVE-0-2026-80899)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-07 14:21
VLAI
EPSS
VEX
Title
erofs: remove fscache backend entirely
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: remove fscache backend entirely
EROFS over fscache was introduced to provide image lazy pulling
functionality. After the feature landed, the fscache subsystem made
netfs a new hard dependency, which is unexpected for a local filesystem
and has an kernel-defined caching hierarchy which could be inflexible
compared to the fanotify pre-content hooks. Therefore, this feature has
been deprecated for almost two years.
As EROFS file-backed mounts and fanotify pre-content hooks both upstream
for a while and already providing equivalent functionality (erofs-utils
has supported fanotify pre-content hooks), let's remove the fscache
backend now.
The main application of this feature is Nydus [1], and they plan to move
to use fanotify pre-content hooks in the near future too.
I hope this patch can be merged into Linux 7.2, which is also motivated
by newly found implementation issues [2][3] that are not worth
investigating given the deprecation and limited development resources.
The associated fscache/cachefiles cleanup patch will follow separately
through the vfs tree (netfs) later: it seems fine since the codebase is
isolated by CONFIG_CACHEFILES_ONDEMAND.
[1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md
[2] https://github.com/dragonflyoss/nydus/pull/1824
[3] https://lore.kernel.org/r/20260619135800.1594811-1-michael.bommarito@gmail.com
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a1bafc3109d713ed83f73d61ba5cb1e6fd80fdbc , < f6145794f17a27d25f8a84edb80731fb0e07c196
(git)
Affected: a1bafc3109d713ed83f73d61ba5cb1e6fd80fdbc , < c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56 (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Documentation/filesystems/erofs.rst",
"fs/erofs/Kconfig",
"fs/erofs/Makefile",
"fs/erofs/data.c",
"fs/erofs/fscache.c",
"fs/erofs/inode.c",
"fs/erofs/internal.h",
"fs/erofs/ishare.c",
"fs/erofs/super.c",
"fs/erofs/zdata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f6145794f17a27d25f8a84edb80731fb0e07c196",
"status": "affected",
"version": "a1bafc3109d713ed83f73d61ba5cb1e6fd80fdbc",
"versionType": "git"
},
{
"lessThan": "c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56",
"status": "affected",
"version": "a1bafc3109d713ed83f73d61ba5cb1e6fd80fdbc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Documentation/filesystems/erofs.rst",
"fs/erofs/Kconfig",
"fs/erofs/Makefile",
"fs/erofs/data.c",
"fs/erofs/fscache.c",
"fs/erofs/inode.c",
"fs/erofs/internal.h",
"fs/erofs/ishare.c",
"fs/erofs/super.c",
"fs/erofs/zdata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: remove fscache backend entirely\n\nEROFS over fscache was introduced to provide image lazy pulling\nfunctionality. After the feature landed, the fscache subsystem made\nnetfs a new hard dependency, which is unexpected for a local filesystem\nand has an kernel-defined caching hierarchy which could be inflexible\ncompared to the fanotify pre-content hooks. Therefore, this feature has\nbeen deprecated for almost two years.\n\nAs EROFS file-backed mounts and fanotify pre-content hooks both upstream\nfor a while and already providing equivalent functionality (erofs-utils\nhas supported fanotify pre-content hooks), let\u0027s remove the fscache\nbackend now.\n\nThe main application of this feature is Nydus [1], and they plan to move\nto use fanotify pre-content hooks in the near future too.\n\nI hope this patch can be merged into Linux 7.2, which is also motivated\nby newly found implementation issues [2][3] that are not worth\ninvestigating given the deprecation and limited development resources.\nThe associated fscache/cachefiles cleanup patch will follow separately\nthrough the vfs tree (netfs) later: it seems fine since the codebase is\nisolated by CONFIG_CACHEFILES_ONDEMAND.\n\n[1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md\n[2] https://github.com/dragonflyoss/nydus/pull/1824\n[3] https://lore.kernel.org/r/20260619135800.1594811-1-michael.bommarito@gmail.com"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T14:21:26.371Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f6145794f17a27d25f8a84edb80731fb0e07c196"
},
{
"url": "https://git.kernel.org/stable/c/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56"
}
],
"title": "erofs: remove fscache backend entirely",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80899",
"datePublished": "2026-09-04T17:11:14.158Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-07T14:21:26.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80898 (GCVE-0-2026-80898)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
netfs: clear PG_private_2 on copy-to-cache append failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: clear PG_private_2 on copy-to-cache append failure
netfs_pgpriv2_copy_to_cache() marks the folio with PG_private_2 before
netfs_pgpriv2_copy_folio() appends it to the copy-to-cache rolling
buffer.
If the append fails, the folio is not queued for cache writeback, so
the PG_private_2 state and its reference must be released immediately.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2d46f2ec332533816417b60933954173f602121 , < 627826ef4208042b0470d1a3fdb729ce35471a0d
(git)
Affected: e2d46f2ec332533816417b60933954173f602121 , < 614b7f4bfcf665a751ae89ff9ae336a1b2d5af4e (git) Affected: e2d46f2ec332533816417b60933954173f602121 , < a81fc9266e1c5fef9ccf675a9b44b2f4ab464923 (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/read_pgpriv2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "627826ef4208042b0470d1a3fdb729ce35471a0d",
"status": "affected",
"version": "e2d46f2ec332533816417b60933954173f602121",
"versionType": "git"
},
{
"lessThan": "614b7f4bfcf665a751ae89ff9ae336a1b2d5af4e",
"status": "affected",
"version": "e2d46f2ec332533816417b60933954173f602121",
"versionType": "git"
},
{
"lessThan": "a81fc9266e1c5fef9ccf675a9b44b2f4ab464923",
"status": "affected",
"version": "e2d46f2ec332533816417b60933954173f602121",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/read_pgpriv2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: clear PG_private_2 on copy-to-cache append failure\n\nnetfs_pgpriv2_copy_to_cache() marks the folio with PG_private_2 before\nnetfs_pgpriv2_copy_folio() appends it to the copy-to-cache rolling\nbuffer.\n\nIf the append fails, the folio is not queued for cache writeback, so\nthe PG_private_2 state and its reference must be released immediately."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:13.337Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/627826ef4208042b0470d1a3fdb729ce35471a0d"
},
{
"url": "https://git.kernel.org/stable/c/614b7f4bfcf665a751ae89ff9ae336a1b2d5af4e"
},
{
"url": "https://git.kernel.org/stable/c/a81fc9266e1c5fef9ccf675a9b44b2f4ab464923"
}
],
"title": "netfs: clear PG_private_2 on copy-to-cache append failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80898",
"datePublished": "2026-09-04T17:11:13.337Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:13.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80897 (GCVE-0-2026-80897)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
netfs: release readahead folios on iterator preparation failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: release readahead folios on iterator preparation failure
netfs_prepare_read_iterator() batches readahead folios in put_batch so that
the folio references can be dropped after the I/O iterator has been
prepared.
If rolling_buffer_load_from_ra() fails after earlier folios have been
batched, the function returns immediately and leaves those references held.
Release the batch before returning the error.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
06fa229ceb36898e68022b5654c017d2c6582d7d , < 2c148a31ca01fc160aceec777bbc0041b0d0b8bd
(git)
Affected: 06fa229ceb36898e68022b5654c017d2c6582d7d , < 935e7b74bb2368f215cf8c2ad4bff60ee4e7589e (git) Affected: 06fa229ceb36898e68022b5654c017d2c6582d7d , < 87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6 (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c148a31ca01fc160aceec777bbc0041b0d0b8bd",
"status": "affected",
"version": "06fa229ceb36898e68022b5654c017d2c6582d7d",
"versionType": "git"
},
{
"lessThan": "935e7b74bb2368f215cf8c2ad4bff60ee4e7589e",
"status": "affected",
"version": "06fa229ceb36898e68022b5654c017d2c6582d7d",
"versionType": "git"
},
{
"lessThan": "87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6",
"status": "affected",
"version": "06fa229ceb36898e68022b5654c017d2c6582d7d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: release readahead folios on iterator preparation failure\n\nnetfs_prepare_read_iterator() batches readahead folios in put_batch so that\nthe folio references can be dropped after the I/O iterator has been\nprepared.\n\nIf rolling_buffer_load_from_ra() fails after earlier folios have been\nbatched, the function returns immediately and leaves those references held.\nRelease the batch before returning the error."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:12.499Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c148a31ca01fc160aceec777bbc0041b0d0b8bd"
},
{
"url": "https://git.kernel.org/stable/c/935e7b74bb2368f215cf8c2ad4bff60ee4e7589e"
},
{
"url": "https://git.kernel.org/stable/c/87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6"
}
],
"title": "netfs: release readahead folios on iterator preparation failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80897",
"datePublished": "2026-09-04T17:11:12.499Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:12.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80896 (GCVE-0-2026-80896)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
mshv: Fix race in mshv_irqfd_deassign
Summary
In the Linux kernel, the following vulnerability has been resolved:
mshv: Fix race in mshv_irqfd_deassign
mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list
require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign()
omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(),
which does take the lock before calling mshv_irqfd_deactivate().
Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons
the node pointers rather than resetting them. Since
mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev ==
NULL), a poisoned node still appears active. If a concurrent path calls
mshv_irqfd_deactivate() again on the same irqfd, the guard fails to
prevent a double hlist_del() on poisoned pointers.
Fix both issues:
- Add the missing spin_lock_irq/spin_unlock_irq around the list
traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release().
- Use hlist_del_init() instead of hlist_del() so the node is properly
marked as unhashed after removal, making the is_active guard reliable.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
621191d709b14882270dfd8ea5d7d6cdfebe2c35 , < 72a90ce4918b5a2d4820fe20677ba9af780d8826
(git)
Affected: 621191d709b14882270dfd8ea5d7d6cdfebe2c35 , < 4529a41a675b96e0f876eef1cc93a31a57cb4d18 (git) Affected: 621191d709b14882270dfd8ea5d7d6cdfebe2c35 , < 0762262ac3e70f65b3bb843fe892f8bac1562d08 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hv/mshv_eventfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "72a90ce4918b5a2d4820fe20677ba9af780d8826",
"status": "affected",
"version": "621191d709b14882270dfd8ea5d7d6cdfebe2c35",
"versionType": "git"
},
{
"lessThan": "4529a41a675b96e0f876eef1cc93a31a57cb4d18",
"status": "affected",
"version": "621191d709b14882270dfd8ea5d7d6cdfebe2c35",
"versionType": "git"
},
{
"lessThan": "0762262ac3e70f65b3bb843fe892f8bac1562d08",
"status": "affected",
"version": "621191d709b14882270dfd8ea5d7d6cdfebe2c35",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hv/mshv_eventfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmshv: Fix race in mshv_irqfd_deassign\n\nmshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list\nrequire pt-\u003ept_irqfds_lock to be held, but mshv_irqfd_deassign()\nomits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(),\nwhich does take the lock before calling mshv_irqfd_deactivate().\n\nAdditionally, mshv_irqfd_deactivate() uses hlist_del() which poisons\nthe node pointers rather than resetting them. Since\nmshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev ==\nNULL), a poisoned node still appears active. If a concurrent path calls\nmshv_irqfd_deactivate() again on the same irqfd, the guard fails to\nprevent a double hlist_del() on poisoned pointers.\n\nFix both issues:\n- Add the missing spin_lock_irq/spin_unlock_irq around the list\n traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release().\n- Use hlist_del_init() instead of hlist_del() so the node is properly\n marked as unhashed after removal, making the is_active guard reliable."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:11.689Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/72a90ce4918b5a2d4820fe20677ba9af780d8826"
},
{
"url": "https://git.kernel.org/stable/c/4529a41a675b96e0f876eef1cc93a31a57cb4d18"
},
{
"url": "https://git.kernel.org/stable/c/0762262ac3e70f65b3bb843fe892f8bac1562d08"
}
],
"title": "mshv: Fix race in mshv_irqfd_deassign",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80896",
"datePublished": "2026-09-04T17:11:11.689Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:11.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}