Most recent entries from all

ALSA-2026:81552 — Important: kernel security update

Affected: AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra, AlmaLinux:9: kernel-64k-modules, AlmaLinux:9: kernel-64k-modules-core and 8 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309) * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925) * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508) * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507) * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236) * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278) * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245) * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123) * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318) * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887) * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970) * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811) * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-80887

Affected: Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

certfr-2026-avi-1232 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Certaines d'entre elles permettent à…

certfr-2026-avi-1232

fkie_cve-2026-80887

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: use check_add_overflow for shader size+offset bound

vmw_shader_define() validates the user-supplied shader window against its backing buffer with

(u64)buffer->tbo.base.size < (u64)size + (u64)offset

drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands.

Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.

GHSA-377r-p949-gf93

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: use check_add_overflow for shader size+offset bound

vmw_shader_define() validates the user-supplied shader window against its backing buffer with

(u64)buffer->tbo.base.size < (u64)size + (u64)offset

Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.

msrc_CVE-2026-80887 — drm/vmwgfx: use check_add_overflow for shader size+offset bound

msrc_CVE-2026-80887

RHSA-2026:81552 — Red Hat Security Advisory: kernel security update

kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise kernel: macsec: fix replay protection at XPN lower-PN wrap kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation kernel: bpf: Support for hardening against JIT spraying kernel: openvswitch: fix GSO userspace truncation underflow kernel: drm/amd/display: set new_stream to NULL after release kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation kernel: cifs: validate DFS referral string offsets kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension kernel: media: cx231xx: reject geometry changes while the VBI queue is busy kernel: nvmet-auth: Synchronize timeout work during SQ teardown

RLSA-2026:81552 — Important: kernel security update

Affected: Rocky Linux:9: kernel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)

* kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

* kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

* kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

* kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

* kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

* kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

* kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

* kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

* kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

* kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

* kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

* kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-80887

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 155 more

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.

WID-SEC-W-2026-3211 — Linux Kernel: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Speicherfehler und Kernel-Abstürze beziehungsweise Denial-of-Service-Zustände auszulösen, Speicher außerhalb vorgesehener Grenzen auszulesen sowie in einzelnen Fällen weitere Sicherheitsauswirkungen zu verursachen.