Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
15547 vulnerabilities found for Linux by Linux
CVE-2026-80913 (GCVE-0-2026-80913)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
selinux: require every boolean value to be defined
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: require every boolean value to be defined
p_bools.nprim comes from the policy image independently of how many
booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at
value - 1, so a count larger than the values present leaves NULL entries.
Every user of that array then walks it by index and dereferences each
entry: cond_evaluate_expr() on the access-vector path,
security_get_bools() and security_get_bool_value() behind selinuxfs, and
security_set_bools(). A sparse class value is absorbed by
policydb_class_isvalid() and its siblings; booleans have no such
predicate, and no consumer that could use one.
Reject a boolean value that no boolean defines, once, where the array is
built. Conforming policies define every boolean they declare and are
unaffected.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4d0ece18e648bd4362704fd087249ac697f2b7fb
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4dfb997c60f7951011d3dcbee926e3a7f80d8a76 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 740012aebdb8311332bf66e2aabf453ba73c2c45 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 42a7107f99d86a7524c37f108047dfa3db096ab5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a93d37a09b863810653f93d371fb197457d59deb (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/policydb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4d0ece18e648bd4362704fd087249ac697f2b7fb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4dfb997c60f7951011d3dcbee926e3a7f80d8a76",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "740012aebdb8311332bf66e2aabf453ba73c2c45",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "42a7107f99d86a7524c37f108047dfa3db096ab5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a93d37a09b863810653f93d371fb197457d59deb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/policydb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: require every boolean value to be defined\n\np_bools.nprim comes from the policy image independently of how many\nbooleans follow it, and cond_index_bool() fills bool_val_to_struct[] at\nvalue - 1, so a count larger than the values present leaves NULL entries.\nEvery user of that array then walks it by index and dereferences each\nentry: cond_evaluate_expr() on the access-vector path,\nsecurity_get_bools() and security_get_bool_value() behind selinuxfs, and\nsecurity_set_bools(). A sparse class value is absorbed by\npolicydb_class_isvalid() and its siblings; booleans have no such\npredicate, and no consumer that could use one.\n\nReject a boolean value that no boolean defines, once, where the array is\nbuilt. Conforming policies define every boolean they declare and are\nunaffected."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:23.975Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4d0ece18e648bd4362704fd087249ac697f2b7fb"
},
{
"url": "https://git.kernel.org/stable/c/3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8"
},
{
"url": "https://git.kernel.org/stable/c/4dfb997c60f7951011d3dcbee926e3a7f80d8a76"
},
{
"url": "https://git.kernel.org/stable/c/3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40"
},
{
"url": "https://git.kernel.org/stable/c/740012aebdb8311332bf66e2aabf453ba73c2c45"
},
{
"url": "https://git.kernel.org/stable/c/42a7107f99d86a7524c37f108047dfa3db096ab5"
},
{
"url": "https://git.kernel.org/stable/c/ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec"
},
{
"url": "https://git.kernel.org/stable/c/a93d37a09b863810653f93d371fb197457d59deb"
}
],
"title": "selinux: require every boolean value to be defined",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80913",
"datePublished": "2026-09-04T17:19:23.975Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-04T17:19:23.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80912 (GCVE-0-2026-80912)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
selinux: reject an unclaimed class value in security_get_classes()
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: reject an unclaimed class value in security_get_classes()
security_get_classes() sizes an array by p_classes.nprim and fills it at
value - 1, so a class value the policy never defines leaves a NULL.
sel_make_classes() passes every entry to sel_make_dir(), reaching the same
d_alloc_name() dereference as the permission array. The class symbol table
is allowed to be sparse (policydb_class_isvalid() exists to absorb that),
but this getter builds its own array straight from the hash table and has
no such predicate.
Fail the lookup when a value went unclaimed instead of handing out the
NULL. Conforming policies define every class they declare and are
unaffected.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < e0285bb152211c00900136b66d4b420c14a59094
(git)
Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 099869e9343a5f8c22b58497f074b34f63cbf856 (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 841aea4d5a25e16273d04cd07a74142b4687e03b (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < d8a10899ea3c84b80de72ca8ee9039e9a5156c9a (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd (git) |
|
| Linux | Linux |
Affected:
2.6.23
Unaffected: 0 , < 2.6.23 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/services.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e0285bb152211c00900136b66d4b420c14a59094",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "099869e9343a5f8c22b58497f074b34f63cbf856",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "841aea4d5a25e16273d04cd07a74142b4687e03b",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "d8a10899ea3c84b80de72ca8ee9039e9a5156c9a",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/services.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: reject an unclaimed class value in security_get_classes()\n\nsecurity_get_classes() sizes an array by p_classes.nprim and fills it at\nvalue - 1, so a class value the policy never defines leaves a NULL.\nsel_make_classes() passes every entry to sel_make_dir(), reaching the same\nd_alloc_name() dereference as the permission array. The class symbol table\nis allowed to be sparse (policydb_class_isvalid() exists to absorb that),\nbut this getter builds its own array straight from the hash table and has\nno such predicate.\n\nFail the lookup when a value went unclaimed instead of handing out the\nNULL. Conforming policies define every class they declare and are\nunaffected."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:23.066Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e0285bb152211c00900136b66d4b420c14a59094"
},
{
"url": "https://git.kernel.org/stable/c/099869e9343a5f8c22b58497f074b34f63cbf856"
},
{
"url": "https://git.kernel.org/stable/c/841aea4d5a25e16273d04cd07a74142b4687e03b"
},
{
"url": "https://git.kernel.org/stable/c/d8a10899ea3c84b80de72ca8ee9039e9a5156c9a"
},
{
"url": "https://git.kernel.org/stable/c/22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd"
}
],
"title": "selinux: reject an unclaimed class value in security_get_classes()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80912",
"datePublished": "2026-09-04T17:19:23.066Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-04T17:19:23.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80911 (GCVE-0-2026-80911)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
If either tplg_ops->dai_config or widget_kcontrol_setup fail during widget
setup we would double decrement the use_count of the widget because the
sof_widget_free_unlocked() would be called twice, similarly the core_put
would be invoked twice as well.
Since the use_count and core_put() is handled within the widget_free
function we need to return without falling through the pipe_widget_free
label.
The fixes tag is picked to the last change around this part of the code
which is adequately old enough for backporting purposes.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3c124f09b7ff0434b076a8dec1ed446a6170b549 , < b270ed327380428581bbcbd85707f62e942428d7
(git)
Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < c06995637f6a4667f2b540ac65315bfc8196a099 (git) Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < 8cba53b862e1437257ec206d303ff942684284f1 (git) Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < d48691e70d4a9434b71039d4ed12bb0df4601acf (git) Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < e780e4917d43683224812400fe3dc4816fceba75 (git) Affected: 6.6.13 , < 6.6.153 (semver) |
|
| Linux | Linux |
Affected:
6.7
Unaffected: 0 , < 6.7 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/sof-audio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b270ed327380428581bbcbd85707f62e942428d7",
"status": "affected",
"version": "3c124f09b7ff0434b076a8dec1ed446a6170b549",
"versionType": "git"
},
{
"lessThan": "c06995637f6a4667f2b540ac65315bfc8196a099",
"status": "affected",
"version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
"versionType": "git"
},
{
"lessThan": "8cba53b862e1437257ec206d303ff942684284f1",
"status": "affected",
"version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
"versionType": "git"
},
{
"lessThan": "d48691e70d4a9434b71039d4ed12bb0df4601acf",
"status": "affected",
"version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
"versionType": "git"
},
{
"lessThan": "e780e4917d43683224812400fe3dc4816fceba75",
"status": "affected",
"version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
"versionType": "git"
},
{
"lessThan": "6.6.153",
"status": "affected",
"version": "6.6.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/sof-audio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "6.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()\n\nIf either tplg_ops-\u003edai_config or widget_kcontrol_setup fail during widget\nsetup we would double decrement the use_count of the widget because the\nsof_widget_free_unlocked() would be called twice, similarly the core_put\nwould be invoked twice as well.\n\nSince the use_count and core_put() is handled within the widget_free\nfunction we need to return without falling through the pipe_widget_free\nlabel.\n\nThe fixes tag is picked to the last change around this part of the code\nwhich is adequately old enough for backporting purposes."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:22.045Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b270ed327380428581bbcbd85707f62e942428d7"
},
{
"url": "https://git.kernel.org/stable/c/c06995637f6a4667f2b540ac65315bfc8196a099"
},
{
"url": "https://git.kernel.org/stable/c/8cba53b862e1437257ec206d303ff942684284f1"
},
{
"url": "https://git.kernel.org/stable/c/d48691e70d4a9434b71039d4ed12bb0df4601acf"
},
{
"url": "https://git.kernel.org/stable/c/e780e4917d43683224812400fe3dc4816fceba75"
}
],
"title": "ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80911",
"datePublished": "2026-09-04T17:19:22.045Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-04T17:19:22.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80910 (GCVE-0-2026-80910)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated,
but their get and put callbacks access the value through
ucontrol->value.integer.value[0] (a long) instead of
ucontrol->value.enumerated.item[0] (an unsigned int).
This same pattern was fixed in the sibling drivers by
commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array
out of bounds for enum type") and
commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array
out of bounds for enum type"), but wsa-macro was missed.
On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value
sanity check and every read of these controls fails with -EINVAL.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
809bcbcecebff86003e13f07444d21b9d6652a64 , < bd4e5f9c3b764dc0e2a5662f92d63d2f3767a78d
(git)
Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 4bcac4bf304a3ec746192e49a669c236aaf27dbf (git) Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 891129df5de79cd533ae335c6eab24df2ff2b0fd (git) Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 524aa7b9954b0a43dd13f71ecbbac52a151c326d (git) Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 2fe7a89b2b5b73be35c1e493d0246314ba54e427 (git) Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 7bcdde412e6c744f6135e02b12a735e2e37b639f (git) Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 56f24311fd5607588a47e44675195a9efb200f29 (git) |
|
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/lpass-wsa-macro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bd4e5f9c3b764dc0e2a5662f92d63d2f3767a78d",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "4bcac4bf304a3ec746192e49a669c236aaf27dbf",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "891129df5de79cd533ae335c6eab24df2ff2b0fd",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "524aa7b9954b0a43dd13f71ecbbac52a151c326d",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "2fe7a89b2b5b73be35c1e493d0246314ba54e427",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "7bcdde412e6c744f6135e02b12a735e2e37b639f",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
},
{
"lessThan": "56f24311fd5607588a47e44675195a9efb200f29",
"status": "affected",
"version": "809bcbcecebff86003e13f07444d21b9d6652a64",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/lpass-wsa-macro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses\n\nEAR SPKR PA Gain\" and the four \"WSA RX* Mux\" controls are enumerated,\nbut their get and put callbacks access the value through\nucontrol-\u003evalue.integer.value[0] (a long) instead of\nucontrol-\u003evalue.enumerated.item[0] (an unsigned int).\n\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but wsa-macro was missed.\n\nOn 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value\nsanity check and every read of these controls fails with -EINVAL."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:21.079Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bd4e5f9c3b764dc0e2a5662f92d63d2f3767a78d"
},
{
"url": "https://git.kernel.org/stable/c/4bcac4bf304a3ec746192e49a669c236aaf27dbf"
},
{
"url": "https://git.kernel.org/stable/c/891129df5de79cd533ae335c6eab24df2ff2b0fd"
},
{
"url": "https://git.kernel.org/stable/c/524aa7b9954b0a43dd13f71ecbbac52a151c326d"
},
{
"url": "https://git.kernel.org/stable/c/2fe7a89b2b5b73be35c1e493d0246314ba54e427"
},
{
"url": "https://git.kernel.org/stable/c/7bcdde412e6c744f6135e02b12a735e2e37b639f"
},
{
"url": "https://git.kernel.org/stable/c/56f24311fd5607588a47e44675195a9efb200f29"
}
],
"title": "ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80910",
"datePublished": "2026-09-04T17:19:21.079Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-04T17:19:21.079Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80909 (GCVE-0-2026-80909)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Same change as for h264, avoids overflow later when calculating
min dpb size.
(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1facad2a78c1a8aeecc36eb4d560c7f1e10ce198
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 499907e5d46e575e96967c0230a0a6af980a17ab (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cbf1c84bf5cac2b3742ea3d2085fa713424465cc (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a930c54cb67200de8bc0de87480d09ece7dcd85d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2abcdc5f738574e7fcdd9417575dffb877fdc26f (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e304c3e0d9ce251887be1f274aa0ed52219d5fd7 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0acdf1a575f59bd46717d5c487d84575af5bee8f (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9fca434208f1f9ab977feac62df8ebb1cc7ce893 (git) Affected: 0 , < 5.10.266 (semver) Affected: 0 , < 5.15.217 (semver) Affected: 0 , < 6.1.184 (semver) Affected: 0 , < 6.6.153 (semver) Affected: 0 , < 6.12.105 (semver) Affected: 0 , < 6.18.46 (semver) Affected: 0 , < 7.1.10 (semver) |
|
| Linux | Linux |
Unaffected:
5.10.266 , ≤ 5.10.*
(semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1facad2a78c1a8aeecc36eb4d560c7f1e10ce198",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "499907e5d46e575e96967c0230a0a6af980a17ab",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cbf1c84bf5cac2b3742ea3d2085fa713424465cc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a930c54cb67200de8bc0de87480d09ece7dcd85d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2abcdc5f738574e7fcdd9417575dffb877fdc26f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e304c3e0d9ce251887be1f274aa0ed52219d5fd7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0acdf1a575f59bd46717d5c487d84575af5bee8f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9fca434208f1f9ab977feac62df8ebb1cc7ce893",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5.10.266",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.15.217",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.1.184",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.6.153",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.105",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.46",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Reject UVD message with invalid number of h265 refs\n\nSame change as for h264, avoids overflow later when calculating\nmin dpb size.\n\n(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:20.085Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1facad2a78c1a8aeecc36eb4d560c7f1e10ce198"
},
{
"url": "https://git.kernel.org/stable/c/499907e5d46e575e96967c0230a0a6af980a17ab"
},
{
"url": "https://git.kernel.org/stable/c/cbf1c84bf5cac2b3742ea3d2085fa713424465cc"
},
{
"url": "https://git.kernel.org/stable/c/a930c54cb67200de8bc0de87480d09ece7dcd85d"
},
{
"url": "https://git.kernel.org/stable/c/2abcdc5f738574e7fcdd9417575dffb877fdc26f"
},
{
"url": "https://git.kernel.org/stable/c/e304c3e0d9ce251887be1f274aa0ed52219d5fd7"
},
{
"url": "https://git.kernel.org/stable/c/0acdf1a575f59bd46717d5c487d84575af5bee8f"
},
{
"url": "https://git.kernel.org/stable/c/9fca434208f1f9ab977feac62df8ebb1cc7ce893"
}
],
"title": "drm/amdgpu: Reject UVD message with invalid number of h265 refs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80909",
"datePublished": "2026-09-04T17:19:20.085Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-04T17:19:20.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80908 (GCVE-0-2026-80908)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
drm/amdgpu: Reject UVD message with dimensions above 4096
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Reject UVD message with dimensions above 4096
Fixes potential overflow in DPB size calculations.
(cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8bae80eaed00e7ae28412a3cdf590f4beca72294
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9adc5e25f31d7ee7dfc18814499b6e3a6d402904 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 382bef781ff441ce8055bdada57b8c291dc0fd30 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8435d41afcf2bc31ecee213ef651c12bd1a16d38 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f7af372d3b892b95dd3cd1c6acf29daa39ba076d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 339deb76ee4859ea973e435c9a9a4a4fefc29338 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 17fbb996c05f2190e0fa20927ca0b9804d481b02 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8c9aebcdd9f46f7a14b98d6ab18574b7a48fbb08 (git) Affected: 0 , < 5.10.266 (semver) Affected: 0 , < 5.15.217 (semver) Affected: 0 , < 6.1.184 (semver) Affected: 0 , < 6.6.153 (semver) Affected: 0 , < 6.12.105 (semver) Affected: 0 , < 6.18.46 (semver) Affected: 0 , < 7.1.10 (semver) |
|
| Linux | Linux |
Unaffected:
5.10.266 , ≤ 5.10.*
(semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8bae80eaed00e7ae28412a3cdf590f4beca72294",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9adc5e25f31d7ee7dfc18814499b6e3a6d402904",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "382bef781ff441ce8055bdada57b8c291dc0fd30",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8435d41afcf2bc31ecee213ef651c12bd1a16d38",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f7af372d3b892b95dd3cd1c6acf29daa39ba076d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "339deb76ee4859ea973e435c9a9a4a4fefc29338",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "17fbb996c05f2190e0fa20927ca0b9804d481b02",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8c9aebcdd9f46f7a14b98d6ab18574b7a48fbb08",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5.10.266",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.15.217",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.1.184",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.6.153",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.105",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.46",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Reject UVD message with dimensions above 4096\n\nFixes potential overflow in DPB size calculations.\n\n(cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:19.155Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8bae80eaed00e7ae28412a3cdf590f4beca72294"
},
{
"url": "https://git.kernel.org/stable/c/9adc5e25f31d7ee7dfc18814499b6e3a6d402904"
},
{
"url": "https://git.kernel.org/stable/c/382bef781ff441ce8055bdada57b8c291dc0fd30"
},
{
"url": "https://git.kernel.org/stable/c/8435d41afcf2bc31ecee213ef651c12bd1a16d38"
},
{
"url": "https://git.kernel.org/stable/c/f7af372d3b892b95dd3cd1c6acf29daa39ba076d"
},
{
"url": "https://git.kernel.org/stable/c/339deb76ee4859ea973e435c9a9a4a4fefc29338"
},
{
"url": "https://git.kernel.org/stable/c/17fbb996c05f2190e0fa20927ca0b9804d481b02"
},
{
"url": "https://git.kernel.org/stable/c/8c9aebcdd9f46f7a14b98d6ab18574b7a48fbb08"
}
],
"title": "drm/amdgpu: Reject UVD message with dimensions above 4096",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80908",
"datePublished": "2026-09-04T17:19:19.155Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-04T17:19:19.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80907 (GCVE-0-2026-80907)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
drm/amdgpu: Fix UVD dpb min size calculation for H264
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix UVD dpb min size calculation for H264
This should use actual number of references from the decode
message, instead of maximum derived from level.
(cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fa96c24485942e277483cc70d9551d9e0111d7c5
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 33f4ef585368fe93523dca1e5440e006f6e5146e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 38914cb2c6afb5fe00241ea3438e655822196378 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ff4361816b6ba4bd29b548b17d993056a1ae2502 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 21a8084cd76223a13493237e04d45f5226d7cee6 (git) Affected: 0 , < 6.6.153 (semver) Affected: 0 , < 6.12.105 (semver) Affected: 0 , < 6.18.46 (semver) Affected: 0 , < 7.1.10 (semver) |
|
| Linux | Linux |
Unaffected:
6.6.153 , ≤ 6.6.*
(semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fa96c24485942e277483cc70d9551d9e0111d7c5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "33f4ef585368fe93523dca1e5440e006f6e5146e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "38914cb2c6afb5fe00241ea3438e655822196378",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ff4361816b6ba4bd29b548b17d993056a1ae2502",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "21a8084cd76223a13493237e04d45f5226d7cee6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.6.153",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.105",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.46",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix UVD dpb min size calculation for H264\n\nThis should use actual number of references from the decode\nmessage, instead of maximum derived from level.\n\n(cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:18.052Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fa96c24485942e277483cc70d9551d9e0111d7c5"
},
{
"url": "https://git.kernel.org/stable/c/33f4ef585368fe93523dca1e5440e006f6e5146e"
},
{
"url": "https://git.kernel.org/stable/c/38914cb2c6afb5fe00241ea3438e655822196378"
},
{
"url": "https://git.kernel.org/stable/c/ff4361816b6ba4bd29b548b17d993056a1ae2502"
},
{
"url": "https://git.kernel.org/stable/c/21a8084cd76223a13493237e04d45f5226d7cee6"
}
],
"title": "drm/amdgpu: Fix UVD dpb min size calculation for H264",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80907",
"datePublished": "2026-09-04T17:19:18.052Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:19:18.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80906 (GCVE-0-2026-80906)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
net: packet: fix wrong transport_header when sending VLAN-tagged frame
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: packet: fix wrong transport_header when sending VLAN-tagged frame
In packet_parse_headers(), when processing a VLAN-tagged frame,
skb_set_network_header() is called to advance network_header past the
VLAN tag to the inner protocol header. skb_probe_transport_header() is
then called with skb->protocol still set to the outer VLAN EtherType
(e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset())
already points past the VLAN tag to the inner protocol header.
In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff
points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it
reads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that
offset contains the inner protocol header (e.g. an IP header). The bytes
are misinterpreted as a VLAN header, yielding a garbage encapsulated
EtherType that matches no known protocol. The dissector returns false,
so skb_probe_transport_header() never calls skb_set_transport_header(),
leaving transport_header at its uninitialized sentinel value (~0U).
Move skb_probe_transport_header() to before skb_set_network_header(). At
the time skb_probe_transport_header() is called, network_header still
points to the VLAN header, so nhoff correctly points to the VLAN header.
The flow dissector can then parse the VLAN header, extract the inner
EtherType, and advance nhoff to the inner protocol header, allowing
transport_header to be set correctly.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c2137d565ceb505de69593c181a0543bc4083838 , < a4b82de96d465ddb44bc931145c0fa80c4fe9c9c
(git)
Affected: 9ff46c36df2e0a1ac352f2f4038eaf3f0f7361b8 , < fa86bc52ea8ba981f74f851fd61e2a3d3bc0feac (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < 5479eb9b355f44745d7ccfe112386bd4f96eceea (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < e451e20adb869a983a21dda158625f024142e61f (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < 6971cf319263d6a1b4096f9248aca9e57d77a1eb (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < f9297abbcaba760b7a7b9d63b839f607f738013e (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < 6386a6ffa2efba2965ed8e4fa303582c0b76a215 (git) Affected: dfed913e8b55a0c2c4906f1242fd38fd9a116e49 , < 01fdecc0480d916c799dbee584833a4a37e94d06 (git) Affected: ad3f90a9c4a2c74bb3711f2031bffda4ec44c849 (git) Affected: 5.10.163 , < 5.10.266 (semver) Affected: 5.15.87 , < 5.15.217 (semver) Affected: 5.4.229 , < 5.5 (semver) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a4b82de96d465ddb44bc931145c0fa80c4fe9c9c",
"status": "affected",
"version": "c2137d565ceb505de69593c181a0543bc4083838",
"versionType": "git"
},
{
"lessThan": "fa86bc52ea8ba981f74f851fd61e2a3d3bc0feac",
"status": "affected",
"version": "9ff46c36df2e0a1ac352f2f4038eaf3f0f7361b8",
"versionType": "git"
},
{
"lessThan": "5479eb9b355f44745d7ccfe112386bd4f96eceea",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"lessThan": "e451e20adb869a983a21dda158625f024142e61f",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"lessThan": "6971cf319263d6a1b4096f9248aca9e57d77a1eb",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"lessThan": "f9297abbcaba760b7a7b9d63b839f607f738013e",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"lessThan": "6386a6ffa2efba2965ed8e4fa303582c0b76a215",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"lessThan": "01fdecc0480d916c799dbee584833a4a37e94d06",
"status": "affected",
"version": "dfed913e8b55a0c2c4906f1242fd38fd9a116e49",
"versionType": "git"
},
{
"status": "affected",
"version": "ad3f90a9c4a2c74bb3711f2031bffda4ec44c849",
"versionType": "git"
},
{
"lessThan": "5.10.266",
"status": "affected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThan": "5.15.217",
"status": "affected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.229",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.10.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.15.87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.229",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: packet: fix wrong transport_header when sending VLAN-tagged frame\n\nIn packet_parse_headers(), when processing a VLAN-tagged frame,\nskb_set_network_header() is called to advance network_header past the\nVLAN tag to the inner protocol header. skb_probe_transport_header() is\nthen called with skb-\u003eprotocol still set to the outer VLAN EtherType\n(e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset())\nalready points past the VLAN tag to the inner protocol header.\n\nIn __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff\npoints past the VLAN tag. When the dissector hits case ETH_P_8021Q, it\nreads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that\noffset contains the inner protocol header (e.g. an IP header). The bytes\nare misinterpreted as a VLAN header, yielding a garbage encapsulated\nEtherType that matches no known protocol. The dissector returns false,\nso skb_probe_transport_header() never calls skb_set_transport_header(),\nleaving transport_header at its uninitialized sentinel value (~0U).\n\nMove skb_probe_transport_header() to before skb_set_network_header(). At\nthe time skb_probe_transport_header() is called, network_header still\npoints to the VLAN header, so nhoff correctly points to the VLAN header.\nThe flow dissector can then parse the VLAN header, extract the inner\nEtherType, and advance nhoff to the inner protocol header, allowing\ntransport_header to be set correctly."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:16.531Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a4b82de96d465ddb44bc931145c0fa80c4fe9c9c"
},
{
"url": "https://git.kernel.org/stable/c/fa86bc52ea8ba981f74f851fd61e2a3d3bc0feac"
},
{
"url": "https://git.kernel.org/stable/c/5479eb9b355f44745d7ccfe112386bd4f96eceea"
},
{
"url": "https://git.kernel.org/stable/c/e451e20adb869a983a21dda158625f024142e61f"
},
{
"url": "https://git.kernel.org/stable/c/6971cf319263d6a1b4096f9248aca9e57d77a1eb"
},
{
"url": "https://git.kernel.org/stable/c/f9297abbcaba760b7a7b9d63b839f607f738013e"
},
{
"url": "https://git.kernel.org/stable/c/6386a6ffa2efba2965ed8e4fa303582c0b76a215"
},
{
"url": "https://git.kernel.org/stable/c/01fdecc0480d916c799dbee584833a4a37e94d06"
}
],
"title": "net: packet: fix wrong transport_header when sending VLAN-tagged frame",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80906",
"datePublished": "2026-09-04T17:19:16.531Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:19:16.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80905 (GCVE-0-2026-80905)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
net: tap: fix wrong transport_header when sending VLAN-tagged frame
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: tap: fix wrong transport_header when sending VLAN-tagged frame
In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g.
ETH_P_8021Q), skb_set_network_header() is called first to advance
network_header past the VLAN tag to the inner protocol header.
skb_probe_transport_header() is then called with skb->protocol still
set to ETH_P_8021Q, while nhoff (derived from skb_network_offset())
already points past the VLAN tag to the inner protocol header.
In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff
points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it
reads a struct vlan_hdr at the current nhoff via __skb_header_pointer(),
but that offset contains the inner protocol header (e.g. an IP header).
The bytes are misinterpreted as a VLAN header, yielding a garbage
encapsulated EtherType that matches no known protocol. The dissector
returns false, so skb_probe_transport_header() never calls
skb_set_transport_header(), leaving transport_header at its uninitialized
sentinel value (~0U).
Move skb_set_network_header() to after skb_probe_transport_header(). At
the time skb_probe_transport_header() is called, network_header still
points to the VLAN header (offset ETH_HLEN), so nhoff is correct and the
flow dissector can parse the VLAN header, extract the inner EtherType,
and advance nhoff to the inner protocol header, allowing transport_header
to be set correctly.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8c76e77f9069f10505c08e02646c3ee11ad79038 , < 5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b
(git)
Affected: 8c76e77f9069f10505c08e02646c3ee11ad79038 , < 88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3 (git) Affected: 8c76e77f9069f10505c08e02646c3ee11ad79038 , < cbb35cbe8db268fefe34c23df15348cf99025298 (git) Affected: 3cae5ef1f37a475faf7c40bc6a3c170779f3e0b1 (git) Affected: 4.20.1 , < 4.21 (semver) |
|
| Linux | Linux |
Affected:
5.0
Unaffected: 0 , < 5.0 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/tap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"lessThan": "88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"lessThan": "cbb35cbe8db268fefe34c23df15348cf99025298",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"status": "affected",
"version": "3cae5ef1f37a475faf7c40bc6a3c170779f3e0b1",
"versionType": "git"
},
{
"lessThan": "4.21",
"status": "affected",
"version": "4.20.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/tap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.20.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tap: fix wrong transport_header when sending VLAN-tagged frame\n\nIn tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g.\nETH_P_8021Q), skb_set_network_header() is called first to advance\nnetwork_header past the VLAN tag to the inner protocol header.\nskb_probe_transport_header() is then called with skb-\u003eprotocol still\nset to ETH_P_8021Q, while nhoff (derived from skb_network_offset())\nalready points past the VLAN tag to the inner protocol header.\n\nIn __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff\npoints past the VLAN tag. When the dissector hits case ETH_P_8021Q, it\nreads a struct vlan_hdr at the current nhoff via __skb_header_pointer(),\nbut that offset contains the inner protocol header (e.g. an IP header).\nThe bytes are misinterpreted as a VLAN header, yielding a garbage\nencapsulated EtherType that matches no known protocol. The dissector\nreturns false, so skb_probe_transport_header() never calls\nskb_set_transport_header(), leaving transport_header at its uninitialized\nsentinel value (~0U).\n\nMove skb_set_network_header() to after skb_probe_transport_header(). At\nthe time skb_probe_transport_header() is called, network_header still\npoints to the VLAN header (offset ETH_HLEN), so nhoff is correct and the\nflow dissector can parse the VLAN header, extract the inner EtherType,\nand advance nhoff to the inner protocol header, allowing transport_header\nto be set correctly."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:15.289Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b"
},
{
"url": "https://git.kernel.org/stable/c/88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3"
},
{
"url": "https://git.kernel.org/stable/c/cbb35cbe8db268fefe34c23df15348cf99025298"
}
],
"title": "net: tap: fix wrong transport_header when sending VLAN-tagged frame",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80905",
"datePublished": "2026-09-04T17:19:15.289Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:19:15.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80904 (GCVE-0-2026-80904)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
When an async decrypt fails, tls_decrypt_done() records the error in
ctx->async_wait.err and calls tls_err_abort(), which stores it in
sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read
async_wait.err once they hold the reader lock and fail the call: a
record that did not authenticate breaks the connection.
tls_sw_splice_read() has no such check, and sk_err does not stand in
for one. tls_rx_rec_wait() tests sk_err only inside the loop it
skips whenever a record is already parsed, and the first reader to
reach sock_error() clears it, while async_wait.err persists. A
splice therefore keeps delivering records on a connection that
recvmsg() and read_sock() refuse to read.
Read async_wait.err in tls_sw_splice_read() as the other two readers
do.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f314bfee81b1bf8e01168177b2f65f24eb8da63a , < a808aadff634c7a408b2ab84d5919e9a741fdb5b
(git)
Affected: f314bfee81b1bf8e01168177b2f65f24eb8da63a , < 06c2a53604fa1dc4820063828d7dadb3675b7af8 (git) Affected: f314bfee81b1bf8e01168177b2f65f24eb8da63a , < 18ae1e95f20867106a28820c208a9cec99dda861 (git) Affected: f314bfee81b1bf8e01168177b2f65f24eb8da63a , < 82d9269f01ebfd835b6256aa17016a974cbbc647 (git) Affected: f314bfee81b1bf8e01168177b2f65f24eb8da63a , < 4b177911eb9f799e9841c2f87c75b08cb112757a (git) Affected: f314bfee81b1bf8e01168177b2f65f24eb8da63a , < 976df67f463db1fddaf2a32fb04f57ad2891a23d (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a808aadff634c7a408b2ab84d5919e9a741fdb5b",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
},
{
"lessThan": "06c2a53604fa1dc4820063828d7dadb3675b7af8",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
},
{
"lessThan": "18ae1e95f20867106a28820c208a9cec99dda861",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
},
{
"lessThan": "82d9269f01ebfd835b6256aa17016a974cbbc647",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
},
{
"lessThan": "4b177911eb9f799e9841c2f87c75b08cb112757a",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
},
{
"lessThan": "976df67f463db1fddaf2a32fb04f57ad2891a23d",
"status": "affected",
"version": "f314bfee81b1bf8e01168177b2f65f24eb8da63a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: Fail tls_sw_splice_read() after a failed async decrypt\n\nWhen an async decrypt fails, tls_decrypt_done() records the error in\nctx-\u003easync_wait.err and calls tls_err_abort(), which stores it in\nsk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read\nasync_wait.err once they hold the reader lock and fail the call: a\nrecord that did not authenticate breaks the connection.\n\ntls_sw_splice_read() has no such check, and sk_err does not stand in\nfor one. tls_rx_rec_wait() tests sk_err only inside the loop it\nskips whenever a record is already parsed, and the first reader to\nreach sock_error() clears it, while async_wait.err persists. A\nsplice therefore keeps delivering records on a connection that\nrecvmsg() and read_sock() refuse to read.\n\nRead async_wait.err in tls_sw_splice_read() as the other two readers\ndo."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:14.391Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a808aadff634c7a408b2ab84d5919e9a741fdb5b"
},
{
"url": "https://git.kernel.org/stable/c/06c2a53604fa1dc4820063828d7dadb3675b7af8"
},
{
"url": "https://git.kernel.org/stable/c/18ae1e95f20867106a28820c208a9cec99dda861"
},
{
"url": "https://git.kernel.org/stable/c/82d9269f01ebfd835b6256aa17016a974cbbc647"
},
{
"url": "https://git.kernel.org/stable/c/4b177911eb9f799e9841c2f87c75b08cb112757a"
},
{
"url": "https://git.kernel.org/stable/c/976df67f463db1fddaf2a32fb04f57ad2891a23d"
}
],
"title": "net/tls: Fail tls_sw_splice_read() after a failed async decrypt",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80904",
"datePublished": "2026-09-04T17:19:14.391Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:19:14.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80903 (GCVE-0-2026-80903)
Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
VLAI
EPSS
VEX
Title
drm/xe/oa: Fix sync entry leak on OA config emit failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Fix sync entry leak on OA config emit failure
xe_oa_emit_oa_config() releases the sync entries and the syncs array
only on its success path. When it fails before the point of no return
(fence allocation, config buffer allocation or batch submission), it
returns without touching stream->syncs.
The stream open path handles such failures in the caller, but
xe_oa_config_locked() propagates the error without any cleanup, so the
syncs array and the fence references held by the parsed entries are
leaked. The next config ioctl overwrites stream->syncs, making the
memory unreachable for good.
Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching
the cleanup done by the stream open error path.
(cherry picked from commit 8af97b3da2cfce04e6b457c6eb17ed3c1daf912b)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f0ab9cd205d852a9024b73c71c8d8b217a04e8f0 , < fcf7943b0a38568c547d7b5702de1d8190480616
(git)
Affected: 9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0 , < 948f346fe36e1d02353c3d61b1f6b66c6af91996 (git) Affected: 9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0 , < 027150e24e173a5dffe7f5ab3a6600618f634da2 (git) Affected: 9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0 , < 8d33c4987cd162527375a3905017ae129ba7c3fe (git) Affected: 6.12.18 , < 6.12.105 (semver) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_oa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fcf7943b0a38568c547d7b5702de1d8190480616",
"status": "affected",
"version": "f0ab9cd205d852a9024b73c71c8d8b217a04e8f0",
"versionType": "git"
},
{
"lessThan": "948f346fe36e1d02353c3d61b1f6b66c6af91996",
"status": "affected",
"version": "9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0",
"versionType": "git"
},
{
"lessThan": "027150e24e173a5dffe7f5ab3a6600618f634da2",
"status": "affected",
"version": "9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0",
"versionType": "git"
},
{
"lessThan": "8d33c4987cd162527375a3905017ae129ba7c3fe",
"status": "affected",
"version": "9920c8b88c5cf2e44f4ff508dd3c0c96e4364db0",
"versionType": "git"
},
{
"lessThan": "6.12.105",
"status": "affected",
"version": "6.12.18",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_oa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.12.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix sync entry leak on OA config emit failure\n\nxe_oa_emit_oa_config() releases the sync entries and the syncs array\nonly on its success path. When it fails before the point of no return\n(fence allocation, config buffer allocation or batch submission), it\nreturns without touching stream-\u003esyncs.\n\nThe stream open path handles such failures in the caller, but\nxe_oa_config_locked() propagates the error without any cleanup, so the\nsyncs array and the fence references held by the parsed entries are\nleaked. The next config ioctl overwrites stream-\u003esyncs, making the\nmemory unreachable for good.\n\nClean up the parsed syncs when xe_oa_emit_oa_config() fails, matching\nthe cleanup done by the stream open error path.\n\n(cherry picked from commit 8af97b3da2cfce04e6b457c6eb17ed3c1daf912b)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:19:13.464Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fcf7943b0a38568c547d7b5702de1d8190480616"
},
{
"url": "https://git.kernel.org/stable/c/948f346fe36e1d02353c3d61b1f6b66c6af91996"
},
{
"url": "https://git.kernel.org/stable/c/027150e24e173a5dffe7f5ab3a6600618f634da2"
},
{
"url": "https://git.kernel.org/stable/c/8d33c4987cd162527375a3905017ae129ba7c3fe"
}
],
"title": "drm/xe/oa: Fix sync entry leak on OA config emit failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80903",
"datePublished": "2026-09-04T17:19:13.464Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:19:13.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80902 (GCVE-0-2026-80902)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
When terminating DMA transfers, active descriptors are not properly
reclaimed. Only cyclic descriptors were handled, leaving non-cyclic
descriptors and their LLI chains to be permanently leaked.
Fix by using vchan_terminate_vdesc() which handles both cyclic and
non-cyclic descriptors by adding them to desc_terminated queue for
proper cleanup.
Add pchan->desc != pchan->done check to prevent double-adding completed
descriptors, which would corrupt the list.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
555859308723d8d5b828304f5eb9281143fd86b5 , < bb87440561eb72b47a2b848b5373b86433b247e6
(git)
Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < 004a7a02982bed0a727a4ac7be400f00f353e7a2 (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < b150f603083cc8b72b0cbf13ec3e91f85b4390a0 (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < 27806fe7b9701af0963dcd510e30e7d0cc314c43 (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < 1ccc5c059d067c5358682ad5352e7d7e9239ed9b (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < 9086b488f2737d5dcee86852b83f2059f1cdfabf (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < d4ba6aa65fcd797152d3aebd428a7b2da49cd5eb (git) Affected: 555859308723d8d5b828304f5eb9281143fd86b5 , < ab1150115e68a46b687eb38c1ab92782018c9f2c (git) |
|
| Linux | Linux |
Affected:
3.17
Unaffected: 0 , < 3.17 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/sun6i-dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb87440561eb72b47a2b848b5373b86433b247e6",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "004a7a02982bed0a727a4ac7be400f00f353e7a2",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "b150f603083cc8b72b0cbf13ec3e91f85b4390a0",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "27806fe7b9701af0963dcd510e30e7d0cc314c43",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "1ccc5c059d067c5358682ad5352e7d7e9239ed9b",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "9086b488f2737d5dcee86852b83f2059f1cdfabf",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "d4ba6aa65fcd797152d3aebd428a7b2da49cd5eb",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
},
{
"lessThan": "ab1150115e68a46b687eb38c1ab92782018c9f2c",
"status": "affected",
"version": "555859308723d8d5b828304f5eb9281143fd86b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/sun6i-dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA\n\nWhen terminating DMA transfers, active descriptors are not properly\nreclaimed. Only cyclic descriptors were handled, leaving non-cyclic\ndescriptors and their LLI chains to be permanently leaked.\n\nFix by using vchan_terminate_vdesc() which handles both cyclic and\nnon-cyclic descriptors by adding them to desc_terminated queue for\nproper cleanup.\n\nAdd pchan-\u003edesc != pchan-\u003edone check to prevent double-adding completed\ndescriptors, which would corrupt the list."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:17.510Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb87440561eb72b47a2b848b5373b86433b247e6"
},
{
"url": "https://git.kernel.org/stable/c/004a7a02982bed0a727a4ac7be400f00f353e7a2"
},
{
"url": "https://git.kernel.org/stable/c/b150f603083cc8b72b0cbf13ec3e91f85b4390a0"
},
{
"url": "https://git.kernel.org/stable/c/27806fe7b9701af0963dcd510e30e7d0cc314c43"
},
{
"url": "https://git.kernel.org/stable/c/1ccc5c059d067c5358682ad5352e7d7e9239ed9b"
},
{
"url": "https://git.kernel.org/stable/c/9086b488f2737d5dcee86852b83f2059f1cdfabf"
},
{
"url": "https://git.kernel.org/stable/c/d4ba6aa65fcd797152d3aebd428a7b2da49cd5eb"
},
{
"url": "https://git.kernel.org/stable/c/ab1150115e68a46b687eb38c1ab92782018c9f2c"
}
],
"title": "dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80902",
"datePublished": "2026-09-04T17:11:17.510Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:17.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80901 (GCVE-0-2026-80901)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
ipvs: fix the checksum validations
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix the checksum validations
ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6
packets from clients. In fact, as for TCP/UDP we should
validate the checksum for ICMP packets only when we
mangle the packets on MASQ or on reply for tunnel.
Also, Sashiko points out that handle_response_icmp() being
common for IPv4 and IPv6 is missing the pseudo-header
calculation while validating ICMPv6 messages from real
servers which is a problem if checksum is not validated
by the hardware.
Fix the problems by creating ip_vs_checksum_common_check()
helper and use it for TCP/UDP/ICMP both for IPv4 and IPv6.
Rely on the nf_checksum() for validating the ICMP messages
but use it also for TCP and UDP.
Use correct IP offset for IP_VS_DBG_RL_PKT for TCP/UDP/SCTP.
IPVS packets (TCP/UDP/SCTP/ICMP) do not need checksum
validation on LOCAL_OUT (local clients or local real
servers) and on FORWARD (traffic from servers on LAN).
Do it only on LOCAL_IN, in case nf_checksum() is not
called on PRE_ROUTING.
Also, ip_vs_checksum_complete() can be marked static.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2a3b791e6e1169f374224d164738e9f7be703d77 , < d418d73acf8be62744dc47359dfdde8c2148845d
(git)
Affected: 2a3b791e6e1169f374224d164738e9f7be703d77 , < b3869d9b54e76dff64118dee4c8fd9302fcd5171 (git) Affected: 2a3b791e6e1169f374224d164738e9f7be703d77 , < 9cbe2c0fdb71904ee929b1851cdc1c73341a03c0 (git) Affected: 2a3b791e6e1169f374224d164738e9f7be703d77 , < 00eb23829fd08df1b5e057cb6b625996a70e7e65 (git) Affected: 2a3b791e6e1169f374224d164738e9f7be703d77 , < 5558a85add073215b298f3e044ff9a6d86d714ae (git) Affected: 2a3b791e6e1169f374224d164738e9f7be703d77 , < e876b75b9020a97bbdc79721e7fc749024891c65 (git) |
|
| Linux | Linux |
Affected:
2.6.28
Unaffected: 0 , < 2.6.28 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ip_vs.h",
"net/netfilter/ipvs/ip_vs_core.c",
"net/netfilter/ipvs/ip_vs_proto_sctp.c",
"net/netfilter/ipvs/ip_vs_proto_tcp.c",
"net/netfilter/ipvs/ip_vs_proto_udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d418d73acf8be62744dc47359dfdde8c2148845d",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
},
{
"lessThan": "b3869d9b54e76dff64118dee4c8fd9302fcd5171",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
},
{
"lessThan": "9cbe2c0fdb71904ee929b1851cdc1c73341a03c0",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
},
{
"lessThan": "00eb23829fd08df1b5e057cb6b625996a70e7e65",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
},
{
"lessThan": "5558a85add073215b298f3e044ff9a6d86d714ae",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
},
{
"lessThan": "e876b75b9020a97bbdc79721e7fc749024891c65",
"status": "affected",
"version": "2a3b791e6e1169f374224d164738e9f7be703d77",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ip_vs.h",
"net/netfilter/ipvs/ip_vs_core.c",
"net/netfilter/ipvs/ip_vs_proto_sctp.c",
"net/netfilter/ipvs/ip_vs_proto_tcp.c",
"net/netfilter/ipvs/ip_vs_proto_udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix the checksum validations\n\nip_vs_in_icmp_v6() is missing checksum validation for ICMPv6\npackets from clients. In fact, as for TCP/UDP we should\nvalidate the checksum for ICMP packets only when we\nmangle the packets on MASQ or on reply for tunnel.\n\nAlso, Sashiko points out that handle_response_icmp() being\ncommon for IPv4 and IPv6 is missing the pseudo-header\ncalculation while validating ICMPv6 messages from real\nservers which is a problem if checksum is not validated\nby the hardware.\n\nFix the problems by creating ip_vs_checksum_common_check()\nhelper and use it for TCP/UDP/ICMP both for IPv4 and IPv6.\nRely on the nf_checksum() for validating the ICMP messages\nbut use it also for TCP and UDP.\n\nUse correct IP offset for IP_VS_DBG_RL_PKT for TCP/UDP/SCTP.\n\nIPVS packets (TCP/UDP/SCTP/ICMP) do not need checksum\nvalidation on LOCAL_OUT (local clients or local real\nservers) and on FORWARD (traffic from servers on LAN).\nDo it only on LOCAL_IN, in case nf_checksum() is not\ncalled on PRE_ROUTING.\n\nAlso, ip_vs_checksum_complete() can be marked static."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:15.780Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d418d73acf8be62744dc47359dfdde8c2148845d"
},
{
"url": "https://git.kernel.org/stable/c/b3869d9b54e76dff64118dee4c8fd9302fcd5171"
},
{
"url": "https://git.kernel.org/stable/c/9cbe2c0fdb71904ee929b1851cdc1c73341a03c0"
},
{
"url": "https://git.kernel.org/stable/c/00eb23829fd08df1b5e057cb6b625996a70e7e65"
},
{
"url": "https://git.kernel.org/stable/c/5558a85add073215b298f3e044ff9a6d86d714ae"
},
{
"url": "https://git.kernel.org/stable/c/e876b75b9020a97bbdc79721e7fc749024891c65"
}
],
"title": "ipvs: fix the checksum validations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80901",
"datePublished": "2026-09-04T17:11:15.780Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:15.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80900 (GCVE-0-2026-80900)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
ASoC: SDCA: Make UMP message size check more robust
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SDCA: Make UMP message size check more robust
If message offset was larger than the buffer length the size
check will pass incorrectly. Refactor the check such that it is
more robust to invalid sizes.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
daab108504be73182c16a72b9cfe47ac3b1928ca , < fe5c53a952970ba15be8f512babd922e273579de
(git)
Affected: daab108504be73182c16a72b9cfe47ac3b1928ca , < 556d872e7c2a0b570c5b0974813847ef0d0cd637 (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sdca/sdca_ump.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fe5c53a952970ba15be8f512babd922e273579de",
"status": "affected",
"version": "daab108504be73182c16a72b9cfe47ac3b1928ca",
"versionType": "git"
},
{
"lessThan": "556d872e7c2a0b570c5b0974813847ef0d0cd637",
"status": "affected",
"version": "daab108504be73182c16a72b9cfe47ac3b1928ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sdca/sdca_ump.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Make UMP message size check more robust\n\nIf message offset was larger than the buffer length the size\ncheck will pass incorrectly. Refactor the check such that it is\nmore robust to invalid sizes."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:14.939Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fe5c53a952970ba15be8f512babd922e273579de"
},
{
"url": "https://git.kernel.org/stable/c/556d872e7c2a0b570c5b0974813847ef0d0cd637"
}
],
"title": "ASoC: SDCA: Make UMP message size check more robust",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80900",
"datePublished": "2026-09-04T17:11:14.939Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:14.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80899 (GCVE-0-2026-80899)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
erofs: remove fscache backend entirely
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: remove fscache backend entirely
EROFS over fscache was introduced to provide image lazy pulling
functionality. After the feature landed, the fscache subsystem made
netfs a new hard dependency, which is unexpected for a local filesystem
and has an kernel-defined caching hierarchy which could be inflexible
compared to the fanotify pre-content hooks. Therefore, this feature has
been deprecated for almost two years.
As EROFS file-backed mounts and fanotify pre-content hooks both upstream
for a while and already providing equivalent functionality (erofs-utils
has supported fanotify pre-content hooks), let's remove the fscache
backend now.
The main application of this feature is Nydus [1], and they plan to move
to use fanotify pre-content hooks in the near future too.
I hope this patch can be merged into Linux 7.2, which is also motivated
by newly found implementation issues [2][3] that are not worth
investigating given the deprecation and limited development resources.
The associated fscache/cachefiles cleanup patch will follow separately
through the vfs tree (netfs) later: it seems fine since the codebase is
isolated by CONFIG_CACHEFILES_ONDEMAND.
[1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md
[2] https://github.com/dragonflyoss/nydus/pull/1824
[3] https://lore.kernel.org/r/20260619135800.1594811-1-michael.bommarito@gmail.com
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f6145794f17a27d25f8a84edb80731fb0e07c196
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56 (git) Affected: 0 , < 7.1.8 (semver) |
|
| Linux | Linux |
Unaffected:
7.1.8 , ≤ 7.1.*
(semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Documentation/filesystems/erofs.rst",
"fs/erofs/Kconfig",
"fs/erofs/Makefile",
"fs/erofs/data.c",
"fs/erofs/fscache.c",
"fs/erofs/inode.c",
"fs/erofs/internal.h",
"fs/erofs/ishare.c",
"fs/erofs/super.c",
"fs/erofs/zdata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f6145794f17a27d25f8a84edb80731fb0e07c196",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7.1.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Documentation/filesystems/erofs.rst",
"fs/erofs/Kconfig",
"fs/erofs/Makefile",
"fs/erofs/data.c",
"fs/erofs/fscache.c",
"fs/erofs/inode.c",
"fs/erofs/internal.h",
"fs/erofs/ishare.c",
"fs/erofs/super.c",
"fs/erofs/zdata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: remove fscache backend entirely\n\nEROFS over fscache was introduced to provide image lazy pulling\nfunctionality. After the feature landed, the fscache subsystem made\nnetfs a new hard dependency, which is unexpected for a local filesystem\nand has an kernel-defined caching hierarchy which could be inflexible\ncompared to the fanotify pre-content hooks. Therefore, this feature has\nbeen deprecated for almost two years.\n\nAs EROFS file-backed mounts and fanotify pre-content hooks both upstream\nfor a while and already providing equivalent functionality (erofs-utils\nhas supported fanotify pre-content hooks), let\u0027s remove the fscache\nbackend now.\n\nThe main application of this feature is Nydus [1], and they plan to move\nto use fanotify pre-content hooks in the near future too.\n\nI hope this patch can be merged into Linux 7.2, which is also motivated\nby newly found implementation issues [2][3] that are not worth\ninvestigating given the deprecation and limited development resources.\nThe associated fscache/cachefiles cleanup patch will follow separately\nthrough the vfs tree (netfs) later: it seems fine since the codebase is\nisolated by CONFIG_CACHEFILES_ONDEMAND.\n\n[1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md\n[2] https://github.com/dragonflyoss/nydus/pull/1824\n[3] https://lore.kernel.org/r/20260619135800.1594811-1-michael.bommarito@gmail.com"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:14.158Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f6145794f17a27d25f8a84edb80731fb0e07c196"
},
{
"url": "https://git.kernel.org/stable/c/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56"
}
],
"title": "erofs: remove fscache backend entirely",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80899",
"datePublished": "2026-09-04T17:11:14.158Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:14.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80898 (GCVE-0-2026-80898)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
netfs: clear PG_private_2 on copy-to-cache append failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: clear PG_private_2 on copy-to-cache append failure
netfs_pgpriv2_copy_to_cache() marks the folio with PG_private_2 before
netfs_pgpriv2_copy_folio() appends it to the copy-to-cache rolling
buffer.
If the append fails, the folio is not queued for cache writeback, so
the PG_private_2 state and its reference must be released immediately.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2d46f2ec332533816417b60933954173f602121 , < 627826ef4208042b0470d1a3fdb729ce35471a0d
(git)
Affected: e2d46f2ec332533816417b60933954173f602121 , < 614b7f4bfcf665a751ae89ff9ae336a1b2d5af4e (git) Affected: e2d46f2ec332533816417b60933954173f602121 , < a81fc9266e1c5fef9ccf675a9b44b2f4ab464923 (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/read_pgpriv2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "627826ef4208042b0470d1a3fdb729ce35471a0d",
"status": "affected",
"version": "e2d46f2ec332533816417b60933954173f602121",
"versionType": "git"
},
{
"lessThan": "614b7f4bfcf665a751ae89ff9ae336a1b2d5af4e",
"status": "affected",
"version": "e2d46f2ec332533816417b60933954173f602121",
"versionType": "git"
},
{
"lessThan": "a81fc9266e1c5fef9ccf675a9b44b2f4ab464923",
"status": "affected",
"version": "e2d46f2ec332533816417b60933954173f602121",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/read_pgpriv2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: clear PG_private_2 on copy-to-cache append failure\n\nnetfs_pgpriv2_copy_to_cache() marks the folio with PG_private_2 before\nnetfs_pgpriv2_copy_folio() appends it to the copy-to-cache rolling\nbuffer.\n\nIf the append fails, the folio is not queued for cache writeback, so\nthe PG_private_2 state and its reference must be released immediately."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:13.337Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/627826ef4208042b0470d1a3fdb729ce35471a0d"
},
{
"url": "https://git.kernel.org/stable/c/614b7f4bfcf665a751ae89ff9ae336a1b2d5af4e"
},
{
"url": "https://git.kernel.org/stable/c/a81fc9266e1c5fef9ccf675a9b44b2f4ab464923"
}
],
"title": "netfs: clear PG_private_2 on copy-to-cache append failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80898",
"datePublished": "2026-09-04T17:11:13.337Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:13.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80897 (GCVE-0-2026-80897)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
netfs: release readahead folios on iterator preparation failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: release readahead folios on iterator preparation failure
netfs_prepare_read_iterator() batches readahead folios in put_batch so that
the folio references can be dropped after the I/O iterator has been
prepared.
If rolling_buffer_load_from_ra() fails after earlier folios have been
batched, the function returns immediately and leaves those references held.
Release the batch before returning the error.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
06fa229ceb36898e68022b5654c017d2c6582d7d , < 2c148a31ca01fc160aceec777bbc0041b0d0b8bd
(git)
Affected: 06fa229ceb36898e68022b5654c017d2c6582d7d , < 935e7b74bb2368f215cf8c2ad4bff60ee4e7589e (git) Affected: 06fa229ceb36898e68022b5654c017d2c6582d7d , < 87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6 (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c148a31ca01fc160aceec777bbc0041b0d0b8bd",
"status": "affected",
"version": "06fa229ceb36898e68022b5654c017d2c6582d7d",
"versionType": "git"
},
{
"lessThan": "935e7b74bb2368f215cf8c2ad4bff60ee4e7589e",
"status": "affected",
"version": "06fa229ceb36898e68022b5654c017d2c6582d7d",
"versionType": "git"
},
{
"lessThan": "87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6",
"status": "affected",
"version": "06fa229ceb36898e68022b5654c017d2c6582d7d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: release readahead folios on iterator preparation failure\n\nnetfs_prepare_read_iterator() batches readahead folios in put_batch so that\nthe folio references can be dropped after the I/O iterator has been\nprepared.\n\nIf rolling_buffer_load_from_ra() fails after earlier folios have been\nbatched, the function returns immediately and leaves those references held.\nRelease the batch before returning the error."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:12.499Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c148a31ca01fc160aceec777bbc0041b0d0b8bd"
},
{
"url": "https://git.kernel.org/stable/c/935e7b74bb2368f215cf8c2ad4bff60ee4e7589e"
},
{
"url": "https://git.kernel.org/stable/c/87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6"
}
],
"title": "netfs: release readahead folios on iterator preparation failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80897",
"datePublished": "2026-09-04T17:11:12.499Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:12.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80896 (GCVE-0-2026-80896)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
mshv: Fix race in mshv_irqfd_deassign
Summary
In the Linux kernel, the following vulnerability has been resolved:
mshv: Fix race in mshv_irqfd_deassign
mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list
require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign()
omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(),
which does take the lock before calling mshv_irqfd_deactivate().
Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons
the node pointers rather than resetting them. Since
mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev ==
NULL), a poisoned node still appears active. If a concurrent path calls
mshv_irqfd_deactivate() again on the same irqfd, the guard fails to
prevent a double hlist_del() on poisoned pointers.
Fix both issues:
- Add the missing spin_lock_irq/spin_unlock_irq around the list
traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release().
- Use hlist_del_init() instead of hlist_del() so the node is properly
marked as unhashed after removal, making the is_active guard reliable.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
621191d709b14882270dfd8ea5d7d6cdfebe2c35 , < 72a90ce4918b5a2d4820fe20677ba9af780d8826
(git)
Affected: 621191d709b14882270dfd8ea5d7d6cdfebe2c35 , < 4529a41a675b96e0f876eef1cc93a31a57cb4d18 (git) Affected: 621191d709b14882270dfd8ea5d7d6cdfebe2c35 , < 0762262ac3e70f65b3bb843fe892f8bac1562d08 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hv/mshv_eventfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "72a90ce4918b5a2d4820fe20677ba9af780d8826",
"status": "affected",
"version": "621191d709b14882270dfd8ea5d7d6cdfebe2c35",
"versionType": "git"
},
{
"lessThan": "4529a41a675b96e0f876eef1cc93a31a57cb4d18",
"status": "affected",
"version": "621191d709b14882270dfd8ea5d7d6cdfebe2c35",
"versionType": "git"
},
{
"lessThan": "0762262ac3e70f65b3bb843fe892f8bac1562d08",
"status": "affected",
"version": "621191d709b14882270dfd8ea5d7d6cdfebe2c35",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hv/mshv_eventfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmshv: Fix race in mshv_irqfd_deassign\n\nmshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list\nrequire pt-\u003ept_irqfds_lock to be held, but mshv_irqfd_deassign()\nomits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(),\nwhich does take the lock before calling mshv_irqfd_deactivate().\n\nAdditionally, mshv_irqfd_deactivate() uses hlist_del() which poisons\nthe node pointers rather than resetting them. Since\nmshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev ==\nNULL), a poisoned node still appears active. If a concurrent path calls\nmshv_irqfd_deactivate() again on the same irqfd, the guard fails to\nprevent a double hlist_del() on poisoned pointers.\n\nFix both issues:\n- Add the missing spin_lock_irq/spin_unlock_irq around the list\n traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release().\n- Use hlist_del_init() instead of hlist_del() so the node is properly\n marked as unhashed after removal, making the is_active guard reliable."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:11.689Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/72a90ce4918b5a2d4820fe20677ba9af780d8826"
},
{
"url": "https://git.kernel.org/stable/c/4529a41a675b96e0f876eef1cc93a31a57cb4d18"
},
{
"url": "https://git.kernel.org/stable/c/0762262ac3e70f65b3bb843fe892f8bac1562d08"
}
],
"title": "mshv: Fix race in mshv_irqfd_deassign",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80896",
"datePublished": "2026-09-04T17:11:11.689Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:11.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80895 (GCVE-0-2026-80895)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
mshv: Order pt_vp_array publish against irqfd assertion path
Summary
In the Linux kernel, the following vulnerability has been resolved:
mshv: Order pt_vp_array publish against irqfd assertion path
mshv_partition_ioctl_create_vp() initialises a VP struct (allocations,
mutex_init, init_waitqueue_head, page mappings) and then publishes the
pointer into partition->pt_vp_array. Several ISR paths read this array
locklessly: the intercept ISR, the two scheduler ISRs, and
mshv_try_assert_irq_fast() on the irqfd fast path.
Of these, only mshv_try_assert_irq_fast() can structurally race the
publish. It runs from an eventfd waker without holding pt_mutex, and
MSHV_IRQFD does not require the target lapic_apic_id (== vp_index) to
refer to an existing VP at registration time. A user can therefore
register an irqfd targeting a yet-to-be-created VP, then trigger
mshv_try_assert_irq_fast() concurrently with MSHV_CREATE_VP for the
same index. On weakly-ordered architectures the reader can observe a
non-NULL pointer in pt_vp_array before the initialising stores to the
VP struct become visible, leading to use of partially-initialised
fields (e.g. vp_register_page).
The other ISR readers cannot reach this race: the hypervisor will not
generate intercept or scheduler messages for a VP that has never been
told to run, and the user can only call MSHV_RUN_VP on the VP fd
returned by MSHV_CREATE_VP, which by construction is returned after
the publish. Leave those readers as plain loads.
Use smp_store_release() in mshv_partition_ioctl_create_vp() to publish
the pointer, and pair it with smp_load_acquire() in
mshv_try_assert_irq_fast(). On x86 these compile to plain accesses
under TSO; on ARM64 they emit one-instruction acquire/release barriers,
acceptable on this fast path.
The destroy-side path (destroy_partition() clearing pt_vp_array[i] to
NULL after kfree(vp)) has a separate ordering and lifetime concern
that is out of scope here.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
621191d709b14882270dfd8ea5d7d6cdfebe2c35 , < 062aa5dcc49a9ad96726a80c2a0ab0a1233bc2b9
(git)
Affected: 621191d709b14882270dfd8ea5d7d6cdfebe2c35 , < eba2bf5daa7933f94c53ebbbf0f567d4274716df (git) Affected: 621191d709b14882270dfd8ea5d7d6cdfebe2c35 , < b098dc869219c15dc49bf9cf63fb5fc1481d3373 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hv/mshv_eventfd.c",
"drivers/hv/mshv_root_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "062aa5dcc49a9ad96726a80c2a0ab0a1233bc2b9",
"status": "affected",
"version": "621191d709b14882270dfd8ea5d7d6cdfebe2c35",
"versionType": "git"
},
{
"lessThan": "eba2bf5daa7933f94c53ebbbf0f567d4274716df",
"status": "affected",
"version": "621191d709b14882270dfd8ea5d7d6cdfebe2c35",
"versionType": "git"
},
{
"lessThan": "b098dc869219c15dc49bf9cf63fb5fc1481d3373",
"status": "affected",
"version": "621191d709b14882270dfd8ea5d7d6cdfebe2c35",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hv/mshv_eventfd.c",
"drivers/hv/mshv_root_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmshv: Order pt_vp_array publish against irqfd assertion path\n\nmshv_partition_ioctl_create_vp() initialises a VP struct (allocations,\nmutex_init, init_waitqueue_head, page mappings) and then publishes the\npointer into partition-\u003ept_vp_array. Several ISR paths read this array\nlocklessly: the intercept ISR, the two scheduler ISRs, and\nmshv_try_assert_irq_fast() on the irqfd fast path.\n\nOf these, only mshv_try_assert_irq_fast() can structurally race the\npublish. It runs from an eventfd waker without holding pt_mutex, and\nMSHV_IRQFD does not require the target lapic_apic_id (== vp_index) to\nrefer to an existing VP at registration time. A user can therefore\nregister an irqfd targeting a yet-to-be-created VP, then trigger\nmshv_try_assert_irq_fast() concurrently with MSHV_CREATE_VP for the\nsame index. On weakly-ordered architectures the reader can observe a\nnon-NULL pointer in pt_vp_array before the initialising stores to the\nVP struct become visible, leading to use of partially-initialised\nfields (e.g. vp_register_page).\n\nThe other ISR readers cannot reach this race: the hypervisor will not\ngenerate intercept or scheduler messages for a VP that has never been\ntold to run, and the user can only call MSHV_RUN_VP on the VP fd\nreturned by MSHV_CREATE_VP, which by construction is returned after\nthe publish. Leave those readers as plain loads.\n\nUse smp_store_release() in mshv_partition_ioctl_create_vp() to publish\nthe pointer, and pair it with smp_load_acquire() in\nmshv_try_assert_irq_fast(). On x86 these compile to plain accesses\nunder TSO; on ARM64 they emit one-instruction acquire/release barriers,\nacceptable on this fast path.\n\nThe destroy-side path (destroy_partition() clearing pt_vp_array[i] to\nNULL after kfree(vp)) has a separate ordering and lifetime concern\nthat is out of scope here."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:10.880Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/062aa5dcc49a9ad96726a80c2a0ab0a1233bc2b9"
},
{
"url": "https://git.kernel.org/stable/c/eba2bf5daa7933f94c53ebbbf0f567d4274716df"
},
{
"url": "https://git.kernel.org/stable/c/b098dc869219c15dc49bf9cf63fb5fc1481d3373"
}
],
"title": "mshv: Order pt_vp_array publish against irqfd assertion path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80895",
"datePublished": "2026-09-04T17:11:10.880Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:10.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80894 (GCVE-0-2026-80894)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
iommufd_hwpt_replace_device() calls:
iommufd_auto_response_faults(hwpt, old_handle);
passing the *new* hwpt together with the handle of
the device's *old* domain. This should be a parameter mismatch:
1. Semantically, iommufd_auto_response_faults(x, handle) scans
x->fault's deliver list and response xarray for groups matching
"handle". A group is queued under the hwpt that was attached at
fault-delivery time. old_handle is fetched *before* the domain switch,
so its group lives on old->fault, not on the new hwpt->fault.
2. Historically, the first argument was "old". The routine was
introduced by commit b7d8833677ba ("iommufd: Fault-capable hwpt
attach/detach/replace") as __fault_domain_replace_dev() in
fault.c, correctly calling iommufd_auto_response_faults(old, curr).
Commit fb21b1568ada ("iommufd: Make attach_handle generic than
fault specific") moved this into iommufd_hwpt_replace_device() in
device.c and swapped it to "hwpt". This should be a refactor regression,
not an intentional change.
Fix this by passing "old" instead.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6d11543bf37abdf60b8e6022a62fccfb82a5fe2e , < adb87155b67f9759ff010c0a99559f5bffa45dcf
(git)
Affected: fb21b1568adaa76af7a8c853f37c60fba8b28661 , < 564ac339c0f8bada4e77a57a92bab9d3df635e07 (git) Affected: fb21b1568adaa76af7a8c853f37c60fba8b28661 , < 8eb077025279304268bd58657f0af3d388822b21 (git) Affected: fb21b1568adaa76af7a8c853f37c60fba8b28661 , < ba5c0f28a26e7d9be1e0997f8920dd638e2782fd (git) Affected: 1e0216b6a58c79b5ee91c78706d5f560e4d1f56f (git) Affected: 4b23c4b991eb90cc7bca42e9f81142feedd4bb56 (git) Affected: 6.12.24 , < 6.12.105 (semver) Affected: 6.13.12 , < 6.14 (semver) Affected: 6.14.3 , < 6.15 (semver) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "adb87155b67f9759ff010c0a99559f5bffa45dcf",
"status": "affected",
"version": "6d11543bf37abdf60b8e6022a62fccfb82a5fe2e",
"versionType": "git"
},
{
"lessThan": "564ac339c0f8bada4e77a57a92bab9d3df635e07",
"status": "affected",
"version": "fb21b1568adaa76af7a8c853f37c60fba8b28661",
"versionType": "git"
},
{
"lessThan": "8eb077025279304268bd58657f0af3d388822b21",
"status": "affected",
"version": "fb21b1568adaa76af7a8c853f37c60fba8b28661",
"versionType": "git"
},
{
"lessThan": "ba5c0f28a26e7d9be1e0997f8920dd638e2782fd",
"status": "affected",
"version": "fb21b1568adaa76af7a8c853f37c60fba8b28661",
"versionType": "git"
},
{
"status": "affected",
"version": "1e0216b6a58c79b5ee91c78706d5f560e4d1f56f",
"versionType": "git"
},
{
"status": "affected",
"version": "4b23c4b991eb90cc7bca42e9f81142feedd4bb56",
"versionType": "git"
},
{
"lessThan": "6.12.105",
"status": "affected",
"version": "6.12.24",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.12",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.12.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace\n\niommufd_hwpt_replace_device() calls:\n\n\tiommufd_auto_response_faults(hwpt, old_handle);\n\npassing the *new* hwpt together with the handle of\nthe device\u0027s *old* domain. This should be a parameter mismatch:\n\n1. Semantically, iommufd_auto_response_faults(x, handle) scans\n x-\u003efault\u0027s deliver list and response xarray for groups matching\n \"handle\". A group is queued under the hwpt that was attached at\n fault-delivery time. old_handle is fetched *before* the domain switch,\n so its group lives on old-\u003efault, not on the new hwpt-\u003efault.\n\n2. Historically, the first argument was \"old\". The routine was\n introduced by commit b7d8833677ba (\"iommufd: Fault-capable hwpt\n attach/detach/replace\") as __fault_domain_replace_dev() in\n fault.c, correctly calling iommufd_auto_response_faults(old, curr).\n Commit fb21b1568ada (\"iommufd: Make attach_handle generic than\n fault specific\") moved this into iommufd_hwpt_replace_device() in\n device.c and swapped it to \"hwpt\". This should be a refactor regression,\n not an intentional change.\n\nFix this by passing \"old\" instead."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:10.093Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/adb87155b67f9759ff010c0a99559f5bffa45dcf"
},
{
"url": "https://git.kernel.org/stable/c/564ac339c0f8bada4e77a57a92bab9d3df635e07"
},
{
"url": "https://git.kernel.org/stable/c/8eb077025279304268bd58657f0af3d388822b21"
},
{
"url": "https://git.kernel.org/stable/c/ba5c0f28a26e7d9be1e0997f8920dd638e2782fd"
}
],
"title": "iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80894",
"datePublished": "2026-09-04T17:11:10.093Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:10.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80893 (GCVE-0-2026-80893)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
copy_hugetlb_page_range() clears the uffd-wp bit of migration and hwpoison
entries with huge_pte_clear_uffd_wp(), which operates on the present-PTE
bit position. Swap entries keep the uffd-wp state elsewhere -- the
migration branch reads and sets it with pte_swp_uffd_wp() and
pte_swp_mkuffd_wp() -- and the present-PTE position falls into the swap
payload. On x86-64 it lands in the inverted swap offset, where a
naturally-aligned hugetlb PFN always has the affected bit set, so the
clear advances the encoded PFN by two pages.
No userfaultfd needs to be involved: the clear is guarded only by the
child VMA not being uffd-wp registered, so a plain fork() with an
in-flight hugetlb migration entry (or a poisoned hugetlb page) corrupts
the entry copied into the child. Instrumenting the clear and forking
after MADV_HWPOISON on a 2MB anon hugetlb page shows:
offset before=120e00
offset after =120e02
The fallout is mostly latent: rmap walks match migration entries by folio
range and remove_migration_pte() rebuilds the PTE from the folio, so a
within-folio PFN skew heals once migration completes. But any path that
re-encodes the corrupted offset -- e.g. hugetlb_change_protection()
rewriting a writable migration entry via
make_readable_migration_entry(swp_offset(entry)) -- propagates it.
Migration entries legitimately carry uffd-wp, so clear it with
pte_swp_clear_uffd_wp(), matching copy_nonpresent_pte() and
move_huge_pte().
A hwpoison entry, on the other hand, never carries the uffd-wp bit: it is
installed fresh by make_hwpoison_entry() (try_to_unmap_one() does not
preserve uffd-wp on the hwpoison path) and hugetlb_change_protection()
leaves hwpoison entries untouched. There was nothing to clear there, only
the corruption, so drop the clear entirely.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < f1b1311c0352873137768bac5a126e491271a747
(git)
Affected: bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < 69cb5825d9988c7944bc9f1dc08cb233655405a7 (git) Affected: bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < 8b0de7005b148738d79d6c45594d566489948a68 (git) Affected: bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < 2b9a07002c2f296aa6a9c591213933d3492e3089 (git) Affected: bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < 2fa11c60c9c06bafc19cf4d9efdaa36a38079e87 (git) Affected: bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < 83abe2fd5b3aeb3123b5408a5a91709c5538fb23 (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f1b1311c0352873137768bac5a126e491271a747",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
},
{
"lessThan": "69cb5825d9988c7944bc9f1dc08cb233655405a7",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
},
{
"lessThan": "8b0de7005b148738d79d6c45594d566489948a68",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
},
{
"lessThan": "2b9a07002c2f296aa6a9c591213933d3492e3089",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
},
{
"lessThan": "2fa11c60c9c06bafc19cf4d9efdaa36a38079e87",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
},
{
"lessThan": "83abe2fd5b3aeb3123b5408a5a91709c5538fb23",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()\n\ncopy_hugetlb_page_range() clears the uffd-wp bit of migration and hwpoison\nentries with huge_pte_clear_uffd_wp(), which operates on the present-PTE\nbit position. Swap entries keep the uffd-wp state elsewhere -- the\nmigration branch reads and sets it with pte_swp_uffd_wp() and\npte_swp_mkuffd_wp() -- and the present-PTE position falls into the swap\npayload. On x86-64 it lands in the inverted swap offset, where a\nnaturally-aligned hugetlb PFN always has the affected bit set, so the\nclear advances the encoded PFN by two pages.\n\nNo userfaultfd needs to be involved: the clear is guarded only by the\nchild VMA not being uffd-wp registered, so a plain fork() with an\nin-flight hugetlb migration entry (or a poisoned hugetlb page) corrupts\nthe entry copied into the child. Instrumenting the clear and forking\nafter MADV_HWPOISON on a 2MB anon hugetlb page shows:\n\n offset before=120e00\n offset after =120e02\n\nThe fallout is mostly latent: rmap walks match migration entries by folio\nrange and remove_migration_pte() rebuilds the PTE from the folio, so a\nwithin-folio PFN skew heals once migration completes. But any path that\nre-encodes the corrupted offset -- e.g. hugetlb_change_protection()\nrewriting a writable migration entry via\nmake_readable_migration_entry(swp_offset(entry)) -- propagates it.\n\nMigration entries legitimately carry uffd-wp, so clear it with\npte_swp_clear_uffd_wp(), matching copy_nonpresent_pte() and\nmove_huge_pte().\n\nA hwpoison entry, on the other hand, never carries the uffd-wp bit: it is\ninstalled fresh by make_hwpoison_entry() (try_to_unmap_one() does not\npreserve uffd-wp on the hwpoison path) and hugetlb_change_protection()\nleaves hwpoison entries untouched. There was nothing to clear there, only\nthe corruption, so drop the clear entirely."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:09.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f1b1311c0352873137768bac5a126e491271a747"
},
{
"url": "https://git.kernel.org/stable/c/69cb5825d9988c7944bc9f1dc08cb233655405a7"
},
{
"url": "https://git.kernel.org/stable/c/8b0de7005b148738d79d6c45594d566489948a68"
},
{
"url": "https://git.kernel.org/stable/c/2b9a07002c2f296aa6a9c591213933d3492e3089"
},
{
"url": "https://git.kernel.org/stable/c/2fa11c60c9c06bafc19cf4d9efdaa36a38079e87"
},
{
"url": "https://git.kernel.org/stable/c/83abe2fd5b3aeb3123b5408a5a91709c5538fb23"
}
],
"title": "mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80893",
"datePublished": "2026-09-04T17:11:09.199Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:09.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80892 (GCVE-0-2026-80892)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
erofs: cap LZMA stream pool size
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: cap LZMA stream pool size
fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
pool from num_possible_cpus() when the lzma_streams module parameter is
unset, then z_erofs_load_lzma_config() preallocates one image-supplied
dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU
systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed
decoder state until the erofs module is unloaded.
Impact: An EROFS image mounted by the system can pin up to 8 MiB of
vmalloc memory per LZMA stream, either as intended or unexpectedly.
Bound the default stream count by a new
CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the
worst-case default preallocation is 128 MiB if the number of CPUs is no
less than 16 while preserving the existing per-image dictionary limit.
An explicit lzma_streams module parameter is still honoured as-is, so
administrators who deliberately size the pool are not affected.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
622ceaddb7649ca328832f50ba1400af778d75fa , < 682cb3ece37fc5141e73bc726ccf4adb833e5189
(git)
Affected: 622ceaddb7649ca328832f50ba1400af778d75fa , < e8b3d09aa8889dda9be9cbb3d2f0218c4b9acde4 (git) Affected: 622ceaddb7649ca328832f50ba1400af778d75fa , < 0c676903cb2a61992ded8e7907609cc6b0f11744 (git) Affected: 622ceaddb7649ca328832f50ba1400af778d75fa , < 5aaa06dfc10f8398c8807453dbec738ea9af10e4 (git) Affected: 622ceaddb7649ca328832f50ba1400af778d75fa , < e52da169b8c0d19bb2d803f2a07fe0e5a00462d6 (git) Affected: 622ceaddb7649ca328832f50ba1400af778d75fa , < c9b47e6b23114e939b17f818471c7a46e59006e7 (git) |
|
| Linux | Linux |
Affected:
5.16
Unaffected: 0 , < 5.16 (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/Kconfig",
"fs/erofs/decompressor_lzma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "682cb3ece37fc5141e73bc726ccf4adb833e5189",
"status": "affected",
"version": "622ceaddb7649ca328832f50ba1400af778d75fa",
"versionType": "git"
},
{
"lessThan": "e8b3d09aa8889dda9be9cbb3d2f0218c4b9acde4",
"status": "affected",
"version": "622ceaddb7649ca328832f50ba1400af778d75fa",
"versionType": "git"
},
{
"lessThan": "0c676903cb2a61992ded8e7907609cc6b0f11744",
"status": "affected",
"version": "622ceaddb7649ca328832f50ba1400af778d75fa",
"versionType": "git"
},
{
"lessThan": "5aaa06dfc10f8398c8807453dbec738ea9af10e4",
"status": "affected",
"version": "622ceaddb7649ca328832f50ba1400af778d75fa",
"versionType": "git"
},
{
"lessThan": "e52da169b8c0d19bb2d803f2a07fe0e5a00462d6",
"status": "affected",
"version": "622ceaddb7649ca328832f50ba1400af778d75fa",
"versionType": "git"
},
{
"lessThan": "c9b47e6b23114e939b17f818471c7a46e59006e7",
"status": "affected",
"version": "622ceaddb7649ca328832f50ba1400af778d75fa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/Kconfig",
"fs/erofs/decompressor_lzma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: cap LZMA stream pool size\n\nfs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream\npool from num_possible_cpus() when the lzma_streams module parameter is\nunset, then z_erofs_load_lzma_config() preallocates one image-supplied\ndictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU\nsystems, a small EROFS image can pin hundreds of MiB of vmalloc-backed\ndecoder state until the erofs module is unloaded.\n\nImpact: An EROFS image mounted by the system can pin up to 8 MiB of\nvmalloc memory per LZMA stream, either as intended or unexpectedly.\n\nBound the default stream count by a new\nCONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the\nworst-case default preallocation is 128 MiB if the number of CPUs is no\nless than 16 while preserving the existing per-image dictionary limit.\nAn explicit lzma_streams module parameter is still honoured as-is, so\nadministrators who deliberately size the pool are not affected."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:08.391Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/682cb3ece37fc5141e73bc726ccf4adb833e5189"
},
{
"url": "https://git.kernel.org/stable/c/e8b3d09aa8889dda9be9cbb3d2f0218c4b9acde4"
},
{
"url": "https://git.kernel.org/stable/c/0c676903cb2a61992ded8e7907609cc6b0f11744"
},
{
"url": "https://git.kernel.org/stable/c/5aaa06dfc10f8398c8807453dbec738ea9af10e4"
},
{
"url": "https://git.kernel.org/stable/c/e52da169b8c0d19bb2d803f2a07fe0e5a00462d6"
},
{
"url": "https://git.kernel.org/stable/c/c9b47e6b23114e939b17f818471c7a46e59006e7"
}
],
"title": "erofs: cap LZMA stream pool size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80892",
"datePublished": "2026-09-04T17:11:08.391Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:08.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80891 (GCVE-0-2026-80891)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
The AIBV holds one bit per MSI-X vector for a given function. The size of
the bit vector is derived from the NOI and the AIBVO. If the size of the
AIBV exceeds a single page boundary, then reject the request as we cannot
safely pin the guest AIBV.
Similarly reject the request if the AISB address is not 8-byte aligned as
the architecture requires doubleword alignment for the summary bit address.
Since the AISBO can address up to 64 bits, the size of the AISB can only be
8 bytes for the function. This also ensures the AISB doesn't exceed a
single page boundary.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 3a1c64220ede4ac9ef9a3e76f008ff60a34f4c48
(git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < f00ef8efd41440129ccd88f4a1ebebf8d61d297f (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 15df7700dd99f8a37f5c6ed2dcf1e33009cdba47 (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < b878ba7e28144c9a857bc847d31f3c45413450ac (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < fbfe683f8b1ae7e40b56bdd6daf5bd671bc3a528 (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 868d32ac72cba21c5c6d8a66a814b7c25a3a5c01 (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3a1c64220ede4ac9ef9a3e76f008ff60a34f4c48",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "f00ef8efd41440129ccd88f4a1ebebf8d61d297f",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "15df7700dd99f8a37f5c6ed2dcf1e33009cdba47",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "b878ba7e28144c9a857bc847d31f3c45413450ac",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "fbfe683f8b1ae7e40b56bdd6daf5bd671bc3a528",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "868d32ac72cba21c5c6d8a66a814b7c25a3a5c01",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Validate AIBV and AISB before pinning guest pages\n\nThe AIBV holds one bit per MSI-X vector for a given function. The size of\nthe bit vector is derived from the NOI and the AIBVO. If the size of the\nAIBV exceeds a single page boundary, then reject the request as we cannot\nsafely pin the guest AIBV.\n\nSimilarly reject the request if the AISB address is not 8-byte aligned as\nthe architecture requires doubleword alignment for the summary bit address.\nSince the AISBO can address up to 64 bits, the size of the AISB can only be\n8 bytes for the function. This also ensures the AISB doesn\u0027t exceed a\nsingle page boundary."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:07.555Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3a1c64220ede4ac9ef9a3e76f008ff60a34f4c48"
},
{
"url": "https://git.kernel.org/stable/c/f00ef8efd41440129ccd88f4a1ebebf8d61d297f"
},
{
"url": "https://git.kernel.org/stable/c/15df7700dd99f8a37f5c6ed2dcf1e33009cdba47"
},
{
"url": "https://git.kernel.org/stable/c/b878ba7e28144c9a857bc847d31f3c45413450ac"
},
{
"url": "https://git.kernel.org/stable/c/fbfe683f8b1ae7e40b56bdd6daf5bd671bc3a528"
},
{
"url": "https://git.kernel.org/stable/c/868d32ac72cba21c5c6d8a66a814b7c25a3a5c01"
}
],
"title": "KVM: s390: pci: Validate AIBV and AISB before pinning guest pages",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80891",
"datePublished": "2026-09-04T17:11:07.555Z",
"dateReserved": "2026-08-26T14:34:25.799Z",
"dateUpdated": "2026-09-04T17:11:07.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80890 (GCVE-0-2026-80890)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
sctp: reject stale cookies with mismatched verification tags
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: reject stale cookies with mismatched verification tags
sctp_unpack_cookie() skips cookie expiration checks whenever an
association already exists. This is broader than the exception in
RFC 9260 Section 5.2.4.
For an existing association, Section 5.2.4 permits an expired State
Cookie only when both Verification Tags in the cookie match the current
association. Otherwise, the packet SHOULD be discarded and a Stale
Cookie ERROR MUST be sent.
The broad check lets an expired Action A restart cookie reach
sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second
cookie lifetime, replaying such a cookie after 65 seconds returned a
COOKIE-ACK and restarted the association.
Check cookie expiration unless both Verification Tags match. This
preserves the Action D exception for a lost COOKIE ACK while rejecting
expired cookies in all other cases.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f6e3cc296372accad4ee57405195021231ef4bcb
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c151daba0ceb1fb068a215b07de89fb1eb5f87bc (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 817cffdbdbdf50e1f2b016599d1897de3ca54964 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 61baa5020b0afb41bfd97f8f6ce5e336c4a4546e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c68557a49e960dbcdede22c7a9b488603078b8b4 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a0d1693923f41d6f49083aa2446686aed09d1d79 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 35c279113498d19a8734e2aae67b951b9b20f634 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f6e3cc296372accad4ee57405195021231ef4bcb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c151daba0ceb1fb068a215b07de89fb1eb5f87bc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "817cffdbdbdf50e1f2b016599d1897de3ca54964",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "61baa5020b0afb41bfd97f8f6ce5e336c4a4546e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c68557a49e960dbcdede22c7a9b488603078b8b4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a0d1693923f41d6f49083aa2446686aed09d1d79",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "35c279113498d19a8734e2aae67b951b9b20f634",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9d8da8e0a9bce4a340af60dd0446bc7eb8d07587",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: reject stale cookies with mismatched verification tags\n\nsctp_unpack_cookie() skips cookie expiration checks whenever an\nassociation already exists. This is broader than the exception in\nRFC 9260 Section 5.2.4.\n\nFor an existing association, Section 5.2.4 permits an expired State\nCookie only when both Verification Tags in the cookie match the current\nassociation. Otherwise, the packet SHOULD be discarded and a Stale\nCookie ERROR MUST be sent.\n\nThe broad check lets an expired Action A restart cookie reach\nsctp_sf_do_dupcook_a(). In a runtime test with the default 60 second\ncookie lifetime, replaying such a cookie after 65 seconds returned a\nCOOKIE-ACK and restarted the association.\n\nCheck cookie expiration unless both Verification Tags match. This\npreserves the Action D exception for a lost COOKIE ACK while rejecting\nexpired cookies in all other cases."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:06.742Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f6e3cc296372accad4ee57405195021231ef4bcb"
},
{
"url": "https://git.kernel.org/stable/c/c151daba0ceb1fb068a215b07de89fb1eb5f87bc"
},
{
"url": "https://git.kernel.org/stable/c/817cffdbdbdf50e1f2b016599d1897de3ca54964"
},
{
"url": "https://git.kernel.org/stable/c/61baa5020b0afb41bfd97f8f6ce5e336c4a4546e"
},
{
"url": "https://git.kernel.org/stable/c/c68557a49e960dbcdede22c7a9b488603078b8b4"
},
{
"url": "https://git.kernel.org/stable/c/a0d1693923f41d6f49083aa2446686aed09d1d79"
},
{
"url": "https://git.kernel.org/stable/c/35c279113498d19a8734e2aae67b951b9b20f634"
},
{
"url": "https://git.kernel.org/stable/c/9d8da8e0a9bce4a340af60dd0446bc7eb8d07587"
}
],
"title": "sctp: reject stale cookies with mismatched verification tags",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80890",
"datePublished": "2026-09-04T17:11:06.742Z",
"dateReserved": "2026-08-26T14:34:25.799Z",
"dateUpdated": "2026-09-04T17:11:06.742Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80889 (GCVE-0-2026-80889)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
This patch is a follow-up to commit cf070fe33bfb ("can: isotp: serialize
TX state transitions under so->rx_lock") which addresses following
sashiko-bot findings:
- isotp_sendmsg(): drain so->txfrtimer first so a stale callback can't
re-arm echotimer after the claim
- isotp_release(): wake so->wait after forcing ISOTP_SHUTDOWN so a
sleeping sendmsg() claim isn't stranded
- isotp_sendmsg(): have both wait_event_interruptible() calls in
isotp_sendmsg() also wake on ISOTP_SHUTDOWN and do not return claim to
IDLE to avoid corrupting a concurrent isotp_release() process.
- isotp_sendmsg(): handle potential claim of a new transfer when
the wait_event_interruptible() call returns in CAN_ISOTP_WAIT_TX_DONE
mode. Don't touch timers and states of the new transfer if a new thread
incremented so->tx_gen before getting the lock at err_event_drop.
- isotp_sendmsg(): handle a stuck can_send() and omit timer and state
changes if a new transfer was claimed. wait_tx_done() returns the error
recorded in so->tx_result[], tagged with the caller's own generation.
- isotp_tx_timeout(): on a claimed timeout, record the ECOMM error for
the timed-out transfer's own generation in so->tx_result[]; sk->sk_err
is raised unconditionally, same as every other error path here.
- isotp_tx_gen_done()/isotp_tx_timeout(): always read tx.state (acquire)
before tx_gen - the reverse order let a weakly ordered CPU pair a fresh
tx.state with a stale tx_gen/tx_result slot.
- isotp_sendmsg(): wait_tx_done: drain sk_err via sock_error() once we
have read the result from so->tx_result[], so an already-reported error
doesn't stay latched for a later poll()/SO_ERROR.
Also align the remaining lock-free so->tx.state/rx.state/cfecho accesses
and use skb->hash as unique loopback echo frame indicator.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
bbedeb67a9a684f2fb78c55bd3662c400526715e , < 8acab9fc66d6f426c36968c91a979f70784945a7
(git)
Affected: 377a8f500704da42ed86a4541ed930e9dcfdb2ea , < af7e25c649ed68cbad07f8185af0f31b892cbf29 (git) Affected: 6da8119e8dd542194103139812d1a4b7dcd1aedd , < 2753722612d8824d3910096f93059f669009b0f0 (git) Affected: 0b05eca9589f609e2491b528dccf683168a4cda8 , < bf5c4a8b24acb12739ebb9aea5510b007e4f5239 (git) Affected: a7d90e7b5e75d7406c889fe36e9a61ee364a00cb , < deca7746b57d982cd4f0301f4443f56780c4a048 (git) Affected: 37beb16e08cae94cc05840c7274225e3b0b38ae7 , < 10be509fa8fd95d1e47d40d1f68b0b26dfe9d572 (git) Affected: 4f1fdf1a1c317bcac0c6b6c8e12642c9983de1ca , < 35c62ac98d06669aa3f0f38b7829eaca929a611e (git) Affected: cf070fe33bfbd1a4c21236078fadb35dd223a157 , < 050f010f920da17c1044a4f174766ad553e770b6 (git) |
|
| Linux | Linux |
Affected:
5.10.265 , < 5.10.267
(semver)
Affected: 5.15.216 , < 5.15.218 (semver) Affected: 6.1.183 , < 6.1.185 (semver) Affected: 6.6.148 , < 6.6.151 (semver) Affected: 6.12.101 , < 6.12.103 (semver) Affected: 6.18.40 , < 6.18.44 (semver) Affected: 7.1.5 , < 7.1.8 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/isotp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8acab9fc66d6f426c36968c91a979f70784945a7",
"status": "affected",
"version": "bbedeb67a9a684f2fb78c55bd3662c400526715e",
"versionType": "git"
},
{
"lessThan": "af7e25c649ed68cbad07f8185af0f31b892cbf29",
"status": "affected",
"version": "377a8f500704da42ed86a4541ed930e9dcfdb2ea",
"versionType": "git"
},
{
"lessThan": "2753722612d8824d3910096f93059f669009b0f0",
"status": "affected",
"version": "6da8119e8dd542194103139812d1a4b7dcd1aedd",
"versionType": "git"
},
{
"lessThan": "bf5c4a8b24acb12739ebb9aea5510b007e4f5239",
"status": "affected",
"version": "0b05eca9589f609e2491b528dccf683168a4cda8",
"versionType": "git"
},
{
"lessThan": "deca7746b57d982cd4f0301f4443f56780c4a048",
"status": "affected",
"version": "a7d90e7b5e75d7406c889fe36e9a61ee364a00cb",
"versionType": "git"
},
{
"lessThan": "10be509fa8fd95d1e47d40d1f68b0b26dfe9d572",
"status": "affected",
"version": "37beb16e08cae94cc05840c7274225e3b0b38ae7",
"versionType": "git"
},
{
"lessThan": "35c62ac98d06669aa3f0f38b7829eaca929a611e",
"status": "affected",
"version": "4f1fdf1a1c317bcac0c6b6c8e12642c9983de1ca",
"versionType": "git"
},
{
"lessThan": "050f010f920da17c1044a4f174766ad553e770b6",
"status": "affected",
"version": "cf070fe33bfbd1a4c21236078fadb35dd223a157",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/isotp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5.10.267",
"status": "affected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThan": "5.15.218",
"status": "affected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThan": "6.1.185",
"status": "affected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThan": "6.6.151",
"status": "affected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThan": "6.12.103",
"status": "affected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThan": "6.18.44",
"status": "affected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThan": "7.1.8",
"status": "affected",
"version": "7.1.5",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "5.10.265",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "5.15.216",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "6.1.183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.6.148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.12.101",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.18.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "7.1.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix timer drain order, wakeup handling and tx_gen ordering\n\nThis patch is a follow-up to commit cf070fe33bfb (\"can: isotp: serialize\nTX state transitions under so-\u003erx_lock\") which addresses following\nsashiko-bot findings:\n\n- isotp_sendmsg(): drain so-\u003etxfrtimer first so a stale callback can\u0027t\n re-arm echotimer after the claim\n\n- isotp_release(): wake so-\u003ewait after forcing ISOTP_SHUTDOWN so a\n sleeping sendmsg() claim isn\u0027t stranded\n\n- isotp_sendmsg(): have both wait_event_interruptible() calls in\n isotp_sendmsg() also wake on ISOTP_SHUTDOWN and do not return claim to\n IDLE to avoid corrupting a concurrent isotp_release() process.\n\n- isotp_sendmsg(): handle potential claim of a new transfer when\n the wait_event_interruptible() call returns in CAN_ISOTP_WAIT_TX_DONE\n mode. Don\u0027t touch timers and states of the new transfer if a new thread\n incremented so-\u003etx_gen before getting the lock at err_event_drop.\n\n- isotp_sendmsg(): handle a stuck can_send() and omit timer and state\n changes if a new transfer was claimed. wait_tx_done() returns the error\n recorded in so-\u003etx_result[], tagged with the caller\u0027s own generation.\n\n- isotp_tx_timeout(): on a claimed timeout, record the ECOMM error for\n the timed-out transfer\u0027s own generation in so-\u003etx_result[]; sk-\u003esk_err\n is raised unconditionally, same as every other error path here.\n\n- isotp_tx_gen_done()/isotp_tx_timeout(): always read tx.state (acquire)\n before tx_gen - the reverse order let a weakly ordered CPU pair a fresh\n tx.state with a stale tx_gen/tx_result slot.\n\n- isotp_sendmsg(): wait_tx_done: drain sk_err via sock_error() once we\n have read the result from so-\u003etx_result[], so an already-reported error\n doesn\u0027t stay latched for a later poll()/SO_ERROR.\n\nAlso align the remaining lock-free so-\u003etx.state/rx.state/cfecho accesses\nand use skb-\u003ehash as unique loopback echo frame indicator."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:05.854Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8acab9fc66d6f426c36968c91a979f70784945a7"
},
{
"url": "https://git.kernel.org/stable/c/af7e25c649ed68cbad07f8185af0f31b892cbf29"
},
{
"url": "https://git.kernel.org/stable/c/2753722612d8824d3910096f93059f669009b0f0"
},
{
"url": "https://git.kernel.org/stable/c/bf5c4a8b24acb12739ebb9aea5510b007e4f5239"
},
{
"url": "https://git.kernel.org/stable/c/deca7746b57d982cd4f0301f4443f56780c4a048"
},
{
"url": "https://git.kernel.org/stable/c/10be509fa8fd95d1e47d40d1f68b0b26dfe9d572"
},
{
"url": "https://git.kernel.org/stable/c/35c62ac98d06669aa3f0f38b7829eaca929a611e"
},
{
"url": "https://git.kernel.org/stable/c/050f010f920da17c1044a4f174766ad553e770b6"
}
],
"title": "can: isotp: fix timer drain order, wakeup handling and tx_gen ordering",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80889",
"datePublished": "2026-09-04T17:11:05.854Z",
"dateReserved": "2026-08-26T14:34:25.799Z",
"dateUpdated": "2026-09-04T17:11:05.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80888 (GCVE-0-2026-80888)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's
dma_buf->ops do not match the ttm_object_device's ops, but does so
without releasing the reference acquired by dma_buf_get(). Any
unprivileged renderD client passing a non-vmwgfx prime fd through the
DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per
call and indefinitely pins the foreign exporter's GEM resources.
Funnel the error path through the existing dma_buf_put() so the
reference is always dropped.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
65981f7681abdf92b25942222b629b9c512d0705 , < 619c3cfa88e09603a13d918f754808db2dda7057
(git)
Affected: 65981f7681abdf92b25942222b629b9c512d0705 , < c1c22fca0a0896a452a7cb92422d67babd65b4be (git) Affected: 65981f7681abdf92b25942222b629b9c512d0705 , < a1e972fa94c3a8069e022c67b9d97c7aa7b05293 (git) Affected: 65981f7681abdf92b25942222b629b9c512d0705 , < a8434b145b1e467940334c58c00af241e9494c5f (git) Affected: 65981f7681abdf92b25942222b629b9c512d0705 , < 4df39eb99bb47d1f24d1952c23b21b10988356bf (git) Affected: 65981f7681abdf92b25942222b629b9c512d0705 , < f739416dc555fa205a785e5135d73fa39b26f35d (git) |
|
| Linux | Linux |
Affected:
3.13
Unaffected: 0 , < 3.13 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/ttm_object.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "619c3cfa88e09603a13d918f754808db2dda7057",
"status": "affected",
"version": "65981f7681abdf92b25942222b629b9c512d0705",
"versionType": "git"
},
{
"lessThan": "c1c22fca0a0896a452a7cb92422d67babd65b4be",
"status": "affected",
"version": "65981f7681abdf92b25942222b629b9c512d0705",
"versionType": "git"
},
{
"lessThan": "a1e972fa94c3a8069e022c67b9d97c7aa7b05293",
"status": "affected",
"version": "65981f7681abdf92b25942222b629b9c512d0705",
"versionType": "git"
},
{
"lessThan": "a8434b145b1e467940334c58c00af241e9494c5f",
"status": "affected",
"version": "65981f7681abdf92b25942222b629b9c512d0705",
"versionType": "git"
},
{
"lessThan": "4df39eb99bb47d1f24d1952c23b21b10988356bf",
"status": "affected",
"version": "65981f7681abdf92b25942222b629b9c512d0705",
"versionType": "git"
},
{
"lessThan": "f739416dc555fa205a785e5135d73fa39b26f35d",
"status": "affected",
"version": "65981f7681abdf92b25942222b629b9c512d0705",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/ttm_object.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: drop dma_buf reference on foreign-fd prime import\n\nttm_prime_fd_to_handle() returns -ENOSYS when the imported fd\u0027s\ndma_buf-\u003eops do not match the ttm_object_device\u0027s ops, but does so\nwithout releasing the reference acquired by dma_buf_get(). Any\nunprivileged renderD client passing a non-vmwgfx prime fd through the\nDRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per\ncall and indefinitely pins the foreign exporter\u0027s GEM resources.\n\nFunnel the error path through the existing dma_buf_put() so the\nreference is always dropped."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:04.975Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/619c3cfa88e09603a13d918f754808db2dda7057"
},
{
"url": "https://git.kernel.org/stable/c/c1c22fca0a0896a452a7cb92422d67babd65b4be"
},
{
"url": "https://git.kernel.org/stable/c/a1e972fa94c3a8069e022c67b9d97c7aa7b05293"
},
{
"url": "https://git.kernel.org/stable/c/a8434b145b1e467940334c58c00af241e9494c5f"
},
{
"url": "https://git.kernel.org/stable/c/4df39eb99bb47d1f24d1952c23b21b10988356bf"
},
{
"url": "https://git.kernel.org/stable/c/f739416dc555fa205a785e5135d73fa39b26f35d"
}
],
"title": "drm/vmwgfx: drop dma_buf reference on foreign-fd prime import",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80888",
"datePublished": "2026-09-04T17:11:04.975Z",
"dateReserved": "2026-08-26T14:34:25.799Z",
"dateUpdated": "2026-09-04T17:11:04.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80887 (GCVE-0-2026-80887)
Vulnerability from nvd – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
drm/vmwgfx: use check_add_overflow for shader size+offset bound
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: use check_add_overflow for shader size+offset bound
vmw_shader_define() validates the user-supplied shader window against
its backing buffer with
(u64)buffer->tbo.base.size < (u64)size + (u64)offset
drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is
near U64_MAX the unsigned addition wraps and the resulting tiny value
passes the check. The unbounded offset is then stored in
res->guest_memory_offset and forwarded to host SVGA shader-create
commands.
Use check_add_overflow() to detect the wrap and compare the resulting
endpoint against the buffer size.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
668b206601c5f5063e03b76784a0d3024fa2b249 , < 1bbe7751f5ebac383405ef29a66622d65bd505d3
(git)
Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < d3f44438aa805270aaead3b6840ccaea0f4c11f9 (git) Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < cfd163169af3be56eaef113c680ea251f0d09189 (git) Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 5c725901908eb1e52a16fc0e2373cb761df42d21 (git) Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 54d56d5b42d2e4c72ba6e365e9774da90698aa22 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_shader.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1bbe7751f5ebac383405ef29a66622d65bd505d3",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "d3f44438aa805270aaead3b6840ccaea0f4c11f9",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "cfd163169af3be56eaef113c680ea251f0d09189",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "5c725901908eb1e52a16fc0e2373cb761df42d21",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "54d56d5b42d2e4c72ba6e365e9774da90698aa22",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_shader.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: use check_add_overflow for shader size+offset bound\n\nvmw_shader_define() validates the user-supplied shader window against\nits backing buffer with\n\n\t(u64)buffer-\u003etbo.base.size \u003c (u64)size + (u64)offset\n\ndrm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is\nnear U64_MAX the unsigned addition wraps and the resulting tiny value\npasses the check. The unbounded offset is then stored in\nres-\u003eguest_memory_offset and forwarded to host SVGA shader-create\ncommands.\n\nUse check_add_overflow() to detect the wrap and compare the resulting\nendpoint against the buffer size."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:04.063Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1bbe7751f5ebac383405ef29a66622d65bd505d3"
},
{
"url": "https://git.kernel.org/stable/c/d3f44438aa805270aaead3b6840ccaea0f4c11f9"
},
{
"url": "https://git.kernel.org/stable/c/cfd163169af3be56eaef113c680ea251f0d09189"
},
{
"url": "https://git.kernel.org/stable/c/5c725901908eb1e52a16fc0e2373cb761df42d21"
},
{
"url": "https://git.kernel.org/stable/c/54d56d5b42d2e4c72ba6e365e9774da90698aa22"
}
],
"title": "drm/vmwgfx: use check_add_overflow for shader size+offset bound",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80887",
"datePublished": "2026-09-04T17:11:04.063Z",
"dateReserved": "2026-08-26T14:34:25.799Z",
"dateUpdated": "2026-09-04T17:11:04.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80886 (GCVE-0-2026-80886)
Vulnerability from nvd – Published: 2026-09-04 16:49 – Updated: 2026-09-04 16:49
VLAI
EPSS
VEX
Title
serial: msm: Disable DMA for kernel console UART
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: msm: Disable DMA for kernel console UART
At the moment, concurrent writes from userspace and the kernel to the
console can trigger a race condition that results in an infinite loop of
the same messages printed over and over again. This is most likely to
happen during system startup or shutdown when the init system starts/stops
a large number of system services that interact with various kernel code.
When userspace writes to the TTY device, the driver initiates an
asynchronous DMA transfer and releases the port lock. At the same moment,
the kernel printk path might grab the port lock and re-configure the UART
controller for PIO, without waiting for the DMA operation to complete. It
seems like this collision results in zero progress being reported for the
DMA engine, so the same text is printed to the console over and over again.
For the kernel console, we want a reliable output path that will be
functional even during crashes etc. So rather than implementing complex
code to synchronize the kernel console write routines with the userspace
DMA write routines, simply disable DMA for the console UART instance.
Similar checks exist in many other serial drivers, e.g. 8250_port.c,
imx.c, sh-sci.c etc.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3a878c430fd6eb4f8587f9ebd187f773bf85d1d6 , < f58e568dc308c8e13f7730c8de2da5ed514e540d
(git)
Affected: 3a878c430fd6eb4f8587f9ebd187f773bf85d1d6 , < bb4296de5b538b575978c588cb3738ab8524d01a (git) Affected: 3a878c430fd6eb4f8587f9ebd187f773bf85d1d6 , < 6acea62738ed4cae6746483026706a773b44dad7 (git) Affected: 3a878c430fd6eb4f8587f9ebd187f773bf85d1d6 , < abc1926c88c189e5d698b91ed6890e09ab5c321d (git) Affected: 3a878c430fd6eb4f8587f9ebd187f773bf85d1d6 , < 2727744ccb5ca59090451451ee94f530b1be04a5 (git) Affected: 3a878c430fd6eb4f8587f9ebd187f773bf85d1d6 , < d354716245192de2d203f2b35f22ab8dc13595e2 (git) Affected: 3a878c430fd6eb4f8587f9ebd187f773bf85d1d6 , < e3b42e326f4f30efcdc90bad5f5ba37e1cd91a47 (git) Affected: 3a878c430fd6eb4f8587f9ebd187f773bf85d1d6 , < 22dd2777e6c180e1c945b00f6d18550979436324 (git) |
|
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/msm_serial.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f58e568dc308c8e13f7730c8de2da5ed514e540d",
"status": "affected",
"version": "3a878c430fd6eb4f8587f9ebd187f773bf85d1d6",
"versionType": "git"
},
{
"lessThan": "bb4296de5b538b575978c588cb3738ab8524d01a",
"status": "affected",
"version": "3a878c430fd6eb4f8587f9ebd187f773bf85d1d6",
"versionType": "git"
},
{
"lessThan": "6acea62738ed4cae6746483026706a773b44dad7",
"status": "affected",
"version": "3a878c430fd6eb4f8587f9ebd187f773bf85d1d6",
"versionType": "git"
},
{
"lessThan": "abc1926c88c189e5d698b91ed6890e09ab5c321d",
"status": "affected",
"version": "3a878c430fd6eb4f8587f9ebd187f773bf85d1d6",
"versionType": "git"
},
{
"lessThan": "2727744ccb5ca59090451451ee94f530b1be04a5",
"status": "affected",
"version": "3a878c430fd6eb4f8587f9ebd187f773bf85d1d6",
"versionType": "git"
},
{
"lessThan": "d354716245192de2d203f2b35f22ab8dc13595e2",
"status": "affected",
"version": "3a878c430fd6eb4f8587f9ebd187f773bf85d1d6",
"versionType": "git"
},
{
"lessThan": "e3b42e326f4f30efcdc90bad5f5ba37e1cd91a47",
"status": "affected",
"version": "3a878c430fd6eb4f8587f9ebd187f773bf85d1d6",
"versionType": "git"
},
{
"lessThan": "22dd2777e6c180e1c945b00f6d18550979436324",
"status": "affected",
"version": "3a878c430fd6eb4f8587f9ebd187f773bf85d1d6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/msm_serial.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: msm: Disable DMA for kernel console UART\n\nAt the moment, concurrent writes from userspace and the kernel to the\nconsole can trigger a race condition that results in an infinite loop of\nthe same messages printed over and over again. This is most likely to\nhappen during system startup or shutdown when the init system starts/stops\na large number of system services that interact with various kernel code.\n\nWhen userspace writes to the TTY device, the driver initiates an\nasynchronous DMA transfer and releases the port lock. At the same moment,\nthe kernel printk path might grab the port lock and re-configure the UART\ncontroller for PIO, without waiting for the DMA operation to complete. It\nseems like this collision results in zero progress being reported for the\nDMA engine, so the same text is printed to the console over and over again.\n\nFor the kernel console, we want a reliable output path that will be\nfunctional even during crashes etc. So rather than implementing complex\ncode to synchronize the kernel console write routines with the userspace\nDMA write routines, simply disable DMA for the console UART instance.\n\nSimilar checks exist in many other serial drivers, e.g. 8250_port.c,\nimx.c, sh-sci.c etc."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T16:49:35.864Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f58e568dc308c8e13f7730c8de2da5ed514e540d"
},
{
"url": "https://git.kernel.org/stable/c/bb4296de5b538b575978c588cb3738ab8524d01a"
},
{
"url": "https://git.kernel.org/stable/c/6acea62738ed4cae6746483026706a773b44dad7"
},
{
"url": "https://git.kernel.org/stable/c/abc1926c88c189e5d698b91ed6890e09ab5c321d"
},
{
"url": "https://git.kernel.org/stable/c/2727744ccb5ca59090451451ee94f530b1be04a5"
},
{
"url": "https://git.kernel.org/stable/c/d354716245192de2d203f2b35f22ab8dc13595e2"
},
{
"url": "https://git.kernel.org/stable/c/e3b42e326f4f30efcdc90bad5f5ba37e1cd91a47"
},
{
"url": "https://git.kernel.org/stable/c/22dd2777e6c180e1c945b00f6d18550979436324"
}
],
"title": "serial: msm: Disable DMA for kernel console UART",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80886",
"datePublished": "2026-09-04T16:49:35.864Z",
"dateReserved": "2026-08-26T14:34:25.799Z",
"dateUpdated": "2026-09-04T16:49:35.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80885 (GCVE-0-2026-80885)
Vulnerability from nvd – Published: 2026-09-04 16:49 – Updated: 2026-09-04 16:49
VLAI
EPSS
VEX
Title
afs: Fix uncancelled rxrpc OOB message handler
Summary
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix uncancelled rxrpc OOB message handler
Fix AFS to cancel its OOB message processing (typically to respond to
security challenges). Also move OOB message processing to afs_wq so that
it's also waited for and make the OOB handler just return if the net
namespace is no longer live.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5800b1cf3fd8ccab752a101865be1e76dac33142 , < 231414253b648b3518b56f09710b831945d6a2fc
(git)
Affected: 5800b1cf3fd8ccab752a101865be1e76dac33142 , < d14e96ddd616c8a9fff3b5bab3bf4af0cfc30ec4 (git) Affected: 5800b1cf3fd8ccab752a101865be1e76dac33142 , < a4057e58b07005d0fe0491bdbf1868c1491909ee (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/afs/cm_security.c",
"fs/afs/rxrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "231414253b648b3518b56f09710b831945d6a2fc",
"status": "affected",
"version": "5800b1cf3fd8ccab752a101865be1e76dac33142",
"versionType": "git"
},
{
"lessThan": "d14e96ddd616c8a9fff3b5bab3bf4af0cfc30ec4",
"status": "affected",
"version": "5800b1cf3fd8ccab752a101865be1e76dac33142",
"versionType": "git"
},
{
"lessThan": "a4057e58b07005d0fe0491bdbf1868c1491909ee",
"status": "affected",
"version": "5800b1cf3fd8ccab752a101865be1e76dac33142",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/afs/cm_security.c",
"fs/afs/rxrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix uncancelled rxrpc OOB message handler\n\nFix AFS to cancel its OOB message processing (typically to respond to\nsecurity challenges). Also move OOB message processing to afs_wq so that\nit\u0027s also waited for and make the OOB handler just return if the net\nnamespace is no longer live."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T16:49:34.486Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/231414253b648b3518b56f09710b831945d6a2fc"
},
{
"url": "https://git.kernel.org/stable/c/d14e96ddd616c8a9fff3b5bab3bf4af0cfc30ec4"
},
{
"url": "https://git.kernel.org/stable/c/a4057e58b07005d0fe0491bdbf1868c1491909ee"
}
],
"title": "afs: Fix uncancelled rxrpc OOB message handler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80885",
"datePublished": "2026-09-04T16:49:34.486Z",
"dateReserved": "2026-08-26T14:34:25.799Z",
"dateUpdated": "2026-09-04T16:49:34.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80884 (GCVE-0-2026-80884)
Vulnerability from nvd – Published: 2026-09-04 16:49 – Updated: 2026-09-04 16:49
VLAI
EPSS
VEX
Title
ntb: Store original DMA address for future release
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntb: Store original DMA address for future release
The DMA API requires that dma_free_attrs receive the exact dma_handle
originally returned by the allocation function. Do not modify it.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fc5d1829f9bf3d8275322727c0e9a8baf268b7c6 , < 10662aafce4acd52278c942d0a5b3993594017b9
(git)
Affected: fc5d1829f9bf3d8275322727c0e9a8baf268b7c6 , < da6d997ac556479c112554ab5d95cbd04683eb11 (git) |
|
| Linux | Linux |
Affected:
4.20
Unaffected: 0 , < 4.20 (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ntb/ntb_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10662aafce4acd52278c942d0a5b3993594017b9",
"status": "affected",
"version": "fc5d1829f9bf3d8275322727c0e9a8baf268b7c6",
"versionType": "git"
},
{
"lessThan": "da6d997ac556479c112554ab5d95cbd04683eb11",
"status": "affected",
"version": "fc5d1829f9bf3d8275322727c0e9a8baf268b7c6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ntb/ntb_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: Store original DMA address for future release\n\nThe DMA API requires that dma_free_attrs receive the exact dma_handle\noriginally returned by the allocation function. Do not modify it."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T16:49:31.751Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10662aafce4acd52278c942d0a5b3993594017b9"
},
{
"url": "https://git.kernel.org/stable/c/da6d997ac556479c112554ab5d95cbd04683eb11"
}
],
"title": "ntb: Store original DMA address for future release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80884",
"datePublished": "2026-09-04T16:49:31.751Z",
"dateReserved": "2026-08-26T14:34:25.799Z",
"dateUpdated": "2026-09-04T16:49:31.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}