Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
18678 vulnerabilities by Linux
CVE-2026-80589 (GCVE-0-2026-80589)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
block: stop the timeout timer when releasing a never added disk
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: stop the timeout timer when releasing a never added disk
disk_release() undoes blk_mq_init_allocated_queue() for a disk whose
probe failed before add_disk(), but it only calls blk_mq_exit_queue().
Nothing there stops q->timeout, and that timer rolls forward: it stays
pending until it next expires, not until the last request completes.
So if the driver issued any I/O before adding the disk, the
request_queue is freed while still linked into a timer wheel bucket.
Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the
blk_cleanup_queue() call that used to stop it. __del_gendisk() and
blk_mq_destroy_queue() still do; only the probe failure path lost it.
nvme gets there because nvme_update_ns_info() submits Report Zones or
FDP io-mgmt-recv on ns->queue before the disk is added, so a later
failure - a concurrent reset setting NVME_CTRL_FROZEN, or
device_add_disk() failing - lands in put_disk() with the timer armed:
BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340
Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37
__timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621
blk_sync_queue+0x22/0x40 block/blk-core.c:222
nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362
nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264
Allocated by task 34:
__blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462
nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146
Freed by task 0:
blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254
rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857
The queue being synced there is ctrl->admin_q, only a victim sharing a
timer wheel bucket with the freed queue's dangling entry; other runs
tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work().
Failing nvme_alloc_ns() with a debug patch makes it deterministic: one
leaked timer trips KASAN within seconds, while 1987 patched releases
produced no splat.
Stop the timer and the queue work items before blk_mq_exit_queue(), like
blk_mq_destroy_queue() does.
Found by FuzzNvme.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < 6ae7364f68e6c7af6b6df4bbb14040b89e5975d0
(git)
Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < 6f06dbe5012c160e0dba418a5a9cb16c456ad46a (git) Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < 1a0ae4d502062a2759f2a92d12bdeab3c64c7372 (git) Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < bb03b56d1d754908a37a160603be21769da423cf (git) Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < 93d620519d71dfc6ee64b5baea74f1d85d4439fb (git) Affected: 6f8191fdf41d3a53cc1d63fe2234e812c55a0092 , < 26cb8ebbfaf713c82e142d08828d4d765057633b (git) Affected: d27b66257db183fe11c10f31246ae965adb005d3 (git) Affected: 5.19.12 , < 5.20 (semver) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/genhd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6ae7364f68e6c7af6b6df4bbb14040b89e5975d0",
"status": "affected",
"version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
"versionType": "git"
},
{
"lessThan": "6f06dbe5012c160e0dba418a5a9cb16c456ad46a",
"status": "affected",
"version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
"versionType": "git"
},
{
"lessThan": "1a0ae4d502062a2759f2a92d12bdeab3c64c7372",
"status": "affected",
"version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
"versionType": "git"
},
{
"lessThan": "bb03b56d1d754908a37a160603be21769da423cf",
"status": "affected",
"version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
"versionType": "git"
},
{
"lessThan": "93d620519d71dfc6ee64b5baea74f1d85d4439fb",
"status": "affected",
"version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
"versionType": "git"
},
{
"lessThan": "26cb8ebbfaf713c82e142d08828d4d765057633b",
"status": "affected",
"version": "6f8191fdf41d3a53cc1d63fe2234e812c55a0092",
"versionType": "git"
},
{
"status": "affected",
"version": "d27b66257db183fe11c10f31246ae965adb005d3",
"versionType": "git"
},
{
"lessThan": "5.20",
"status": "affected",
"version": "5.19.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/genhd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: stop the timeout timer when releasing a never added disk\n\ndisk_release() undoes blk_mq_init_allocated_queue() for a disk whose\nprobe failed before add_disk(), but it only calls blk_mq_exit_queue().\nNothing there stops q-\u003etimeout, and that timer rolls forward: it stays\npending until it next expires, not until the last request completes.\nSo if the driver issued any I/O before adding the disk, the\nrequest_queue is freed while still linked into a timer wheel bucket.\n\nCommit 6f8191fdf41d (\"block: simplify disk shutdown\") dropped the\nblk_cleanup_queue() call that used to stop it. __del_gendisk() and\nblk_mq_destroy_queue() still do; only the probe failure path lost it.\n\nnvme gets there because nvme_update_ns_info() submits Report Zones or\nFDP io-mgmt-recv on ns-\u003equeue before the disk is added, so a later\nfailure - a concurrent reset setting NVME_CTRL_FROZEN, or\ndevice_add_disk() failing - lands in put_disk() with the timer armed:\n\n BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340\n Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37\n __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621\n blk_sync_queue+0x22/0x40 block/blk-core.c:222\n nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362\n nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264\n\n Allocated by task 34:\n __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462\n nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146\n\n Freed by task 0:\n blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254\n rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857\n\nThe queue being synced there is ctrl-\u003eadmin_q, only a victim sharing a\ntimer wheel bucket with the freed queue\u0027s dangling entry; other runs\ntripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work().\nFailing nvme_alloc_ns() with a debug patch makes it deterministic: one\nleaked timer trips KASAN within seconds, while 1987 patched releases\nproduced no splat.\n\nStop the timer and the queue work items before blk_mq_exit_queue(), like\nblk_mq_destroy_queue() does.\n\nFound by FuzzNvme."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:43.293Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6ae7364f68e6c7af6b6df4bbb14040b89e5975d0"
},
{
"url": "https://git.kernel.org/stable/c/6f06dbe5012c160e0dba418a5a9cb16c456ad46a"
},
{
"url": "https://git.kernel.org/stable/c/1a0ae4d502062a2759f2a92d12bdeab3c64c7372"
},
{
"url": "https://git.kernel.org/stable/c/bb03b56d1d754908a37a160603be21769da423cf"
},
{
"url": "https://git.kernel.org/stable/c/93d620519d71dfc6ee64b5baea74f1d85d4439fb"
},
{
"url": "https://git.kernel.org/stable/c/26cb8ebbfaf713c82e142d08828d4d765057633b"
}
],
"title": "block: stop the timeout timer when releasing a never added disk",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80589",
"datePublished": "2026-08-26T14:37:43.293Z",
"dateReserved": "2026-08-26T14:34:25.770Z",
"dateUpdated": "2026-08-26T14:37:43.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80588 (GCVE-0-2026-80588)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
mptcp: reclaim forward-allocated memory on RX path errors
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: reclaim forward-allocated memory on RX path errors
After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"),
errors in the receive path prior to queueing skbs into the receive
queue do not trigger forward-allocated memory reclaiming.
Prevent forward memory from growing unboundedly in pathological drop
scenarios by explicitly reclaiming memory when skbs are dropped.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a84164847b1e0a106ebc46821e5d2f9b775c9dc8 , < 473f1a5ab2abc98dd9e74b95b9c23c66c47535cc
(git)
Affected: 9db5b3cec4ec1c0cd3239689f5c8653d691a1754 , < 8277f48a06d3aa1441f6d0b6998ccc0360d30ed8 (git) Affected: 9db5b3cec4ec1c0cd3239689f5c8653d691a1754 , < 41b49a8b914ec7dcb03eae93fb27f3c464078644 (git) Affected: 6.18.35 , < 6.18.46 (semver) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "473f1a5ab2abc98dd9e74b95b9c23c66c47535cc",
"status": "affected",
"version": "a84164847b1e0a106ebc46821e5d2f9b775c9dc8",
"versionType": "git"
},
{
"lessThan": "8277f48a06d3aa1441f6d0b6998ccc0360d30ed8",
"status": "affected",
"version": "9db5b3cec4ec1c0cd3239689f5c8653d691a1754",
"versionType": "git"
},
{
"lessThan": "41b49a8b914ec7dcb03eae93fb27f3c464078644",
"status": "affected",
"version": "9db5b3cec4ec1c0cd3239689f5c8653d691a1754",
"versionType": "git"
},
{
"lessThan": "6.18.46",
"status": "affected",
"version": "6.18.35",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.18.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: reclaim forward-allocated memory on RX path errors\n\nAfter commit 9db5b3cec4ec (\"mptcp: borrow forward memory from subflow\"),\nerrors in the receive path prior to queueing skbs into the receive\nqueue do not trigger forward-allocated memory reclaiming.\n\nPrevent forward memory from growing unboundedly in pathological drop\nscenarios by explicitly reclaiming memory when skbs are dropped."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:42.685Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/473f1a5ab2abc98dd9e74b95b9c23c66c47535cc"
},
{
"url": "https://git.kernel.org/stable/c/8277f48a06d3aa1441f6d0b6998ccc0360d30ed8"
},
{
"url": "https://git.kernel.org/stable/c/41b49a8b914ec7dcb03eae93fb27f3c464078644"
}
],
"title": "mptcp: reclaim forward-allocated memory on RX path errors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80588",
"datePublished": "2026-08-26T14:37:42.685Z",
"dateReserved": "2026-08-26T14:34:25.770Z",
"dateUpdated": "2026-08-26T14:37:42.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80587 (GCVE-0-2026-80587)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
mptcp: avoid combining some incoming suboptions
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: avoid combining some incoming suboptions
Some MPTCP suboptions are mutually exclusive according to the RFC8684,
but also because in different places, the code doesn't expect some
combinations to be present. That's specially true for suboptions that
would be present twice, but with different attributes.
The new restrictions are the same as the ones applied on the output
side, with mptcp_write_options. The same rules can be reused with a
small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks
this option [1], which is not the case on Linux. Here are the rules:
Which options can be used together?
X: mutually exclusive
O: often used together
C: can be used together in some cases
P: could be used together but we prefer not to (optimisations)
| Opt: | MPC | MPJ | DSS | ADD | RM | PRIO | FAIL | FC |
|------|------|------|------|------|------|------|------|------|
| MPC |------|------|------|------|------|------|------|------|
| MPJ | X |------|------|------|------|------|------|------|
| DSS | X | X |------|------|------|------|------|------|
| ADD | X | X | P |------|------|------|------|------|
| RM | C | C | C | P |------|------|------|------|
| PRIO | X | C | C | C | C |------|------|------|
| FAIL | X | X | C | X | X | X |------|------|
| FC | X | X | P | X | X | X | X |------|
| RST | X | X | X | X | X | X | O | O |
|------|------|------|------|------|------|------|------|------|
The only difference is with the 'P': another stack could send and
ADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be
allowed.
A few points of attention:
- In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is
no reason to add it with a SYN. Note that even with a 4th ACK, it
doesn't seem to be useful, except when IDs are known in advance via
another channel. Better not to break that.
- Now, combining both an MP_CAPABLE and an MP_JOIN will no longer
result to a reject of the two options, but only the second suboption
is ignored. That seems OK to do that for this unexpected error. At
least now all inconsistent combinations are handled the same way.
This could change later in next. This also means the explicit checks
for having both MPC + MPJ in subflow.c will now be unreachable.
That's fine, they will be removed in a follow-up patch.
- In case of conflicting combinations, the extra suboption(s) is/are
ignored: having such combinations either means the remote peer is
buggy, or is evil. The simplest action is then taken in this case:
stop processing the current suboption.
- In mp_opt->suboptions, there is also a bit reserved to the checksum,
which can be used in an MP_CAPABLE and a DSS. Each time a DSS option
can be used in parallel with another option, the checksum can be set,
so the verification is combined into a new OPTIONS_MPTCP_DSS macro.
- An MP_CAPABLE ACK can carry a Data-Level Length, and an optional
Checksum: they are the same as the ones found in a DSS, because a DSS
cannot be used in parallel to an MP_CAPABLE. Similarly, even if there
is room, a DSS cannot be used with an MP_JOIN.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < dc1d8d3eb345c616fbe922a010fa391c72c54d52
(git)
Affected: eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < 099bfcbd0c16ae9b50aba2a1bea033e63f895da7 (git) Affected: eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < a04dcc784959e4702048785d87e0d029bd2fbdcb (git) Affected: eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < 6bab907292155513af397a12ccb488acbfc30d79 (git) Affected: eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < b6ee361524641f57b2e2363f7737f20e17f67827 (git) |
|
| Linux | Linux |
Affected:
5.6
Unaffected: 0 , < 5.6 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/options.c",
"net/mptcp/protocol.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dc1d8d3eb345c616fbe922a010fa391c72c54d52",
"status": "affected",
"version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
"versionType": "git"
},
{
"lessThan": "099bfcbd0c16ae9b50aba2a1bea033e63f895da7",
"status": "affected",
"version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
"versionType": "git"
},
{
"lessThan": "a04dcc784959e4702048785d87e0d029bd2fbdcb",
"status": "affected",
"version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
"versionType": "git"
},
{
"lessThan": "6bab907292155513af397a12ccb488acbfc30d79",
"status": "affected",
"version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
"versionType": "git"
},
{
"lessThan": "b6ee361524641f57b2e2363f7737f20e17f67827",
"status": "affected",
"version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/options.c",
"net/mptcp/protocol.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid combining some incoming suboptions\n\nSome MPTCP suboptions are mutually exclusive according to the RFC8684,\nbut also because in different places, the code doesn\u0027t expect some\ncombinations to be present. That\u0027s specially true for suboptions that\nwould be present twice, but with different attributes.\n\nThe new restrictions are the same as the ones applied on the output\nside, with mptcp_write_options. The same rules can be reused with a\nsmall fix: an MP_FASTCLOSE can be used with a DSS when the sender picks\nthis option [1], which is not the case on Linux. Here are the rules:\n\n Which options can be used together?\n\n X: mutually exclusive\n O: often used together\n C: can be used together in some cases\n P: could be used together but we prefer not to (optimisations)\n\n | Opt: | MPC | MPJ | DSS | ADD | RM | PRIO | FAIL | FC |\n |------|------|------|------|------|------|------|------|------|\n | MPC |------|------|------|------|------|------|------|------|\n | MPJ | X |------|------|------|------|------|------|------|\n | DSS | X | X |------|------|------|------|------|------|\n | ADD | X | X | P |------|------|------|------|------|\n | RM | C | C | C | P |------|------|------|------|\n | PRIO | X | C | C | C | C |------|------|------|\n | FAIL | X | X | C | X | X | X |------|------|\n | FC | X | X | P | X | X | X | X |------|\n | RST | X | X | X | X | X | X | O | O |\n |------|------|------|------|------|------|------|------|------|\n\nThe only difference is with the \u0027P\u0027: another stack could send and\nADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be\nallowed.\n\nA few points of attention:\n\n - In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is\n no reason to add it with a SYN. Note that even with a 4th ACK, it\n doesn\u0027t seem to be useful, except when IDs are known in advance via\n another channel. Better not to break that.\n\n - Now, combining both an MP_CAPABLE and an MP_JOIN will no longer\n result to a reject of the two options, but only the second suboption\n is ignored. That seems OK to do that for this unexpected error. At\n least now all inconsistent combinations are handled the same way.\n This could change later in next. This also means the explicit checks\n for having both MPC + MPJ in subflow.c will now be unreachable.\n That\u0027s fine, they will be removed in a follow-up patch.\n\n - In case of conflicting combinations, the extra suboption(s) is/are\n ignored: having such combinations either means the remote peer is\n buggy, or is evil. The simplest action is then taken in this case:\n stop processing the current suboption.\n\n - In mp_opt-\u003esuboptions, there is also a bit reserved to the checksum,\n which can be used in an MP_CAPABLE and a DSS. Each time a DSS option\n can be used in parallel with another option, the checksum can be set,\n so the verification is combined into a new OPTIONS_MPTCP_DSS macro.\n\n - An MP_CAPABLE ACK can carry a Data-Level Length, and an optional\n Checksum: they are the same as the ones found in a DSS, because a DSS\n cannot be used in parallel to an MP_CAPABLE. Similarly, even if there\n is room, a DSS cannot be used with an MP_JOIN."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:42.093Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dc1d8d3eb345c616fbe922a010fa391c72c54d52"
},
{
"url": "https://git.kernel.org/stable/c/099bfcbd0c16ae9b50aba2a1bea033e63f895da7"
},
{
"url": "https://git.kernel.org/stable/c/a04dcc784959e4702048785d87e0d029bd2fbdcb"
},
{
"url": "https://git.kernel.org/stable/c/6bab907292155513af397a12ccb488acbfc30d79"
},
{
"url": "https://git.kernel.org/stable/c/b6ee361524641f57b2e2363f7737f20e17f67827"
}
],
"title": "mptcp: avoid combining some incoming suboptions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80587",
"datePublished": "2026-08-26T14:37:42.093Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-26T14:37:42.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80586 (GCVE-0-2026-80586)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
mptcp: options: reset DSS fields in case of unexpected size
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: options: reset DSS fields in case of unexpected size
A remote peer could send a malformed DSS with a wrong size, followed by
another DSS or MPC + Data. In this case, the first suboption will be
ignored, but leaving some fields written, which could lead to
inconsistency or access uninitialized data.
Explicitly reset the fields that could have been modified in case of
unexpected size.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
648ef4b88673dadb8463bf0d4b10fbf33d55def8 , < 15e35fdad7a5576bf3f1c8d688877aeb5d1b506b
(git)
Affected: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 , < b1256090816ec46011601e084be580731df58fc7 (git) Affected: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 , < 192878df582c51d440bf7b91a15f297f29f2b596 (git) Affected: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 , < 26dac5c9ffb20812b475fdf253eb04fab99cff3b (git) Affected: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 , < 4e80eff5c1c893aca2ac1d202f0b256d2e52ecde (git) Affected: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 , < 1fade1b2ac5b1a4948e538fae7313bea57b5ac36 (git) Affected: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 , < 27ed642a4e7e4b5df4b8522c72c457a67e052493 (git) Affected: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 , < 35772b4981f38ba8059372cde8753e8e477e98ec (git) |
|
| Linux | Linux |
Affected:
5.6
Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/options.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "15e35fdad7a5576bf3f1c8d688877aeb5d1b506b",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "b1256090816ec46011601e084be580731df58fc7",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "192878df582c51d440bf7b91a15f297f29f2b596",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "26dac5c9ffb20812b475fdf253eb04fab99cff3b",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "4e80eff5c1c893aca2ac1d202f0b256d2e52ecde",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "1fade1b2ac5b1a4948e538fae7313bea57b5ac36",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "27ed642a4e7e4b5df4b8522c72c457a67e052493",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "35772b4981f38ba8059372cde8753e8e477e98ec",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/options.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: options: reset DSS fields in case of unexpected size\n\nA remote peer could send a malformed DSS with a wrong size, followed by\nanother DSS or MPC + Data. In this case, the first suboption will be\nignored, but leaving some fields written, which could lead to\ninconsistency or access uninitialized data.\n\nExplicitly reset the fields that could have been modified in case of\nunexpected size."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:41.493Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/15e35fdad7a5576bf3f1c8d688877aeb5d1b506b"
},
{
"url": "https://git.kernel.org/stable/c/b1256090816ec46011601e084be580731df58fc7"
},
{
"url": "https://git.kernel.org/stable/c/192878df582c51d440bf7b91a15f297f29f2b596"
},
{
"url": "https://git.kernel.org/stable/c/26dac5c9ffb20812b475fdf253eb04fab99cff3b"
},
{
"url": "https://git.kernel.org/stable/c/4e80eff5c1c893aca2ac1d202f0b256d2e52ecde"
},
{
"url": "https://git.kernel.org/stable/c/1fade1b2ac5b1a4948e538fae7313bea57b5ac36"
},
{
"url": "https://git.kernel.org/stable/c/27ed642a4e7e4b5df4b8522c72c457a67e052493"
},
{
"url": "https://git.kernel.org/stable/c/35772b4981f38ba8059372cde8753e8e477e98ec"
}
],
"title": "mptcp: options: reset DSS fields in case of unexpected size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80586",
"datePublished": "2026-08-26T14:37:41.493Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-26T14:37:41.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80585 (GCVE-0-2026-80585)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
mptcp: fastopen: only mark MPTFO subflows with SYN data
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fastopen: only mark MPTFO subflows with SYN data
Passive TCP Fast Open accepts a valid-cookie SYN even when it carries
no data. In that case the child socket's receive queue is intentionally
left empty.
mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking
for queued SYN data. That made data-less TFO SYNs hit a WARN and, if
the warning was non-fatal, left stale MPTFO state behind. The stale
flag could later trigger a state-confusion bug in
check_fully_established().
Only mark the subflow as MPTFO after confirming that an SKB was queued.
Return quietly when the receive queue is empty.
Note that mptcp_subflow_context's is_mptfo field is now not just about
subflows where the TFO was present, but about MPTFO subflow that
consumed SYN data. Only having a valid cookie but not carrying data is
not really "doing TFO".
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
36b122baf6a8bd46b4a591f12f4ed17b22257408 , < f75f174edc865738522e514d042cf5627f084859
(git)
Affected: 36b122baf6a8bd46b4a591f12f4ed17b22257408 , < fca7e444c04689fe4cc6b56f2725f804a4bb1ef9 (git) Affected: 36b122baf6a8bd46b4a591f12f4ed17b22257408 , < 75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5 (git) Affected: 36b122baf6a8bd46b4a591f12f4ed17b22257408 , < 72b4a0c51a4b550d40301d60a366b429b8c8e78d (git) Affected: 36b122baf6a8bd46b4a591f12f4ed17b22257408 , < e00b63056fb4f261455b3e5df5268a1f8ce47a87 (git) |
|
| Linux | Linux |
Affected:
6.2
Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/fastopen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f75f174edc865738522e514d042cf5627f084859",
"status": "affected",
"version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
"versionType": "git"
},
{
"lessThan": "fca7e444c04689fe4cc6b56f2725f804a4bb1ef9",
"status": "affected",
"version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
"versionType": "git"
},
{
"lessThan": "75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5",
"status": "affected",
"version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
"versionType": "git"
},
{
"lessThan": "72b4a0c51a4b550d40301d60a366b429b8c8e78d",
"status": "affected",
"version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
"versionType": "git"
},
{
"lessThan": "e00b63056fb4f261455b3e5df5268a1f8ce47a87",
"status": "affected",
"version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/fastopen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fastopen: only mark MPTFO subflows with SYN data\n\nPassive TCP Fast Open accepts a valid-cookie SYN even when it carries\nno data. In that case the child socket\u0027s receive queue is intentionally\nleft empty.\n\nmptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking\nfor queued SYN data. That made data-less TFO SYNs hit a WARN and, if\nthe warning was non-fatal, left stale MPTFO state behind. The stale\nflag could later trigger a state-confusion bug in\ncheck_fully_established().\n\nOnly mark the subflow as MPTFO after confirming that an SKB was queued.\nReturn quietly when the receive queue is empty.\n\nNote that mptcp_subflow_context\u0027s is_mptfo field is now not just about\nsubflows where the TFO was present, but about MPTFO subflow that\nconsumed SYN data. Only having a valid cookie but not carrying data is\nnot really \"doing TFO\"."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:40.901Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f75f174edc865738522e514d042cf5627f084859"
},
{
"url": "https://git.kernel.org/stable/c/fca7e444c04689fe4cc6b56f2725f804a4bb1ef9"
},
{
"url": "https://git.kernel.org/stable/c/75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5"
},
{
"url": "https://git.kernel.org/stable/c/72b4a0c51a4b550d40301d60a366b429b8c8e78d"
},
{
"url": "https://git.kernel.org/stable/c/e00b63056fb4f261455b3e5df5268a1f8ce47a87"
}
],
"title": "mptcp: fastopen: only mark MPTFO subflows with SYN data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80585",
"datePublished": "2026-08-26T14:37:40.901Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-26T14:37:40.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80584 (GCVE-0-2026-80584)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by
a user-supplied length (udata_len) without checking a lower bound, then
set udata_offset to a fixed non-zero value and pass both to a reply
callback. The callback bounds-checks the copy with
if ((udata_len - udata_offset) < len)
Both fields are u32, so a udata_len smaller than udata_offset makes the
subtraction wrap and the check pass, and the following memcpy() writes
past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from
kzalloc(), which the existing NULL check does not catch.
Reject buffers smaller than udata_offset before allocating, so the
callback subtraction can no longer underflow.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4a71df50047f0db65ea09b1be155852e81a45eba , < 9d00eeb2d27f4cc817c5e408760226d43f811ec6
(git)
Affected: 4a71df50047f0db65ea09b1be155852e81a45eba , < 46443eaddebd84c51940857b11787229be169dec (git) Affected: 4a71df50047f0db65ea09b1be155852e81a45eba , < 91935843f9396a9e45253e2c0d4337ca1371754b (git) Affected: 4a71df50047f0db65ea09b1be155852e81a45eba , < cc423f4105fe145b33e1d7cad34245a798358f73 (git) Affected: 4a71df50047f0db65ea09b1be155852e81a45eba , < 3083818e67bcd656965797fbac9a3d6c1d44f78a (git) Affected: 4a71df50047f0db65ea09b1be155852e81a45eba , < a3083647747942ea32faf14560d6397ff3068046 (git) Affected: 4a71df50047f0db65ea09b1be155852e81a45eba , < 75fb3151513d7d9f77a8f9545418279b119c06b8 (git) Affected: 4a71df50047f0db65ea09b1be155852e81a45eba , < d141f087b1af656f055d7c5793a3e87817ba0bbe (git) |
|
| Linux | Linux |
Affected:
2.6.26
Unaffected: 0 , < 2.6.26 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/net/qeth_core_main.c",
"drivers/s390/net/qeth_l3_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9d00eeb2d27f4cc817c5e408760226d43f811ec6",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "46443eaddebd84c51940857b11787229be169dec",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "91935843f9396a9e45253e2c0d4337ca1371754b",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "cc423f4105fe145b33e1d7cad34245a798358f73",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "3083818e67bcd656965797fbac9a3d6c1d44f78a",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "a3083647747942ea32faf14560d6397ff3068046",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "75fb3151513d7d9f77a8f9545418279b119c06b8",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "d141f087b1af656f055d7c5793a3e87817ba0bbe",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/net/qeth_core_main.c",
"drivers/s390/net/qeth_l3_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/qeth: validate user buffer length in SNMP and ARP query ioctls\n\nqeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by\na user-supplied length (udata_len) without checking a lower bound, then\nset udata_offset to a fixed non-zero value and pass both to a reply\ncallback. The callback bounds-checks the copy with\n\n if ((udata_len - udata_offset) \u003c len)\n\nBoth fields are u32, so a udata_len smaller than udata_offset makes the\nsubtraction wrap and the check pass, and the following memcpy() writes\npast the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from\nkzalloc(), which the existing NULL check does not catch.\n\nReject buffers smaller than udata_offset before allocating, so the\ncallback subtraction can no longer underflow."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:40.302Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9d00eeb2d27f4cc817c5e408760226d43f811ec6"
},
{
"url": "https://git.kernel.org/stable/c/46443eaddebd84c51940857b11787229be169dec"
},
{
"url": "https://git.kernel.org/stable/c/91935843f9396a9e45253e2c0d4337ca1371754b"
},
{
"url": "https://git.kernel.org/stable/c/cc423f4105fe145b33e1d7cad34245a798358f73"
},
{
"url": "https://git.kernel.org/stable/c/3083818e67bcd656965797fbac9a3d6c1d44f78a"
},
{
"url": "https://git.kernel.org/stable/c/a3083647747942ea32faf14560d6397ff3068046"
},
{
"url": "https://git.kernel.org/stable/c/75fb3151513d7d9f77a8f9545418279b119c06b8"
},
{
"url": "https://git.kernel.org/stable/c/d141f087b1af656f055d7c5793a3e87817ba0bbe"
}
],
"title": "s390/qeth: validate user buffer length in SNMP and ARP query ioctls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80584",
"datePublished": "2026-08-26T14:37:40.302Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-26T14:37:40.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80583 (GCVE-0-2026-80583)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but
tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their
value through ucontrol->value.integer.value[0] (a long) instead of
ucontrol->value.enumerated.item[0] (an unsigned int).
This same pattern was fixed in the sibling drivers by
commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array
out of bounds for enum type") and
commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array
out of bounds for enum type"), but tx-macro was missed.
On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value
sanity check catches the 4 bytes written past the enumerated item
and every read of these controls fails with -EINVAL:
snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c39667ddcfc516fee084e449179d54430a558298 , < 3ee3c26ceee562079596abc9bc3307dd56dab4ed
(git)
Affected: c39667ddcfc516fee084e449179d54430a558298 , < 1ba381759e45d5d0442452cfa5c42e836191a568 (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/lpass-tx-macro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ee3c26ceee562079596abc9bc3307dd56dab4ed",
"status": "affected",
"version": "c39667ddcfc516fee084e449179d54430a558298",
"versionType": "git"
},
{
"lessThan": "1ba381759e45d5d0442452cfa5c42e836191a568",
"status": "affected",
"version": "c39667ddcfc516fee084e449179d54430a558298",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/lpass-tx-macro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses\n\nThe \"DEC0 MODE\" to \"DEC7 MODE\" controls are enumerated, but\ntx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their\nvalue through ucontrol-\u003evalue.integer.value[0] (a long) instead of\nucontrol-\u003evalue.enumerated.item[0] (an unsigned int).\n\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but tx-macro was missed.\n\nOn 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value\nsanity check catches the 4 bytes written past the enumerated item\nand every read of these controls fails with -EINVAL:\n\n snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:39.704Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ee3c26ceee562079596abc9bc3307dd56dab4ed"
},
{
"url": "https://git.kernel.org/stable/c/1ba381759e45d5d0442452cfa5c42e836191a568"
}
],
"title": "ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80583",
"datePublished": "2026-08-26T14:37:39.704Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-26T14:37:39.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80582 (GCVE-0-2026-80582)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
drm/shmem_helper: Check VMA boundaries for PMD mappings
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/shmem_helper: Check VMA boundaries for PMD mappings
In the ->huge_fault handler do not install a PMD huge page
mapping if the huge page exceeds the boundaries of the VMA.
All other ->huge_fault handlers have similar checks and the
resulting mapping will trigger a VM_BUG_ON_VMA() if it ever
reaches copy_pmd_range().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fc3bbf34e643faa8678aabdc3810c60109f3435a , < 12803e89a1e593fd1e784dfe7453f5e392ccaff2
(git)
Affected: fc3bbf34e643faa8678aabdc3810c60109f3435a , < 617bbd08714857c1613d7c550d43a9092ec0fb97 (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_gem_shmem_helper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "12803e89a1e593fd1e784dfe7453f5e392ccaff2",
"status": "affected",
"version": "fc3bbf34e643faa8678aabdc3810c60109f3435a",
"versionType": "git"
},
{
"lessThan": "617bbd08714857c1613d7c550d43a9092ec0fb97",
"status": "affected",
"version": "fc3bbf34e643faa8678aabdc3810c60109f3435a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_gem_shmem_helper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/shmem_helper: Check VMA boundaries for PMD mappings\n\nIn the -\u003ehuge_fault handler do not install a PMD huge page\nmapping if the huge page exceeds the boundaries of the VMA.\n\nAll other -\u003ehuge_fault handlers have similar checks and the\nresulting mapping will trigger a VM_BUG_ON_VMA() if it ever\nreaches copy_pmd_range()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:39.113Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/12803e89a1e593fd1e784dfe7453f5e392ccaff2"
},
{
"url": "https://git.kernel.org/stable/c/617bbd08714857c1613d7c550d43a9092ec0fb97"
}
],
"title": "drm/shmem_helper: Check VMA boundaries for PMD mappings",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80582",
"datePublished": "2026-08-26T14:37:39.113Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-26T14:37:39.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80581 (GCVE-0-2026-80581)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
Ignore IPC errors for pipeline state change if the firmware state is
crashed or the IPC has timed out.
If the firmware has crashed the kernel still needs to go through the state
changes to reset its internal to be able to correctly work the next time
the DSP is booted up.
The case with IPC timeout is a bit more problematic, but it has been
rootcaused to be the result of system scheduling blockage and the firmware
did actually received and handled the message, but the reply handling got
blocked by issues outside of the SOF stack.
So far the best way to handle this is to continue with setting the state.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c40aad7c81e5fba34b70123ed7ce3397fa62a4d2 , < f2435a46dfa1a5693cf2664afd022db66ee58121
(git)
Affected: c40aad7c81e5fba34b70123ed7ce3397fa62a4d2 , < 6b512a5330ef1a41db7aff4b80c4e952b8d52f17 (git) Affected: c40aad7c81e5fba34b70123ed7ce3397fa62a4d2 , < 17661c67b206612cb3ba65d5ae726cd2015d0a53 (git) Affected: 3cac6eebea9b4bc5f041e157e45c76e212ad6759 (git) Affected: d153e8b154f9746ac969c85a4e6474760453647c (git) Affected: 6.6.23 , < 6.7 (semver) Affected: 6.7.11 , < 6.8 (semver) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc4-pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f2435a46dfa1a5693cf2664afd022db66ee58121",
"status": "affected",
"version": "c40aad7c81e5fba34b70123ed7ce3397fa62a4d2",
"versionType": "git"
},
{
"lessThan": "6b512a5330ef1a41db7aff4b80c4e952b8d52f17",
"status": "affected",
"version": "c40aad7c81e5fba34b70123ed7ce3397fa62a4d2",
"versionType": "git"
},
{
"lessThan": "17661c67b206612cb3ba65d5ae726cd2015d0a53",
"status": "affected",
"version": "c40aad7c81e5fba34b70123ed7ce3397fa62a4d2",
"versionType": "git"
},
{
"status": "affected",
"version": "3cac6eebea9b4bc5f041e157e45c76e212ad6759",
"versionType": "git"
},
{
"status": "affected",
"version": "d153e8b154f9746ac969c85a4e6474760453647c",
"versionType": "git"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.23",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc4-pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout\n\nIgnore IPC errors for pipeline state change if the firmware state is\ncrashed or the IPC has timed out.\n\nIf the firmware has crashed the kernel still needs to go through the state\nchanges to reset its internal to be able to correctly work the next time\nthe DSP is booted up.\n\nThe case with IPC timeout is a bit more problematic, but it has been\nrootcaused to be the result of system scheduling blockage and the firmware\ndid actually received and handled the message, but the reply handling got\nblocked by issues outside of the SOF stack.\nSo far the best way to handle this is to continue with setting the state."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:38.510Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f2435a46dfa1a5693cf2664afd022db66ee58121"
},
{
"url": "https://git.kernel.org/stable/c/6b512a5330ef1a41db7aff4b80c4e952b8d52f17"
},
{
"url": "https://git.kernel.org/stable/c/17661c67b206612cb3ba65d5ae726cd2015d0a53"
}
],
"title": "ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80581",
"datePublished": "2026-08-26T14:37:38.510Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-26T14:37:38.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80580 (GCVE-0-2026-80580)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
fbdev: bound mode sysfs output to the sysfs buffer
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: bound mode sysfs output to the sysfs buffer
mode_string() uses snprintf() which can return a value larger than the
remaining buffer space. show_modes() accumulates the return value into i
without checking whether i has reached PAGE_SIZE, causing the offset to
advance past the sysfs buffer if the modelist is long enough.
Add a size parameter to mode_string() and use scnprintf() to return
only the bytes actually written. Add an early return when offset
already exceeds the buffer. In show_modes(), stop accumulating once
the buffer is full.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 873a1aa15c313263f2e18b38cf525623cc4fabf6
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d15d51fb26e830af58f3f21964f1c09c239077ea (git) Affected: 0 , < 7.1.10 (semver) |
|
| Linux | Linux |
Unaffected:
7.1.10 , ≤ 7.1.*
(semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbsysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "873a1aa15c313263f2e18b38cf525623cc4fabf6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d15d51fb26e830af58f3f21964f1c09c239077ea",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7.1.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbsysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: bound mode sysfs output to the sysfs buffer\n\nmode_string() uses snprintf() which can return a value larger than the\nremaining buffer space. show_modes() accumulates the return value into i\nwithout checking whether i has reached PAGE_SIZE, causing the offset to\nadvance past the sysfs buffer if the modelist is long enough.\n\nAdd a size parameter to mode_string() and use scnprintf() to return\nonly the bytes actually written. Add an early return when offset\nalready exceeds the buffer. In show_modes(), stop accumulating once\nthe buffer is full."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:37.917Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/873a1aa15c313263f2e18b38cf525623cc4fabf6"
},
{
"url": "https://git.kernel.org/stable/c/d15d51fb26e830af58f3f21964f1c09c239077ea"
}
],
"title": "fbdev: bound mode sysfs output to the sysfs buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80580",
"datePublished": "2026-08-26T14:37:37.917Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-26T14:37:37.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80579 (GCVE-0-2026-80579)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
fbdev: clear fb_info->mode before deleting a videomode
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: clear fb_info->mode before deleting a videomode
fb_set_var() can delete a mode from info->modelist when userspace
passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code
checks that the mode being deleted is not the current info->var and
that fbcon is not using it, but it does not check fb_info->mode.
fb_info->mode may still point into the modelist entry being deleted.
If the entry is freed, later mode sysfs reads through show_mode() can
dereference a stale pointer.
Clear fb_info->mode before calling fb_delete_videomode() when it
matches the mode being removed.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ce7fef961c63229b22dec415fb988899f479d61f
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 95e647d2a5304a8fd11f1ba3c8502de700650131 (git) Affected: 0 , < 7.1.10 (semver) |
|
| Linux | Linux |
Unaffected:
7.1.10 , ≤ 7.1.*
(semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce7fef961c63229b22dec415fb988899f479d61f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "95e647d2a5304a8fd11f1ba3c8502de700650131",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7.1.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: clear fb_info-\u003emode before deleting a videomode\n\nfb_set_var() can delete a mode from info-\u003emodelist when userspace\npasses FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code\nchecks that the mode being deleted is not the current info-\u003evar and\nthat fbcon is not using it, but it does not check fb_info-\u003emode.\n\nfb_info-\u003emode may still point into the modelist entry being deleted.\nIf the entry is freed, later mode sysfs reads through show_mode() can\ndereference a stale pointer.\n\nClear fb_info-\u003emode before calling fb_delete_videomode() when it\nmatches the mode being removed."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:37.320Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce7fef961c63229b22dec415fb988899f479d61f"
},
{
"url": "https://git.kernel.org/stable/c/95e647d2a5304a8fd11f1ba3c8502de700650131"
}
],
"title": "fbdev: clear fb_info-\u003emode before deleting a videomode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80579",
"datePublished": "2026-08-26T14:37:37.320Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-26T14:37:37.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80578 (GCVE-0-2026-80578)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
fbdev: core: Fix pointer desynchronization in fb_io_read()
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: core: Fix pointer desynchronization in fb_io_read()
In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to
a faulty user buffer), the loop adjusts the chunk size 'c' and updates
the remaining 'count'. However, the hardware 'src' pointer has already
been eagerly advanced by the original chunk size.
If the loop is allowed to continue, the read will resume from an
incorrect, over-advanced offset. Since the remaining 'count' was only
decremented by the successful bytes, this desynchronization causes the
next iterations to execute more hardware reads than originally bounded,
eventually leading to out-of-bounds I/O reads.
Fix this by breaking out of the loop immediately upon a partial
copy_to_user(). A partial copy indicates a faulty user buffer, making
subsequent read attempts futile. Breaking out ensures we return the
number of successfully read bytes without risking out-of-bounds hardware
accesses in subsequent mismatched iterations.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6121cd9ef911432b14c2a17aefaf8cd2f3cfcdff , < 42bc07b4e5a3c8a02a433388f562a8f46d093e11
(git)
Affected: 6121cd9ef911432b14c2a17aefaf8cd2f3cfcdff , < 42a6d8126c194133eafab2b0fd5c8668ebfcba5b (git) Affected: 6121cd9ef911432b14c2a17aefaf8cd2f3cfcdff , < 7ff87a01ae3a8cd0208f7499386998223a8b5dba (git) Affected: 6121cd9ef911432b14c2a17aefaf8cd2f3cfcdff , < 7110b7b794a2aac2c5cf8eb06ebf2af724c74d50 (git) Affected: 6121cd9ef911432b14c2a17aefaf8cd2f3cfcdff , < 81cc73be40c6f028f1ee3f438ace46afe666dbae (git) |
|
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fb_io_fops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "42bc07b4e5a3c8a02a433388f562a8f46d093e11",
"status": "affected",
"version": "6121cd9ef911432b14c2a17aefaf8cd2f3cfcdff",
"versionType": "git"
},
{
"lessThan": "42a6d8126c194133eafab2b0fd5c8668ebfcba5b",
"status": "affected",
"version": "6121cd9ef911432b14c2a17aefaf8cd2f3cfcdff",
"versionType": "git"
},
{
"lessThan": "7ff87a01ae3a8cd0208f7499386998223a8b5dba",
"status": "affected",
"version": "6121cd9ef911432b14c2a17aefaf8cd2f3cfcdff",
"versionType": "git"
},
{
"lessThan": "7110b7b794a2aac2c5cf8eb06ebf2af724c74d50",
"status": "affected",
"version": "6121cd9ef911432b14c2a17aefaf8cd2f3cfcdff",
"versionType": "git"
},
{
"lessThan": "81cc73be40c6f028f1ee3f438ace46afe666dbae",
"status": "affected",
"version": "6121cd9ef911432b14c2a17aefaf8cd2f3cfcdff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fb_io_fops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: core: Fix pointer desynchronization in fb_io_read()\n\nIn fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to\na faulty user buffer), the loop adjusts the chunk size \u0027c\u0027 and updates\nthe remaining \u0027count\u0027. However, the hardware \u0027src\u0027 pointer has already\nbeen eagerly advanced by the original chunk size.\n\nIf the loop is allowed to continue, the read will resume from an\nincorrect, over-advanced offset. Since the remaining \u0027count\u0027 was only\ndecremented by the successful bytes, this desynchronization causes the\nnext iterations to execute more hardware reads than originally bounded,\neventually leading to out-of-bounds I/O reads.\n\nFix this by breaking out of the loop immediately upon a partial\ncopy_to_user(). A partial copy indicates a faulty user buffer, making\nsubsequent read attempts futile. Breaking out ensures we return the\nnumber of successfully read bytes without risking out-of-bounds hardware\naccesses in subsequent mismatched iterations."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:36.722Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/42bc07b4e5a3c8a02a433388f562a8f46d093e11"
},
{
"url": "https://git.kernel.org/stable/c/42a6d8126c194133eafab2b0fd5c8668ebfcba5b"
},
{
"url": "https://git.kernel.org/stable/c/7ff87a01ae3a8cd0208f7499386998223a8b5dba"
},
{
"url": "https://git.kernel.org/stable/c/7110b7b794a2aac2c5cf8eb06ebf2af724c74d50"
},
{
"url": "https://git.kernel.org/stable/c/81cc73be40c6f028f1ee3f438ace46afe666dbae"
}
],
"title": "fbdev: core: Fix pointer desynchronization in fb_io_read()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80578",
"datePublished": "2026-08-26T14:37:36.722Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-26T14:37:36.722Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80577 (GCVE-0-2026-80577)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
drm/panthor: skip zero-sized firmware sections
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: skip zero-sized firmware sections
panthor_fw_load_section_entry() skips BO creation when the firmware section
VA range is empty. If such a section is added to the firmware section list,
section->mem is left as NULL.
Later reload and unplug paths iterate over all firmware sections and
dereference section->mem, which can lead to a NULL pointer dereference.
Zero-sized firmware sections are valid, so accept them as no-op entries but
skip adding them to the section list.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2718d91816eeed03c09c8abe872e45f59078768c , < f0f3c3922db981031733a25c51e1f37cf9b9e251
(git)
Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 25556a46ae6ecf2a9f1c1c5096828eecd4596b91 (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 5d222b657f02a37f658e4e21925b85b4703855e7 (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 2b8f13d3c7e26c46c20d9e367904cf01729c88e6 (git) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f0f3c3922db981031733a25c51e1f37cf9b9e251",
"status": "affected",
"version": "2718d91816eeed03c09c8abe872e45f59078768c",
"versionType": "git"
},
{
"lessThan": "25556a46ae6ecf2a9f1c1c5096828eecd4596b91",
"status": "affected",
"version": "2718d91816eeed03c09c8abe872e45f59078768c",
"versionType": "git"
},
{
"lessThan": "5d222b657f02a37f658e4e21925b85b4703855e7",
"status": "affected",
"version": "2718d91816eeed03c09c8abe872e45f59078768c",
"versionType": "git"
},
{
"lessThan": "2b8f13d3c7e26c46c20d9e367904cf01729c88e6",
"status": "affected",
"version": "2718d91816eeed03c09c8abe872e45f59078768c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: skip zero-sized firmware sections\n\npanthor_fw_load_section_entry() skips BO creation when the firmware section\nVA range is empty. If such a section is added to the firmware section list,\nsection-\u003emem is left as NULL.\n\nLater reload and unplug paths iterate over all firmware sections and\ndereference section-\u003emem, which can lead to a NULL pointer dereference.\n\nZero-sized firmware sections are valid, so accept them as no-op entries but\nskip adding them to the section list."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:36.132Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f0f3c3922db981031733a25c51e1f37cf9b9e251"
},
{
"url": "https://git.kernel.org/stable/c/25556a46ae6ecf2a9f1c1c5096828eecd4596b91"
},
{
"url": "https://git.kernel.org/stable/c/5d222b657f02a37f658e4e21925b85b4703855e7"
},
{
"url": "https://git.kernel.org/stable/c/2b8f13d3c7e26c46c20d9e367904cf01729c88e6"
}
],
"title": "drm/panthor: skip zero-sized firmware sections",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80577",
"datePublished": "2026-08-26T14:37:36.132Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:36.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80576 (GCVE-0-2026-80576)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
drm/amdgpu: reject oversized IBs with per-ring packet limits
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: reject oversized IBs with per-ring packet limits
On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through
to ib->length_dw without a limit, while ring_emit_ib() encodes length
into packet fields. Oversized values can corrupt adjacent control bits
and destabilize command submission.
Add a per-ring IB packet size limit helper and reject command
submissions exceeding the corresponding dword limit before IB
allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE,
and apply the MM fallback limit for other ring types.
(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6e164ba1057175fb8a370d8e05cbff5c57eac0c8
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1474f3970d1afd303e12ff14d06808eabb371576 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 07fe270ec07c138a70afe7a81e115a85c35c545c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fd37f9dd5b5ab70a46fa7bc76623c0528d602b27 (git) Affected: 0 , < 6.12.105 (semver) Affected: 0 , < 6.18.46 (semver) Affected: 0 , < 7.1.10 (semver) |
|
| Linux | Linux |
Unaffected:
6.12.105 , ≤ 6.12.*
(semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e164ba1057175fb8a370d8e05cbff5c57eac0c8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1474f3970d1afd303e12ff14d06808eabb371576",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "07fe270ec07c138a70afe7a81e115a85c35c545c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fd37f9dd5b5ab70a46fa7bc76623c0528d602b27",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.12.105",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.46",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: reject oversized IBs with per-ring packet limits\n\nOn GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through\nto ib-\u003elength_dw without a limit, while ring_emit_ib() encodes length\ninto packet fields. Oversized values can corrupt adjacent control bits\nand destabilize command submission.\n\nAdd a per-ring IB packet size limit helper and reject command\nsubmissions exceeding the corresponding dword limit before IB\nallocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE,\nand apply the MM fallback limit for other ring types.\n\n(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:35.538Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e164ba1057175fb8a370d8e05cbff5c57eac0c8"
},
{
"url": "https://git.kernel.org/stable/c/1474f3970d1afd303e12ff14d06808eabb371576"
},
{
"url": "https://git.kernel.org/stable/c/07fe270ec07c138a70afe7a81e115a85c35c545c"
},
{
"url": "https://git.kernel.org/stable/c/fd37f9dd5b5ab70a46fa7bc76623c0528d602b27"
}
],
"title": "drm/amdgpu: reject oversized IBs with per-ring packet limits",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80576",
"datePublished": "2026-08-26T14:37:35.538Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:35.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80575 (GCVE-0-2026-80575)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
Input: cs40l50-vibra - validate custom data from user space
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: cs40l50-vibra - validate custom data from user space
cs40l50_add() copies the custom data of an FF_PERIODIC/FF_CUSTOM effect
straight from the ff_effect the user passed to EVIOCSFF, without
requiring it to hold anything:
work_data.custom_data = memdup_array_user(periodic->custom_data,
periodic->custom_len,
sizeof(s16));
work_data.custom_len = periodic->custom_len;
The driver then reads two words out of that buffer: custom_data[0] as the
waveform bank in cs40l50_effect_bank_set(), and custom_data[1] as the
index within the bank in cs40l50_effect_index_set(). Neither read is
covered by a length check, and custom_len is fully user controlled:
- custom_len == 0 makes memdup_array_user() call memdup_user() with a
length of zero, which returns ZERO_SIZE_PTR rather than an error, so
custom_data[0] dereferences it.
- custom_len == 1 allocates two bytes. A bank of ROM or RAM keeps
effect->type out of the OWT case, and custom_data[1] is then read one
word past the allocation.
The bank value itself is also mishandled. It is masked with
CS40L50_CUSTOM_DATA_MASK (0xffff) but stored in an s16, so a
custom_data[0] of 0x8000 or above wraps to a negative value that passes
the "bank_type >= CS40L50_WVFRM_BANK_NUM" test.
cs40l50_effect_index_set() indexes vib->dsp.banks[] with it before the
switch statement's default case gets a chance to reject it:
base_index = vib->dsp.banks[effect->type].base_index;
max_index = vib->dsp.banks[effect->type].max_index;
Require the two words the driver reads to be present, and hold the masked
bank in a u32 so the existing upper-bound test covers the whole range.
The da7280 haptic driver already range checks custom_len this way.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c38fe1bb5d21c2ce0857965ee06174ee587d6b42 , < 3855b6a11f8a7aceb8181cc08c99afef58517006
(git)
Affected: c38fe1bb5d21c2ce0857965ee06174ee587d6b42 , < 52a818c586ae2c36b7324bfaefb547f5e866a8ae (git) Affected: c38fe1bb5d21c2ce0857965ee06174ee587d6b42 , < d38554602a0b04e85fad28ce72c7500cf50d419b (git) Affected: c38fe1bb5d21c2ce0857965ee06174ee587d6b42 , < 7d5c576cb1c86047b1fcb1aa9532e17fc5e46c1d (git) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/misc/cs40l50-vibra.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3855b6a11f8a7aceb8181cc08c99afef58517006",
"status": "affected",
"version": "c38fe1bb5d21c2ce0857965ee06174ee587d6b42",
"versionType": "git"
},
{
"lessThan": "52a818c586ae2c36b7324bfaefb547f5e866a8ae",
"status": "affected",
"version": "c38fe1bb5d21c2ce0857965ee06174ee587d6b42",
"versionType": "git"
},
{
"lessThan": "d38554602a0b04e85fad28ce72c7500cf50d419b",
"status": "affected",
"version": "c38fe1bb5d21c2ce0857965ee06174ee587d6b42",
"versionType": "git"
},
{
"lessThan": "7d5c576cb1c86047b1fcb1aa9532e17fc5e46c1d",
"status": "affected",
"version": "c38fe1bb5d21c2ce0857965ee06174ee587d6b42",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/misc/cs40l50-vibra.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: cs40l50-vibra - validate custom data from user space\n\ncs40l50_add() copies the custom data of an FF_PERIODIC/FF_CUSTOM effect\nstraight from the ff_effect the user passed to EVIOCSFF, without\nrequiring it to hold anything:\n\n work_data.custom_data = memdup_array_user(periodic-\u003ecustom_data,\n periodic-\u003ecustom_len,\n sizeof(s16));\n work_data.custom_len = periodic-\u003ecustom_len;\n\nThe driver then reads two words out of that buffer: custom_data[0] as the\nwaveform bank in cs40l50_effect_bank_set(), and custom_data[1] as the\nindex within the bank in cs40l50_effect_index_set(). Neither read is\ncovered by a length check, and custom_len is fully user controlled:\n\n - custom_len == 0 makes memdup_array_user() call memdup_user() with a\n length of zero, which returns ZERO_SIZE_PTR rather than an error, so\n custom_data[0] dereferences it.\n\n - custom_len == 1 allocates two bytes. A bank of ROM or RAM keeps\n effect-\u003etype out of the OWT case, and custom_data[1] is then read one\n word past the allocation.\n\nThe bank value itself is also mishandled. It is masked with\nCS40L50_CUSTOM_DATA_MASK (0xffff) but stored in an s16, so a\ncustom_data[0] of 0x8000 or above wraps to a negative value that passes\nthe \"bank_type \u003e= CS40L50_WVFRM_BANK_NUM\" test.\ncs40l50_effect_index_set() indexes vib-\u003edsp.banks[] with it before the\nswitch statement\u0027s default case gets a chance to reject it:\n\n base_index = vib-\u003edsp.banks[effect-\u003etype].base_index;\n max_index = vib-\u003edsp.banks[effect-\u003etype].max_index;\n\nRequire the two words the driver reads to be present, and hold the masked\nbank in a u32 so the existing upper-bound test covers the whole range.\nThe da7280 haptic driver already range checks custom_len this way."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:34.942Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3855b6a11f8a7aceb8181cc08c99afef58517006"
},
{
"url": "https://git.kernel.org/stable/c/52a818c586ae2c36b7324bfaefb547f5e866a8ae"
},
{
"url": "https://git.kernel.org/stable/c/d38554602a0b04e85fad28ce72c7500cf50d419b"
},
{
"url": "https://git.kernel.org/stable/c/7d5c576cb1c86047b1fcb1aa9532e17fc5e46c1d"
}
],
"title": "Input: cs40l50-vibra - validate custom data from user space",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80575",
"datePublished": "2026-08-26T14:37:34.942Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:34.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80574 (GCVE-0-2026-80574)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Make finger2 (and also finger1) unsigned, so that if the finger index in
the packet is 0 then subtracting 1 creates an array index which overflows
above the existing check for FOC_MAX_FINGERS, as the existing comment says
it should, instead of writing to state->fingers[-1].
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
05be1d079ec0b3691783e4384b1ada82149ff7d2 , < 063b4c6a6f3fc01bca085c442000c9c100fdbd93
(git)
Affected: 05be1d079ec0b3691783e4384b1ada82149ff7d2 , < bb502d79acb9ac1e0a77fa8bc7b7b4729140b11f (git) Affected: 05be1d079ec0b3691783e4384b1ada82149ff7d2 , < ca92c98b806839c108995b2bbff7061515bdfb53 (git) Affected: 05be1d079ec0b3691783e4384b1ada82149ff7d2 , < 81b07470cb2937ceb74b00be88151582a322433b (git) Affected: 05be1d079ec0b3691783e4384b1ada82149ff7d2 , < 6f6d5fe29efdf5001bc146fc292e6592cace93eb (git) Affected: 05be1d079ec0b3691783e4384b1ada82149ff7d2 , < 83c265bfc084d77e2171d4b67362150ab38c935b (git) Affected: 05be1d079ec0b3691783e4384b1ada82149ff7d2 , < 1842e47126816e56d30c4f856f9854fd7831066c (git) Affected: 05be1d079ec0b3691783e4384b1ada82149ff7d2 , < 296736076b3fd078742651c719555a488624023a (git) |
|
| Linux | Linux |
Affected:
4.0
Unaffected: 0 , < 4.0 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/mouse/focaltech.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "063b4c6a6f3fc01bca085c442000c9c100fdbd93",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "bb502d79acb9ac1e0a77fa8bc7b7b4729140b11f",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "ca92c98b806839c108995b2bbff7061515bdfb53",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "81b07470cb2937ceb74b00be88151582a322433b",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "6f6d5fe29efdf5001bc146fc292e6592cace93eb",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "83c265bfc084d77e2171d4b67362150ab38c935b",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "1842e47126816e56d30c4f856f9854fd7831066c",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "296736076b3fd078742651c719555a488624023a",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/mouse/focaltech.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: focaltech - fix array out-of-bounds in focaltech_process_rel_packet\n\nMake finger2 (and also finger1) unsigned, so that if the finger index in\nthe packet is 0 then subtracting 1 creates an array index which overflows\nabove the existing check for FOC_MAX_FINGERS, as the existing comment says\nit should, instead of writing to state-\u003efingers[-1]."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:34.353Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/063b4c6a6f3fc01bca085c442000c9c100fdbd93"
},
{
"url": "https://git.kernel.org/stable/c/bb502d79acb9ac1e0a77fa8bc7b7b4729140b11f"
},
{
"url": "https://git.kernel.org/stable/c/ca92c98b806839c108995b2bbff7061515bdfb53"
},
{
"url": "https://git.kernel.org/stable/c/81b07470cb2937ceb74b00be88151582a322433b"
},
{
"url": "https://git.kernel.org/stable/c/6f6d5fe29efdf5001bc146fc292e6592cace93eb"
},
{
"url": "https://git.kernel.org/stable/c/83c265bfc084d77e2171d4b67362150ab38c935b"
},
{
"url": "https://git.kernel.org/stable/c/1842e47126816e56d30c4f856f9854fd7831066c"
},
{
"url": "https://git.kernel.org/stable/c/296736076b3fd078742651c719555a488624023a"
}
],
"title": "Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80574",
"datePublished": "2026-08-26T14:37:34.353Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:34.353Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80573 (GCVE-0-2026-80573)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
Input: iforce - validate input packet lengths
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: iforce - validate input packet lengths
iforce_process_packet() reads fixed fields from joystick, wheel and
status packets without first checking their lengths. In particular, the
shared hats-and-buttons helper unconditionally reads data[6]. The status
tail is a sequence of 16-bit effect addresses, but an incomplete final
address is also consumed. A successful zero-length USB URB additionally
reads the packet ID before the common parser is called.
Reject the zero-length USB transfer, require the seven-byte joystick and
wheel prefixes and the two-byte status prefix, and consume only complete
status-tail addresses.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0ec411167655ef3ff3e84f6af685e962aff9a75b
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 609be40988898a4d75225ade0ea5c1734757dd33 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e73d7a7d913d89141321f5f3f16343ecc200d152 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5232529eaf57f08fe37484e301579a1915b93d14 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2c083ab16e33fbff3ab8c752fbf8118ed3dd31ce (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a64a8b6b31cd669f0449138e53cc2592d454ccf1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 84e5cb517f445dadbd5f8bf4ec513540e51f9c36 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5751c781d3c97ab6ce0e2a966156ed882152c415 (git) Affected: 0 , < 5.10.266 (semver) Affected: 0 , < 5.15.217 (semver) Affected: 0 , < 6.1.184 (semver) Affected: 0 , < 6.6.153 (semver) Affected: 0 , < 6.12.105 (semver) Affected: 0 , < 6.18.46 (semver) Affected: 0 , < 7.1.10 (semver) |
|
| Linux | Linux |
Unaffected:
5.10.266 , ≤ 5.10.*
(semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/joystick/iforce/iforce-packets.c",
"drivers/input/joystick/iforce/iforce-usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ec411167655ef3ff3e84f6af685e962aff9a75b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "609be40988898a4d75225ade0ea5c1734757dd33",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e73d7a7d913d89141321f5f3f16343ecc200d152",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5232529eaf57f08fe37484e301579a1915b93d14",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2c083ab16e33fbff3ab8c752fbf8118ed3dd31ce",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a64a8b6b31cd669f0449138e53cc2592d454ccf1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "84e5cb517f445dadbd5f8bf4ec513540e51f9c36",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5751c781d3c97ab6ce0e2a966156ed882152c415",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5.10.266",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.15.217",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.1.184",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.6.153",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.105",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.46",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/joystick/iforce/iforce-packets.c",
"drivers/input/joystick/iforce/iforce-usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: iforce - validate input packet lengths\n\niforce_process_packet() reads fixed fields from joystick, wheel and\nstatus packets without first checking their lengths. In particular, the\nshared hats-and-buttons helper unconditionally reads data[6]. The status\ntail is a sequence of 16-bit effect addresses, but an incomplete final\naddress is also consumed. A successful zero-length USB URB additionally\nreads the packet ID before the common parser is called.\n\nReject the zero-length USB transfer, require the seven-byte joystick and\nwheel prefixes and the two-byte status prefix, and consume only complete\nstatus-tail addresses."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:33.756Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ec411167655ef3ff3e84f6af685e962aff9a75b"
},
{
"url": "https://git.kernel.org/stable/c/609be40988898a4d75225ade0ea5c1734757dd33"
},
{
"url": "https://git.kernel.org/stable/c/e73d7a7d913d89141321f5f3f16343ecc200d152"
},
{
"url": "https://git.kernel.org/stable/c/5232529eaf57f08fe37484e301579a1915b93d14"
},
{
"url": "https://git.kernel.org/stable/c/2c083ab16e33fbff3ab8c752fbf8118ed3dd31ce"
},
{
"url": "https://git.kernel.org/stable/c/a64a8b6b31cd669f0449138e53cc2592d454ccf1"
},
{
"url": "https://git.kernel.org/stable/c/84e5cb517f445dadbd5f8bf4ec513540e51f9c36"
},
{
"url": "https://git.kernel.org/stable/c/5751c781d3c97ab6ce0e2a966156ed882152c415"
}
],
"title": "Input: iforce - validate input packet lengths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80573",
"datePublished": "2026-08-26T14:37:33.756Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:33.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80572 (GCVE-0-2026-80572)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
Input: byd - synchronize timer deletion before freeing private data
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: byd - synchronize timer deletion before freeing private data
byd_disconnect() uses timer_delete() before freeing the driver's private
data. This does not wait for a running byd_clear_touch() callback, which
dereferences the private data and its psmouse pointer. A callback racing
with disconnect can therefore access the private data after it has been
freed. The timer can also still be re-armed by byd_process_byte() while
the disconnect is in progress.
Use timer_shutdown_sync() before freeing the private data: it waits for
a running callback and turns any later re-arm attempt into a no-op.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2d5f5611dd0de52e9a52b56391a7049a52184e72 , < 8dbfd8e32a13e116790780ed0be82b5a05eb9916
(git)
Affected: 2d5f5611dd0de52e9a52b56391a7049a52184e72 , < 2e509ef60ee41a2da0deb062c262bb530143fb37 (git) Affected: 2d5f5611dd0de52e9a52b56391a7049a52184e72 , < c83e79c0842ed29860648bcce5022ef0ba5001c6 (git) |
|
| Linux | Linux |
Affected:
4.6
Unaffected: 0 , < 4.6 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/mouse/byd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8dbfd8e32a13e116790780ed0be82b5a05eb9916",
"status": "affected",
"version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
"versionType": "git"
},
{
"lessThan": "2e509ef60ee41a2da0deb062c262bb530143fb37",
"status": "affected",
"version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
"versionType": "git"
},
{
"lessThan": "c83e79c0842ed29860648bcce5022ef0ba5001c6",
"status": "affected",
"version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/mouse/byd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: byd - synchronize timer deletion before freeing private data\n\nbyd_disconnect() uses timer_delete() before freeing the driver\u0027s private\ndata. This does not wait for a running byd_clear_touch() callback, which\ndereferences the private data and its psmouse pointer. A callback racing\nwith disconnect can therefore access the private data after it has been\nfreed. The timer can also still be re-armed by byd_process_byte() while\nthe disconnect is in progress.\n\nUse timer_shutdown_sync() before freeing the private data: it waits for\na running callback and turns any later re-arm attempt into a no-op."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:33.141Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8dbfd8e32a13e116790780ed0be82b5a05eb9916"
},
{
"url": "https://git.kernel.org/stable/c/2e509ef60ee41a2da0deb062c262bb530143fb37"
},
{
"url": "https://git.kernel.org/stable/c/c83e79c0842ed29860648bcce5022ef0ba5001c6"
}
],
"title": "Input: byd - synchronize timer deletion before freeing private data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80572",
"datePublished": "2026-08-26T14:37:33.141Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:33.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80571 (GCVE-0-2026-80571)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
Summary
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In papr_phy_attest_create_handle(), the params->cmd.length is not
validated before use, which can result in a buffer overlow. Check it and
return -EINVAL if it is either 0 or exceeds sizeof(params->cmd).
Also, params is freed on the success path but not error. Free it on
errors after memory allocation. And free it on negative fd.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
86900ab620a42396a749b506d4a187820fc3fabe , < 828a8d1a9107aec6353d896882df8383accf7e80
(git)
Affected: 86900ab620a42396a749b506d4a187820fc3fabe , < ed98ce338f9a65c90cb930b088f1eb36de7181af (git) Affected: 86900ab620a42396a749b506d4a187820fc3fabe , < 5b17f3f34391372faf03e79d947e0c50ab6dd258 (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/platforms/pseries/papr-phy-attest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "828a8d1a9107aec6353d896882df8383accf7e80",
"status": "affected",
"version": "86900ab620a42396a749b506d4a187820fc3fabe",
"versionType": "git"
},
{
"lessThan": "ed98ce338f9a65c90cb930b088f1eb36de7181af",
"status": "affected",
"version": "86900ab620a42396a749b506d4a187820fc3fabe",
"versionType": "git"
},
{
"lessThan": "5b17f3f34391372faf03e79d947e0c50ab6dd258",
"status": "affected",
"version": "86900ab620a42396a749b506d4a187820fc3fabe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/powerpc/platforms/pseries/papr-phy-attest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak\n\nIn papr_phy_attest_create_handle(), the params-\u003ecmd.length is not\nvalidated before use, which can result in a buffer overlow. Check it and\nreturn -EINVAL if it is either 0 or exceeds sizeof(params-\u003ecmd).\n\nAlso, params is freed on the success path but not error. Free it on\nerrors after memory allocation. And free it on negative fd."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:32.541Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/828a8d1a9107aec6353d896882df8383accf7e80"
},
{
"url": "https://git.kernel.org/stable/c/ed98ce338f9a65c90cb930b088f1eb36de7181af"
},
{
"url": "https://git.kernel.org/stable/c/5b17f3f34391372faf03e79d947e0c50ab6dd258"
}
],
"title": "powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80571",
"datePublished": "2026-08-26T14:37:32.541Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:32.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80570 (GCVE-0-2026-80570)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
Input: synaptics-rmi4 - zero report size on F54 work error
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - zero report size on F54 work error
In rmi_f54_work(), if an error occurs during report request or command
verification, the code jumped directly to the 'error' label, bypassing
the 'abort' label where f54->report_size was normally zeroed out.
This left f54->report_size containing its previous successful payload
size. If a user then altered the V4L2 format to a smaller size, and a
subsequent run failed, rmi_f54_buffer_queue() would copy the stale,
larger payload size into the shrunken V4L2 buffer, causing a heap
buffer overflow.
Fix this by merging the 'abort' and 'error' labels into a single 'out'
exit path, and ensuring that f54->report_size is always set to 0 on
failure by checking for error and zeroing the local report_size first.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 62079c17ec07d64362bec367ee7a525b0dbf6bf9
(git)
Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 79521ed3cc9ea48476666ccacf45ecd6954b29a4 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < c669c64ab71afa7b467c4d7e18f6a05e96b97a1f (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 77749685e55da19b187df215b5da4080842ca5c7 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < c6cfda79f26c69e97db9805808c3b44d02227b4b (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < b28593a05afdd812b590e1045b5bd862a5869225 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 88c8174d72900d77fbdf2f527d54b6ff2da876a8 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < dc76c3c8e8ad09362b8c1561f3928288c15cba2e (git) |
|
| Linux | Linux |
Affected:
4.9
Unaffected: 0 , < 4.9 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "62079c17ec07d64362bec367ee7a525b0dbf6bf9",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "79521ed3cc9ea48476666ccacf45ecd6954b29a4",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "c669c64ab71afa7b467c4d7e18f6a05e96b97a1f",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "77749685e55da19b187df215b5da4080842ca5c7",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "c6cfda79f26c69e97db9805808c3b44d02227b4b",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "b28593a05afdd812b590e1045b5bd862a5869225",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "88c8174d72900d77fbdf2f527d54b6ff2da876a8",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "dc76c3c8e8ad09362b8c1561f3928288c15cba2e",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - zero report size on F54 work error\n\nIn rmi_f54_work(), if an error occurs during report request or command\nverification, the code jumped directly to the \u0027error\u0027 label, bypassing\nthe \u0027abort\u0027 label where f54-\u003ereport_size was normally zeroed out.\n\nThis left f54-\u003ereport_size containing its previous successful payload\nsize. If a user then altered the V4L2 format to a smaller size, and a\nsubsequent run failed, rmi_f54_buffer_queue() would copy the stale,\nlarger payload size into the shrunken V4L2 buffer, causing a heap\nbuffer overflow.\n\nFix this by merging the \u0027abort\u0027 and \u0027error\u0027 labels into a single \u0027out\u0027\nexit path, and ensuring that f54-\u003ereport_size is always set to 0 on\nfailure by checking for error and zeroing the local report_size first."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:31.940Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/62079c17ec07d64362bec367ee7a525b0dbf6bf9"
},
{
"url": "https://git.kernel.org/stable/c/79521ed3cc9ea48476666ccacf45ecd6954b29a4"
},
{
"url": "https://git.kernel.org/stable/c/c669c64ab71afa7b467c4d7e18f6a05e96b97a1f"
},
{
"url": "https://git.kernel.org/stable/c/77749685e55da19b187df215b5da4080842ca5c7"
},
{
"url": "https://git.kernel.org/stable/c/c6cfda79f26c69e97db9805808c3b44d02227b4b"
},
{
"url": "https://git.kernel.org/stable/c/b28593a05afdd812b590e1045b5bd862a5869225"
},
{
"url": "https://git.kernel.org/stable/c/88c8174d72900d77fbdf2f527d54b6ff2da876a8"
},
{
"url": "https://git.kernel.org/stable/c/dc76c3c8e8ad09362b8c1561f3928288c15cba2e"
}
],
"title": "Input: synaptics-rmi4 - zero report size on F54 work error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80570",
"datePublished": "2026-08-26T14:37:31.940Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:31.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80569 (GCVE-0-2026-80569)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
rmi_f54_work() reads a diagnostics report from the device into
f54->report_data, sizing the transfer with rmi_f54_get_report_size():
report_size = rmi_f54_get_report_size(f54);
...
for (i = 0; i < report_size; i += F54_REPORT_DATA_SIZE) {
int size = min(F54_REPORT_DATA_SIZE, report_size - i);
...
rmi_read_block(.., f54->report_data + i, size);
}
report_data is allocated once at probe from F54's own electrode counts
(array3_size(f54->num_tx_electrodes, f54->num_rx_electrodes, sizeof(u16))),
but rmi_f54_get_report_size() computes the size from
drv_data->num_*_electrodes when those are set, i.e. from the F55
function's electrode counts. Both counts come straight from device
queries (F54 and F55 each report up to 255 electrodes) and nothing
constrains the F55 counts to the F54 ones.
A malicious or malfunctioning RMI4 device that reports larger F55
electrode counts than its F54 counts makes report_size exceed the
allocation, so the read loop writes past report_data (and the V4L2
dequeue memcpy() then reads past it). On conforming hardware the F55
configured electrodes are a subset of the F54 physical electrodes, so
report_size never exceeds the buffer and well-behaved devices are
unaffected.
Record the allocation size and reject a report that does not fit,
mirroring the existing zero-size check.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c762cc68b6a12eedebefc156ea4838e54804e2eb , < 6b3bdd44d4cd7d5e35de1d0f06d4930f3cecd403
(git)
Affected: c762cc68b6a12eedebefc156ea4838e54804e2eb , < b2f596f00d27703ce09167201ba57f55be8d2f9a (git) Affected: c762cc68b6a12eedebefc156ea4838e54804e2eb , < b3932101c9c457148038392bc977f9b31e125a86 (git) Affected: c762cc68b6a12eedebefc156ea4838e54804e2eb , < 12be3c6ca9589afd6ade41a59c761866e526634d (git) Affected: c762cc68b6a12eedebefc156ea4838e54804e2eb , < 42eaf0e6f79c487f419737314cf0760f7331d368 (git) Affected: c762cc68b6a12eedebefc156ea4838e54804e2eb , < 6b06aab79ff166d5781ce792d91acc2e58b1770b (git) Affected: c762cc68b6a12eedebefc156ea4838e54804e2eb , < b7b9a8b1c303b62371698e396654d6724c79cb74 (git) Affected: c762cc68b6a12eedebefc156ea4838e54804e2eb , < 49c5adc2b7d6e43c5cf033e1c86fdb9c16ababb1 (git) |
|
| Linux | Linux |
Affected:
4.10
Unaffected: 0 , < 4.10 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6b3bdd44d4cd7d5e35de1d0f06d4930f3cecd403",
"status": "affected",
"version": "c762cc68b6a12eedebefc156ea4838e54804e2eb",
"versionType": "git"
},
{
"lessThan": "b2f596f00d27703ce09167201ba57f55be8d2f9a",
"status": "affected",
"version": "c762cc68b6a12eedebefc156ea4838e54804e2eb",
"versionType": "git"
},
{
"lessThan": "b3932101c9c457148038392bc977f9b31e125a86",
"status": "affected",
"version": "c762cc68b6a12eedebefc156ea4838e54804e2eb",
"versionType": "git"
},
{
"lessThan": "12be3c6ca9589afd6ade41a59c761866e526634d",
"status": "affected",
"version": "c762cc68b6a12eedebefc156ea4838e54804e2eb",
"versionType": "git"
},
{
"lessThan": "42eaf0e6f79c487f419737314cf0760f7331d368",
"status": "affected",
"version": "c762cc68b6a12eedebefc156ea4838e54804e2eb",
"versionType": "git"
},
{
"lessThan": "6b06aab79ff166d5781ce792d91acc2e58b1770b",
"status": "affected",
"version": "c762cc68b6a12eedebefc156ea4838e54804e2eb",
"versionType": "git"
},
{
"lessThan": "b7b9a8b1c303b62371698e396654d6724c79cb74",
"status": "affected",
"version": "c762cc68b6a12eedebefc156ea4838e54804e2eb",
"versionType": "git"
},
{
"lessThan": "49c5adc2b7d6e43c5cf033e1c86fdb9c16ababb1",
"status": "affected",
"version": "c762cc68b6a12eedebefc156ea4838e54804e2eb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F54 report size to the allocated buffer\n\nrmi_f54_work() reads a diagnostics report from the device into\nf54-\u003ereport_data, sizing the transfer with rmi_f54_get_report_size():\n\n\treport_size = rmi_f54_get_report_size(f54);\n\t...\n\tfor (i = 0; i \u003c report_size; i += F54_REPORT_DATA_SIZE) {\n\t\tint size = min(F54_REPORT_DATA_SIZE, report_size - i);\n\t\t...\n\t\trmi_read_block(.., f54-\u003ereport_data + i, size);\n\t}\n\nreport_data is allocated once at probe from F54\u0027s own electrode counts\n(array3_size(f54-\u003enum_tx_electrodes, f54-\u003enum_rx_electrodes, sizeof(u16))),\nbut rmi_f54_get_report_size() computes the size from\ndrv_data-\u003enum_*_electrodes when those are set, i.e. from the F55\nfunction\u0027s electrode counts. Both counts come straight from device\nqueries (F54 and F55 each report up to 255 electrodes) and nothing\nconstrains the F55 counts to the F54 ones.\n\nA malicious or malfunctioning RMI4 device that reports larger F55\nelectrode counts than its F54 counts makes report_size exceed the\nallocation, so the read loop writes past report_data (and the V4L2\ndequeue memcpy() then reads past it). On conforming hardware the F55\nconfigured electrodes are a subset of the F54 physical electrodes, so\nreport_size never exceeds the buffer and well-behaved devices are\nunaffected.\n\nRecord the allocation size and reject a report that does not fit,\nmirroring the existing zero-size check."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:31.338Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6b3bdd44d4cd7d5e35de1d0f06d4930f3cecd403"
},
{
"url": "https://git.kernel.org/stable/c/b2f596f00d27703ce09167201ba57f55be8d2f9a"
},
{
"url": "https://git.kernel.org/stable/c/b3932101c9c457148038392bc977f9b31e125a86"
},
{
"url": "https://git.kernel.org/stable/c/12be3c6ca9589afd6ade41a59c761866e526634d"
},
{
"url": "https://git.kernel.org/stable/c/42eaf0e6f79c487f419737314cf0760f7331d368"
},
{
"url": "https://git.kernel.org/stable/c/6b06aab79ff166d5781ce792d91acc2e58b1770b"
},
{
"url": "https://git.kernel.org/stable/c/b7b9a8b1c303b62371698e396654d6724c79cb74"
},
{
"url": "https://git.kernel.org/stable/c/49c5adc2b7d6e43c5cf033e1c86fdb9c16ababb1"
}
],
"title": "Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80569",
"datePublished": "2026-08-26T14:37:31.338Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:31.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80568 (GCVE-0-2026-80568)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Changing the input (diagnostic report type) mid-stream changes the
report size. Since V4L2 buffers are allocated based on the size at
stream start, changing the input while streaming could lead to a
heap buffer overflow if the new size is larger than the allocated
buffers.
Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue
is busy (streaming).
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 7e994a9ecc0b49ad2fe63da9c92a8aca8a6614af
(git)
Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < fa69f93015becf3729716de2199b58540aa99672 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 493ba8e794729649689438edba72337111303cc4 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 1d718f1461766e9f00a8dbeb4f13f1b1c19d90ac (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < cae79513f9115c350561b16f36adcb47c9bfff12 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < ff0849705d29277fd1f6fc6596674b9308724fb2 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < ddd9a53faf3b65e5920cb802cb1db6f4615bdfef (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < fbfd76746adc16d64be29ff113f673b70bc3f5c2 (git) |
|
| Linux | Linux |
Affected:
4.9
Unaffected: 0 , < 4.9 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e994a9ecc0b49ad2fe63da9c92a8aca8a6614af",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "fa69f93015becf3729716de2199b58540aa99672",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "493ba8e794729649689438edba72337111303cc4",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "1d718f1461766e9f00a8dbeb4f13f1b1c19d90ac",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "cae79513f9115c350561b16f36adcb47c9bfff12",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "ff0849705d29277fd1f6fc6596674b9308724fb2",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "ddd9a53faf3b65e5920cb802cb1db6f4615bdfef",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "fbfd76746adc16d64be29ff113f673b70bc3f5c2",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - block s_input when F54 queue is busy\n\nChanging the input (diagnostic report type) mid-stream changes the\nreport size. Since V4L2 buffers are allocated based on the size at\nstream start, changing the input while streaming could lead to a\nheap buffer overflow if the new size is larger than the allocated\nbuffers.\n\nPrevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue\nis busy (streaming)."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:30.740Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e994a9ecc0b49ad2fe63da9c92a8aca8a6614af"
},
{
"url": "https://git.kernel.org/stable/c/fa69f93015becf3729716de2199b58540aa99672"
},
{
"url": "https://git.kernel.org/stable/c/493ba8e794729649689438edba72337111303cc4"
},
{
"url": "https://git.kernel.org/stable/c/1d718f1461766e9f00a8dbeb4f13f1b1c19d90ac"
},
{
"url": "https://git.kernel.org/stable/c/cae79513f9115c350561b16f36adcb47c9bfff12"
},
{
"url": "https://git.kernel.org/stable/c/ff0849705d29277fd1f6fc6596674b9308724fb2"
},
{
"url": "https://git.kernel.org/stable/c/ddd9a53faf3b65e5920cb802cb1db6f4615bdfef"
},
{
"url": "https://git.kernel.org/stable/c/fbfd76746adc16d64be29ff113f673b70bc3f5c2"
}
],
"title": "Input: synaptics-rmi4 - block s_input when F54 queue is busy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80568",
"datePublished": "2026-08-26T14:37:30.740Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:30.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80567 (GCVE-0-2026-80567)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Previously, rmi_f54_buffer_queue() waited for the worker thread to
finish but ignored whether it succeeded. If the worker failed (e.g.,
due to a timeout or register read failure), the queue thread would
silently return success, delivering stale or uninitialized memory to
userspace.
Add a 'report_error' field to struct f54_data to store the worker's exit
status. Check this field in rmi_f54_buffer_queue() after the worker
finishes, and mark the buffer as VB2_BUF_STATE_ERROR if an error
occurred.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 305c24ee25b6e08ac9f4c5f697e823cc638c38da
(git)
Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 7d33b752e0df385b285492b74699fc73b6becdfb (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < be56730b547737151f24357d832b04aaa93755d5 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 2b0403fb7e28f65883cd03814b62c9aa9bc7f04d (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 6741a8c21d98088b7f2d9f4f86a706d311ce34a2 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 70f9aad3943559af6f32cb303744f35c05ce9cf1 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 9bbd3682f8a3e064271547133c37fcb17668d860 (git) Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 8786d74bf50e6797b6f655eb381ef6b25451161f (git) |
|
| Linux | Linux |
Affected:
4.9
Unaffected: 0 , < 4.9 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "305c24ee25b6e08ac9f4c5f697e823cc638c38da",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "7d33b752e0df385b285492b74699fc73b6becdfb",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "be56730b547737151f24357d832b04aaa93755d5",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "2b0403fb7e28f65883cd03814b62c9aa9bc7f04d",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "6741a8c21d98088b7f2d9f4f86a706d311ce34a2",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "70f9aad3943559af6f32cb303744f35c05ce9cf1",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "9bbd3682f8a3e064271547133c37fcb17668d860",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "8786d74bf50e6797b6f655eb381ef6b25451161f",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue\n\nPreviously, rmi_f54_buffer_queue() waited for the worker thread to\nfinish but ignored whether it succeeded. If the worker failed (e.g.,\ndue to a timeout or register read failure), the queue thread would\nsilently return success, delivering stale or uninitialized memory to\nuserspace.\n\nAdd a \u0027report_error\u0027 field to struct f54_data to store the worker\u0027s exit\nstatus. Check this field in rmi_f54_buffer_queue() after the worker\nfinishes, and mark the buffer as VB2_BUF_STATE_ERROR if an error\noccurred."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:30.152Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/305c24ee25b6e08ac9f4c5f697e823cc638c38da"
},
{
"url": "https://git.kernel.org/stable/c/7d33b752e0df385b285492b74699fc73b6becdfb"
},
{
"url": "https://git.kernel.org/stable/c/be56730b547737151f24357d832b04aaa93755d5"
},
{
"url": "https://git.kernel.org/stable/c/2b0403fb7e28f65883cd03814b62c9aa9bc7f04d"
},
{
"url": "https://git.kernel.org/stable/c/6741a8c21d98088b7f2d9f4f86a706d311ce34a2"
},
{
"url": "https://git.kernel.org/stable/c/70f9aad3943559af6f32cb303744f35c05ce9cf1"
},
{
"url": "https://git.kernel.org/stable/c/9bbd3682f8a3e064271547133c37fcb17668d860"
},
{
"url": "https://git.kernel.org/stable/c/8786d74bf50e6797b6f655eb381ef6b25451161f"
}
],
"title": "Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80567",
"datePublished": "2026-08-26T14:37:30.152Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:30.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80566 (GCVE-0-2026-80566)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
Input: hynitron_cstxxx - validate touch count and finger IDs
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: hynitron_cstxxx - validate touch count and finger IDs
The driver allocates max_touch_num input slots, which are indexed from
zero through max_touch_num - 1. The current check allows a finger ID
equal to max_touch_num to reach cst3xx_report_contact(). While the input
core ignores out-of-range slot indices, reporting touch data without a
valid slot change corrupts the touch state of the previously active slot.
The touch count is read from the controller's report and is used to
index the fixed-size report buffer without first checking its range.
Reject counts larger than the supported number of touch slots before
checking the trailing byte or parsing touch data.
Reject finger IDs equal to or greater than max_touch_num, and return
immediately when an invalid finger ID is encountered so that corrupt
touch frames are discarded instead of reporting partial contact state.
The V821 Avaota F1 board configures the vendor driver with one touch
slot, so finger ID 1 is already invalid on that device.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
66603243f5283f7f28c795f09e7c2167233df0bd , < ec61ca4e310665816a639cb2e46cd9b3af0a9bee
(git)
Affected: 66603243f5283f7f28c795f09e7c2167233df0bd , < 387829ee60de26c7c073ed4e27ecfab2b75d4c74 (git) Affected: 66603243f5283f7f28c795f09e7c2167233df0bd , < 38e7d5c1ade04b99c70da0298ca296ee62bc99c0 (git) Affected: 66603243f5283f7f28c795f09e7c2167233df0bd , < 51c5503554c87e4de4035468bebf186205391ce9 (git) Affected: 66603243f5283f7f28c795f09e7c2167233df0bd , < 27f380ef0e1d3de3cde114e02d33f9320ce3a5a6 (git) |
|
| Linux | Linux |
Affected:
6.2
Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/hynitron_cstxxx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ec61ca4e310665816a639cb2e46cd9b3af0a9bee",
"status": "affected",
"version": "66603243f5283f7f28c795f09e7c2167233df0bd",
"versionType": "git"
},
{
"lessThan": "387829ee60de26c7c073ed4e27ecfab2b75d4c74",
"status": "affected",
"version": "66603243f5283f7f28c795f09e7c2167233df0bd",
"versionType": "git"
},
{
"lessThan": "38e7d5c1ade04b99c70da0298ca296ee62bc99c0",
"status": "affected",
"version": "66603243f5283f7f28c795f09e7c2167233df0bd",
"versionType": "git"
},
{
"lessThan": "51c5503554c87e4de4035468bebf186205391ce9",
"status": "affected",
"version": "66603243f5283f7f28c795f09e7c2167233df0bd",
"versionType": "git"
},
{
"lessThan": "27f380ef0e1d3de3cde114e02d33f9320ce3a5a6",
"status": "affected",
"version": "66603243f5283f7f28c795f09e7c2167233df0bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/hynitron_cstxxx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: hynitron_cstxxx - validate touch count and finger IDs\n\nThe driver allocates max_touch_num input slots, which are indexed from\nzero through max_touch_num - 1. The current check allows a finger ID\nequal to max_touch_num to reach cst3xx_report_contact(). While the input\ncore ignores out-of-range slot indices, reporting touch data without a\nvalid slot change corrupts the touch state of the previously active slot.\n\nThe touch count is read from the controller\u0027s report and is used to\nindex the fixed-size report buffer without first checking its range.\nReject counts larger than the supported number of touch slots before\nchecking the trailing byte or parsing touch data.\n\nReject finger IDs equal to or greater than max_touch_num, and return\nimmediately when an invalid finger ID is encountered so that corrupt\ntouch frames are discarded instead of reporting partial contact state.\n\nThe V821 Avaota F1 board configures the vendor driver with one touch\nslot, so finger ID 1 is already invalid on that device."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:29.552Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ec61ca4e310665816a639cb2e46cd9b3af0a9bee"
},
{
"url": "https://git.kernel.org/stable/c/387829ee60de26c7c073ed4e27ecfab2b75d4c74"
},
{
"url": "https://git.kernel.org/stable/c/38e7d5c1ade04b99c70da0298ca296ee62bc99c0"
},
{
"url": "https://git.kernel.org/stable/c/51c5503554c87e4de4035468bebf186205391ce9"
},
{
"url": "https://git.kernel.org/stable/c/27f380ef0e1d3de3cde114e02d33f9320ce3a5a6"
}
],
"title": "Input: hynitron_cstxxx - validate touch count and finger IDs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80566",
"datePublished": "2026-08-26T14:37:29.552Z",
"dateReserved": "2026-08-26T14:34:25.767Z",
"dateUpdated": "2026-08-26T14:37:29.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80565 (GCVE-0-2026-80565)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
crypto: qce - fix error path in devm_qce_register_algs
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: qce - fix error path in devm_qce_register_algs
If ops->register_algs() fails, the error path repeatedly calls the same
ops->unregister_algs() from the failed registration. Use the loop index
to unregister the previously registered algorithms instead.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9e403fea74ecbe6b4a4321f13bd4bc929382908d , < dbca8b798caf47fb2799a26dd09c9ad66305883d
(git)
Affected: f52f00efd8c0088992ac07ef46af6096e4f0e52e , < fef187c6194d67395182d58169dd14ba631f1b41 (git) Affected: 5d5b673b4dd260226b2202f66a920566c27051f3 , < 1ece8e16c085e8cd60ecbdb641269aaa53d31da4 (git) Affected: e914b2f795b6995bb0e7db45caa4a912dca09e65 , < de52c713d21806b93b00a6074056b57aec4f8919 (git) Affected: 76e6d50fa5a2fb466edcc8b513d7aad372312c2a , < c7dc487aade12c692add3221673c9bdf32dc24f5 (git) Affected: e80cf84b608725303113d6fe98bb727bf7b7a40d , < a134e4b8102c077286818ee112b9f925db613d4c (git) Affected: e80cf84b608725303113d6fe98bb727bf7b7a40d , < 4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce (git) Affected: e80cf84b608725303113d6fe98bb727bf7b7a40d , < 9c75402286409f5e1a75e4a445555c84066f89db (git) Affected: 8c735ef894dfcca8d0a1cc554f83a82a70fd5b76 (git) Affected: 4007883dc7df1dbaeb461b850e0b1b27c057affc (git) Affected: 5.10.235 , < 5.10.266 (semver) Affected: 5.15.179 , < 5.15.217 (semver) Affected: 6.1.129 , < 6.1.184 (semver) Affected: 6.6.78 , < 6.6.153 (semver) Affected: 6.12.14 , < 6.12.105 (semver) Affected: 5.4.291 , < 5.5 (semver) Affected: 6.13.3 , < 6.14 (semver) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/qce/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dbca8b798caf47fb2799a26dd09c9ad66305883d",
"status": "affected",
"version": "9e403fea74ecbe6b4a4321f13bd4bc929382908d",
"versionType": "git"
},
{
"lessThan": "fef187c6194d67395182d58169dd14ba631f1b41",
"status": "affected",
"version": "f52f00efd8c0088992ac07ef46af6096e4f0e52e",
"versionType": "git"
},
{
"lessThan": "1ece8e16c085e8cd60ecbdb641269aaa53d31da4",
"status": "affected",
"version": "5d5b673b4dd260226b2202f66a920566c27051f3",
"versionType": "git"
},
{
"lessThan": "de52c713d21806b93b00a6074056b57aec4f8919",
"status": "affected",
"version": "e914b2f795b6995bb0e7db45caa4a912dca09e65",
"versionType": "git"
},
{
"lessThan": "c7dc487aade12c692add3221673c9bdf32dc24f5",
"status": "affected",
"version": "76e6d50fa5a2fb466edcc8b513d7aad372312c2a",
"versionType": "git"
},
{
"lessThan": "a134e4b8102c077286818ee112b9f925db613d4c",
"status": "affected",
"version": "e80cf84b608725303113d6fe98bb727bf7b7a40d",
"versionType": "git"
},
{
"lessThan": "4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce",
"status": "affected",
"version": "e80cf84b608725303113d6fe98bb727bf7b7a40d",
"versionType": "git"
},
{
"lessThan": "9c75402286409f5e1a75e4a445555c84066f89db",
"status": "affected",
"version": "e80cf84b608725303113d6fe98bb727bf7b7a40d",
"versionType": "git"
},
{
"status": "affected",
"version": "8c735ef894dfcca8d0a1cc554f83a82a70fd5b76",
"versionType": "git"
},
{
"status": "affected",
"version": "4007883dc7df1dbaeb461b850e0b1b27c057affc",
"versionType": "git"
},
{
"lessThan": "5.10.266",
"status": "affected",
"version": "5.10.235",
"versionType": "semver"
},
{
"lessThan": "5.15.217",
"status": "affected",
"version": "5.15.179",
"versionType": "semver"
},
{
"lessThan": "6.1.184",
"status": "affected",
"version": "6.1.129",
"versionType": "semver"
},
{
"lessThan": "6.6.153",
"status": "affected",
"version": "6.6.78",
"versionType": "semver"
},
{
"lessThan": "6.12.105",
"status": "affected",
"version": "6.12.14",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.291",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/qce/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.10.235",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.15.179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "6.1.129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "6.6.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.12.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.291",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qce - fix error path in devm_qce_register_algs\n\nIf ops-\u003eregister_algs() fails, the error path repeatedly calls the same\nops-\u003eunregister_algs() from the failed registration. Use the loop index\nto unregister the previously registered algorithms instead."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:28.953Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dbca8b798caf47fb2799a26dd09c9ad66305883d"
},
{
"url": "https://git.kernel.org/stable/c/fef187c6194d67395182d58169dd14ba631f1b41"
},
{
"url": "https://git.kernel.org/stable/c/1ece8e16c085e8cd60ecbdb641269aaa53d31da4"
},
{
"url": "https://git.kernel.org/stable/c/de52c713d21806b93b00a6074056b57aec4f8919"
},
{
"url": "https://git.kernel.org/stable/c/c7dc487aade12c692add3221673c9bdf32dc24f5"
},
{
"url": "https://git.kernel.org/stable/c/a134e4b8102c077286818ee112b9f925db613d4c"
},
{
"url": "https://git.kernel.org/stable/c/4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce"
},
{
"url": "https://git.kernel.org/stable/c/9c75402286409f5e1a75e4a445555c84066f89db"
}
],
"title": "crypto: qce - fix error path in devm_qce_register_algs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80565",
"datePublished": "2026-08-26T14:37:28.953Z",
"dateReserved": "2026-08-26T14:34:25.767Z",
"dateUpdated": "2026-08-26T14:37:28.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80564 (GCVE-0-2026-80564)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
gve: fix NULL dereference due to missing ptp adjfine
Summary
In the Linux kernel, the following vulnerability has been resolved:
gve: fix NULL dereference due to missing ptp adjfine
Fix NULL dereference due to missing implementation of adjfine, which can
be triggered from usermode as follows:
sudo ./testptp -d /dev/ptp0 -f 0
[ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
[ 552.061946] Call Trace:
[ 552.064487] <TASK>
[ 552.066681] ptp_clock_adjtime+0x1c0/0x2c0
[ 552.070874] ? get_clock_desc+0x6b/0xb0
[ 552.074825] pc_clock_adjtime+0x78/0xc0
[ 552.078755] __do_sys_clock_adjtime+0x85/0x110
[ 552.083293] do_syscall_64+0xea/0x610
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
acd16380523b400400523fe54c7499320e558e80 , < e9482feeed66d4bc805458631013e9b61b1a9eaf
(git)
Affected: acd16380523b400400523fe54c7499320e558e80 , < fa9b991bf678dd412dc0ed080672d34d7558d7af (git) Affected: acd16380523b400400523fe54c7499320e558e80 , < 3992ced109c70b771efad9e51ae68e5c7a04dea3 (git) |
|
| Linux | Linux |
Affected:
6.17
Unaffected: 0 , < 6.17 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/google/gve/gve_ptp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9482feeed66d4bc805458631013e9b61b1a9eaf",
"status": "affected",
"version": "acd16380523b400400523fe54c7499320e558e80",
"versionType": "git"
},
{
"lessThan": "fa9b991bf678dd412dc0ed080672d34d7558d7af",
"status": "affected",
"version": "acd16380523b400400523fe54c7499320e558e80",
"versionType": "git"
},
{
"lessThan": "3992ced109c70b771efad9e51ae68e5c7a04dea3",
"status": "affected",
"version": "acd16380523b400400523fe54c7499320e558e80",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/google/gve/gve_ptp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix NULL dereference due to missing ptp adjfine\n\nFix NULL dereference due to missing implementation of adjfine, which can\nbe triggered from usermode as follows:\n\nsudo ./testptp -d /dev/ptp0 -f 0\n[ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[...]\n[ 552.061946] Call Trace:\n[ 552.064487] \u003cTASK\u003e\n[ 552.066681] ptp_clock_adjtime+0x1c0/0x2c0\n[ 552.070874] ? get_clock_desc+0x6b/0xb0\n[ 552.074825] pc_clock_adjtime+0x78/0xc0\n[ 552.078755] __do_sys_clock_adjtime+0x85/0x110\n[ 552.083293] do_syscall_64+0xea/0x610"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:28.351Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9482feeed66d4bc805458631013e9b61b1a9eaf"
},
{
"url": "https://git.kernel.org/stable/c/fa9b991bf678dd412dc0ed080672d34d7558d7af"
},
{
"url": "https://git.kernel.org/stable/c/3992ced109c70b771efad9e51ae68e5c7a04dea3"
}
],
"title": "gve: fix NULL dereference due to missing ptp adjfine",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80564",
"datePublished": "2026-08-26T14:37:28.351Z",
"dateReserved": "2026-08-26T14:34:25.767Z",
"dateUpdated": "2026-08-26T14:37:28.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80563 (GCVE-0-2026-80563)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
The "trigger" debugfs file has a hand-rolled ->write handler
(trigger_write()) that dereferences the per-device gpio_la_poll_priv. The
file is created with debugfs_create_file_unsafe(), and the handler never
takes a debugfs reference. Nothing keeps the object alive while the
handler runs.
priv is allocated with devm_kzalloc(). devres frees it when the platform
device is unbound. debugfs_create_file_unsafe() installs no full_proxy
wrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not
wait for an in-flight trigger_write(). The blob_lock taken there does not
help, because trigger_write() never takes it. A write that races an unbind
therefore writes into freed memory:
trigger_write() gpio_la_poll_remove()
priv = m->private
buf = memdup_user() [may sleep]
mutex_lock(&priv->blob_lock)
debugfs_remove_recursive() [no wait]
mutex_unlock(&priv->blob_lock)
(remove returns; devres frees priv)
priv->trig_data = buf <-- use-after-free write
priv->trig_len = count
The race is reachable by root via
/sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.
Create "trigger" with debugfs_create_file() instead. Its full_proxy
wrapper makes debugfs_remove_recursive() drain any in-flight ->write
before it returns.
The use-after-free is confirmed under KASAN with a minimal reproducer of
the same debugfs_create_file_unsafe() plus devm_kzalloc() pattern
(available on request); it produces a slab-use-after-free write in the
handler.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7828b7bbbf2074dd7dd14d87f50bc5ce9036d692 , < 49a1ebb1ef2c8ada300c174b65273810abb4e326
(git)
Affected: 7828b7bbbf2074dd7dd14d87f50bc5ce9036d692 , < 23e9f32c0c7d2043e39655cff5ee3ddf29a43f80 (git) Affected: 7828b7bbbf2074dd7dd14d87f50bc5ce9036d692 , < 24bef4918f6ab806260476e2f93d8f791fd17449 (git) Affected: 7828b7bbbf2074dd7dd14d87f50bc5ce9036d692 , < 44f3468a0aef1aabdad551898ab7cfa2a9d20e99 (git) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-sloppy-logic-analyzer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "49a1ebb1ef2c8ada300c174b65273810abb4e326",
"status": "affected",
"version": "7828b7bbbf2074dd7dd14d87f50bc5ce9036d692",
"versionType": "git"
},
{
"lessThan": "23e9f32c0c7d2043e39655cff5ee3ddf29a43f80",
"status": "affected",
"version": "7828b7bbbf2074dd7dd14d87f50bc5ce9036d692",
"versionType": "git"
},
{
"lessThan": "24bef4918f6ab806260476e2f93d8f791fd17449",
"status": "affected",
"version": "7828b7bbbf2074dd7dd14d87f50bc5ce9036d692",
"versionType": "git"
},
{
"lessThan": "44f3468a0aef1aabdad551898ab7cfa2a9d20e99",
"status": "affected",
"version": "7828b7bbbf2074dd7dd14d87f50bc5ce9036d692",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-sloppy-logic-analyzer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind\n\nThe \"trigger\" debugfs file has a hand-rolled -\u003ewrite handler\n(trigger_write()) that dereferences the per-device gpio_la_poll_priv. The\nfile is created with debugfs_create_file_unsafe(), and the handler never\ntakes a debugfs reference. Nothing keeps the object alive while the\nhandler runs.\n\npriv is allocated with devm_kzalloc(). devres frees it when the platform\ndevice is unbound. debugfs_create_file_unsafe() installs no full_proxy\nwrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not\nwait for an in-flight trigger_write(). The blob_lock taken there does not\nhelp, because trigger_write() never takes it. A write that races an unbind\ntherefore writes into freed memory:\n\n trigger_write() gpio_la_poll_remove()\n priv = m-\u003eprivate\n buf = memdup_user() [may sleep]\n mutex_lock(\u0026priv-\u003eblob_lock)\n debugfs_remove_recursive() [no wait]\n mutex_unlock(\u0026priv-\u003eblob_lock)\n (remove returns; devres frees priv)\n priv-\u003etrig_data = buf \u003c-- use-after-free write\n priv-\u003etrig_len = count\n\nThe race is reachable by root via\n/sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.\n\nCreate \"trigger\" with debugfs_create_file() instead. Its full_proxy\nwrapper makes debugfs_remove_recursive() drain any in-flight -\u003ewrite\nbefore it returns.\n\nThe use-after-free is confirmed under KASAN with a minimal reproducer of\nthe same debugfs_create_file_unsafe() plus devm_kzalloc() pattern\n(available on request); it produces a slab-use-after-free write in the\nhandler."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:27.759Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/49a1ebb1ef2c8ada300c174b65273810abb4e326"
},
{
"url": "https://git.kernel.org/stable/c/23e9f32c0c7d2043e39655cff5ee3ddf29a43f80"
},
{
"url": "https://git.kernel.org/stable/c/24bef4918f6ab806260476e2f93d8f791fd17449"
},
{
"url": "https://git.kernel.org/stable/c/44f3468a0aef1aabdad551898ab7cfa2a9d20e99"
}
],
"title": "gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80563",
"datePublished": "2026-08-26T14:37:27.759Z",
"dateReserved": "2026-08-26T14:34:25.767Z",
"dateUpdated": "2026-08-26T14:37:27.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80562 (GCVE-0-2026-80562)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
gpio: ml-ioh: use raw_spinlock_t for the register lock
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: ml-ioh: use raw_spinlock_t for the register lock
ioh_irq_type() is registered as the irq_chip .irq_set_type callback and
takes chip->spinlock with spin_lock_irqsave(). This callback is reached
from __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while
the caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled.
That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is
an rtmutex-backed sleeping lock, so acquiring it there is invalid.
ioh_irq_enable() and ioh_irq_disable() take the same lock from the
.irq_enable/.irq_disable callbacks, which are likewise invoked with
desc->lock held.
Convert the register lock to raw_spinlock_t. The same lock also
serializes the GPIO direction/value callbacks and the suspend/resume
register save/restore, and those critical sections only perform short
sequences of MMIO register accesses (ioread32()/iowrite32()); the
.irq_set_type callback additionally emits a dev_warn() on an unsupported
type. None of these are sleepable operations, so keeping this register
lock non-sleeping is appropriate for the irqchip callbacks and does not
change the GPIO-side locking contract.
This is the same fix as commit a02b8950d619 ("gpio: pch: use
raw_spinlock_t for the register lock"); this driver shares the same
structure as gpio-pch.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
54be566317b6aece2389a95bb19ea209af9359be , < bc7934d0acd4fc1c7e5b7c68debdb4a991121628
(git)
Affected: 54be566317b6aece2389a95bb19ea209af9359be , < 0559b86611c35d342dd48542ea26a9e437046bf6 (git) Affected: 54be566317b6aece2389a95bb19ea209af9359be , < 600411ea1f2443fdf5b1af9b6480f616d7aff9d0 (git) |
|
| Linux | Linux |
Affected:
3.2
Unaffected: 0 , < 3.2 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-ml-ioh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bc7934d0acd4fc1c7e5b7c68debdb4a991121628",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
},
{
"lessThan": "0559b86611c35d342dd48542ea26a9e437046bf6",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
},
{
"lessThan": "600411ea1f2443fdf5b1af9b6480f616d7aff9d0",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-ml-ioh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: ml-ioh: use raw_spinlock_t for the register lock\n\nioh_irq_type() is registered as the irq_chip .irq_set_type callback and\ntakes chip-\u003espinlock with spin_lock_irqsave(). This callback is reached\nfrom __setup_irq() -\u003e __irq_set_trigger() -\u003e chip-\u003eirq_set_type() while\nthe caller holds desc-\u003elock, a raw_spinlock_t, with hardirqs disabled.\nThat context is not sleepable, but on PREEMPT_RT a regular spinlock_t is\nan rtmutex-backed sleeping lock, so acquiring it there is invalid.\nioh_irq_enable() and ioh_irq_disable() take the same lock from the\n.irq_enable/.irq_disable callbacks, which are likewise invoked with\ndesc-\u003elock held.\n\nConvert the register lock to raw_spinlock_t. The same lock also\nserializes the GPIO direction/value callbacks and the suspend/resume\nregister save/restore, and those critical sections only perform short\nsequences of MMIO register accesses (ioread32()/iowrite32()); the\n.irq_set_type callback additionally emits a dev_warn() on an unsupported\ntype. None of these are sleepable operations, so keeping this register\nlock non-sleeping is appropriate for the irqchip callbacks and does not\nchange the GPIO-side locking contract.\n\nThis is the same fix as commit a02b8950d619 (\"gpio: pch: use\nraw_spinlock_t for the register lock\"); this driver shares the same\nstructure as gpio-pch."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:27.171Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bc7934d0acd4fc1c7e5b7c68debdb4a991121628"
},
{
"url": "https://git.kernel.org/stable/c/0559b86611c35d342dd48542ea26a9e437046bf6"
},
{
"url": "https://git.kernel.org/stable/c/600411ea1f2443fdf5b1af9b6480f616d7aff9d0"
}
],
"title": "gpio: ml-ioh: use raw_spinlock_t for the register lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80562",
"datePublished": "2026-08-26T14:37:27.171Z",
"dateReserved": "2026-08-26T14:34:25.767Z",
"dateUpdated": "2026-08-26T14:37:27.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80561 (GCVE-0-2026-80561)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
libceph: fix multiple unsafe decodes in decode_locker()
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: fix multiple unsafe decodes in decode_locker()
decode_locker() in cls_lock_client.c contains three unsafe decode
operations that allow a malicious or compromised OSD to trigger
slab-out-of-bounds reads:
1. ceph_decode_copy() at the locker_id_t name field has no preceding
bounds check. With p == end after ceph_start_decoding() accepts
struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past
the validated buffer boundary.
2. *p += sizeof(struct ceph_timespec) after the locker_info_t header
is an unchecked pointer advance. A malicious OSD can position p
past end, causing all subsequent _safe checks to pass against a
bogus boundary.
3. len = ceph_decode_32(p) has no preceding bounds check, and the
immediately following *p += len is uncapped. A malicious OSD can
send len=0xffffffff, advancing p gigabytes past end and escaping
the decode window entirely.
Fix all three by replacing bare operations with their safe variants:
ceph_decode_copy -> ceph_decode_copy_safe
*p += sizeof(...) -> ceph_decode_skip_n
ceph_decode_32(p) -> ceph_decode_32_safe
*p += len -> ceph_decode_skip_n
A new label is added to return -EINVAL on any bounds violation.
-EINVAL is appropriate here: the data received from the OSD
is structurally malformed, which is an invalid argument to the decode
contract regardless of whether the caller or the wire is at fault.
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph
deployment can trigger this against any kernel client that issues the
lock.get_info class method (e.g. during RBD exclusive lock acquisition)
without any further privileges beyond OSD session establishment.
[ idryomov: use ceph_decode_skip_string() to skip description, trim
changelog ]
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d4ed4a530562881cc5225050e42d96034f405aae , < 1ed45c8d96498725eb54f740172f9068d8673906
(git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 6265103e78f0ee7e2518de9cf938b94bee9700a0 (git) Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070 (git) Affected: d4ed4a530562881cc5225050e42d96034f405aae , < fa4aa86fff0c56799c2e3f51a88879053285f4a9 (git) Affected: d4ed4a530562881cc5225050e42d96034f405aae , < dbfd83f722a78446ec18a476ef7a38e52240b50a (git) Affected: d4ed4a530562881cc5225050e42d96034f405aae , < d1bba38574d095f191557d397d9633f08cd966b1 (git) Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 51c8d238fe7236de627ab1a1433694552a904136 (git) Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 437b6551cfcc235eea1d735a874f9d421f555e17 (git) |
|
| Linux | Linux |
Affected:
4.9
Unaffected: 0 , < 4.9 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/cls_lock_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1ed45c8d96498725eb54f740172f9068d8673906",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "6265103e78f0ee7e2518de9cf938b94bee9700a0",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "fa4aa86fff0c56799c2e3f51a88879053285f4a9",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "dbfd83f722a78446ec18a476ef7a38e52240b50a",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "d1bba38574d095f191557d397d9633f08cd966b1",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "51c8d238fe7236de627ab1a1433694552a904136",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "437b6551cfcc235eea1d735a874f9d421f555e17",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/cls_lock_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix multiple unsafe decodes in decode_locker()\n\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\n bounds check. With p == end after ceph_start_decoding() accepts\n struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\n the validated buffer boundary.\n\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\n is an unchecked pointer advance. A malicious OSD can position p\n past end, causing all subsequent _safe checks to pass against a\n bogus boundary.\n\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\n immediately following *p += len is uncapped. A malicious OSD can\n send len=0xffffffff, advancing p gigabytes past end and escaping\n the decode window entirely.\n\nFix all three by replacing bare operations with their safe variants:\n ceph_decode_copy -\u003e ceph_decode_copy_safe\n *p += sizeof(...) -\u003e ceph_decode_skip_n\n ceph_decode_32(p) -\u003e ceph_decode_32_safe\n *p += len -\u003e ceph_decode_skip_n\n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\n changelog ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:26.572Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906"
},
{
"url": "https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0"
},
{
"url": "https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070"
},
{
"url": "https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9"
},
{
"url": "https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a"
},
{
"url": "https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1"
},
{
"url": "https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136"
},
{
"url": "https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17"
}
],
"title": "libceph: fix multiple unsafe decodes in decode_locker()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80561",
"datePublished": "2026-08-26T14:37:26.572Z",
"dateReserved": "2026-08-26T14:34:25.767Z",
"dateUpdated": "2026-08-26T14:37:26.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80560 (GCVE-0-2026-80560)
Vulnerability from nvd – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
openrisc: signal: do not restore privileged SR bits on sigreturn
Summary
In the Linux kernel, the following vulnerability has been resolved:
openrisc: signal: do not restore privileged SR bits on sigreturn
restore_sigcontext() copies the whole supervision register (SR) from the
signal frame and only clears SPR_SR_SM before the value is reloaded into
the hardware SR (through ESR and l.rfe) on the return to user space. All
other SR bits are left under user control.
An unprivileged task can thus return from a signal handler through a
crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the
CPU performs no translation or protection on data accesses, so the task
gains read and write access to arbitrary physical memory, a local
privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH
and the cache-enable bits are exposed the same way. The ptrace GPR regset
already refuses any change to SR for exactly this reason.
Restore only the arithmetic flag bits (F, CY, OV) from the signal frame
and take every privileged control bit from the SR the kernel saved on
signal entry.
Verified with qemu-system-or1k -M or1k-sim: before this change an
unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to
physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the
same PoC receives SIGSEGV and physical memory is unchanged.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ac689eb7f9d4e270d1365853b82eece669387e2c , < bc2e24ba6e167ccf374a197457aa5640a802f429
(git)
Affected: ac689eb7f9d4e270d1365853b82eece669387e2c , < cf1b5514ddf9df098ce7e3741fc9679fd85a4ec6 (git) Affected: ac689eb7f9d4e270d1365853b82eece669387e2c , < cd8b43a71755c516f5c1f265a103438ae9ab15be (git) Affected: ac689eb7f9d4e270d1365853b82eece669387e2c , < b4d73c3848bae9084fa8b9b2aa76d99a7d8eb17d (git) Affected: ac689eb7f9d4e270d1365853b82eece669387e2c , < 89a91b30685c0493b0fa2b47d0ab41061a63069d (git) Affected: ac689eb7f9d4e270d1365853b82eece669387e2c , < a88d688be8d7f03cbf927f2ab454ea9fa58d2979 (git) Affected: ac689eb7f9d4e270d1365853b82eece669387e2c , < 212fc482ddd7f9ccdd74a05eab1cac849350dcd6 (git) Affected: ac689eb7f9d4e270d1365853b82eece669387e2c , < 32ef1b30ad736519f7a207bcc2986f3d4129d972 (git) |
|
| Linux | Linux |
Affected:
3.1
Unaffected: 0 , < 3.1 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/openrisc/include/asm/processor.h",
"arch/openrisc/kernel/signal.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bc2e24ba6e167ccf374a197457aa5640a802f429",
"status": "affected",
"version": "ac689eb7f9d4e270d1365853b82eece669387e2c",
"versionType": "git"
},
{
"lessThan": "cf1b5514ddf9df098ce7e3741fc9679fd85a4ec6",
"status": "affected",
"version": "ac689eb7f9d4e270d1365853b82eece669387e2c",
"versionType": "git"
},
{
"lessThan": "cd8b43a71755c516f5c1f265a103438ae9ab15be",
"status": "affected",
"version": "ac689eb7f9d4e270d1365853b82eece669387e2c",
"versionType": "git"
},
{
"lessThan": "b4d73c3848bae9084fa8b9b2aa76d99a7d8eb17d",
"status": "affected",
"version": "ac689eb7f9d4e270d1365853b82eece669387e2c",
"versionType": "git"
},
{
"lessThan": "89a91b30685c0493b0fa2b47d0ab41061a63069d",
"status": "affected",
"version": "ac689eb7f9d4e270d1365853b82eece669387e2c",
"versionType": "git"
},
{
"lessThan": "a88d688be8d7f03cbf927f2ab454ea9fa58d2979",
"status": "affected",
"version": "ac689eb7f9d4e270d1365853b82eece669387e2c",
"versionType": "git"
},
{
"lessThan": "212fc482ddd7f9ccdd74a05eab1cac849350dcd6",
"status": "affected",
"version": "ac689eb7f9d4e270d1365853b82eece669387e2c",
"versionType": "git"
},
{
"lessThan": "32ef1b30ad736519f7a207bcc2986f3d4129d972",
"status": "affected",
"version": "ac689eb7f9d4e270d1365853b82eece669387e2c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/openrisc/include/asm/processor.h",
"arch/openrisc/kernel/signal.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenrisc: signal: do not restore privileged SR bits on sigreturn\n\nrestore_sigcontext() copies the whole supervision register (SR) from the\nsignal frame and only clears SPR_SR_SM before the value is reloaded into\nthe hardware SR (through ESR and l.rfe) on the return to user space. All\nother SR bits are left under user control.\n\nAn unprivileged task can thus return from a signal handler through a\ncrafted sigframe that clears SPR_SR_DME. With the data MMU disabled the\nCPU performs no translation or protection on data accesses, so the task\ngains read and write access to arbitrary physical memory, a local\nprivilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH\nand the cache-enable bits are exposed the same way. The ptrace GPR regset\nalready refuses any change to SR for exactly this reason.\n\nRestore only the arithmetic flag bits (F, CY, OV) from the signal frame\nand take every privileged control bit from the SR the kernel saved on\nsignal entry.\n\nVerified with qemu-system-or1k -M or1k-sim: before this change an\nunprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to\nphysical address 0x03000000 (beyond the kernel\u0027s mem=32M); afterwards the\nsame PoC receives SIGSEGV and physical memory is unchanged."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:25.971Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bc2e24ba6e167ccf374a197457aa5640a802f429"
},
{
"url": "https://git.kernel.org/stable/c/cf1b5514ddf9df098ce7e3741fc9679fd85a4ec6"
},
{
"url": "https://git.kernel.org/stable/c/cd8b43a71755c516f5c1f265a103438ae9ab15be"
},
{
"url": "https://git.kernel.org/stable/c/b4d73c3848bae9084fa8b9b2aa76d99a7d8eb17d"
},
{
"url": "https://git.kernel.org/stable/c/89a91b30685c0493b0fa2b47d0ab41061a63069d"
},
{
"url": "https://git.kernel.org/stable/c/a88d688be8d7f03cbf927f2ab454ea9fa58d2979"
},
{
"url": "https://git.kernel.org/stable/c/212fc482ddd7f9ccdd74a05eab1cac849350dcd6"
},
{
"url": "https://git.kernel.org/stable/c/32ef1b30ad736519f7a207bcc2986f3d4129d972"
}
],
"title": "openrisc: signal: do not restore privileged SR bits on sigreturn",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80560",
"datePublished": "2026-08-26T14:37:25.971Z",
"dateReserved": "2026-08-26T14:34:25.767Z",
"dateUpdated": "2026-08-26T14:37:25.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}