Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
18846 vulnerabilities by Linux
CVE-2026-80757 (GCVE-0-2026-80757)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
selinux: reject a class permission count below its inherited common
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: reject a class permission count below its inherited common
security_get_permissions() maps an inherited common's permissions into
an array sized by the class's own permissions.nprim, but class_read()
takes that nprim verbatim from the policy image and never checks that it
covers the common. A class that inherits a common of N permissions while
declaring a smaller nprim is accepted, and on load the common's
permissions are written past the class-sized array -- an out-of-bounds
heap write.
Reject a class whose permission count is below its inherited common's.
Well-formed policies, where the class count already includes the
inherited permissions, are unaffected.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 2002ff745db64ac83ee1bb9ff78196d2d68bfdb3
(git)
Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 38d91446630a20ce8c2a981810deea81fd61a3b5 (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 638213f2e6ea52c06a25861616781338d154db35 (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7 (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < a63011c009ea79439b800a05602b880eb4adbb05 (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < acd5b09be98fd38b7392307880156fb0452a7276 (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 1b995966c3ae5244751bdaee9bfe7e17567d4fbe (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 9a82dcd98b6e6e11cfd162410967951f12152528 (git) |
|
| Linux | Linux |
Affected:
2.6.23
Unaffected: 0 , < 2.6.23 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/policydb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2002ff745db64ac83ee1bb9ff78196d2d68bfdb3",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "38d91446630a20ce8c2a981810deea81fd61a3b5",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "638213f2e6ea52c06a25861616781338d154db35",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "a63011c009ea79439b800a05602b880eb4adbb05",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "acd5b09be98fd38b7392307880156fb0452a7276",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "1b995966c3ae5244751bdaee9bfe7e17567d4fbe",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "9a82dcd98b6e6e11cfd162410967951f12152528",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/policydb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: reject a class permission count below its inherited common\n\nsecurity_get_permissions() maps an inherited common\u0027s permissions into\nan array sized by the class\u0027s own permissions.nprim, but class_read()\ntakes that nprim verbatim from the policy image and never checks that it\ncovers the common. A class that inherits a common of N permissions while\ndeclaring a smaller nprim is accepted, and on load the common\u0027s\npermissions are written past the class-sized array -- an out-of-bounds\nheap write.\n\nReject a class whose permission count is below its inherited common\u0027s.\nWell-formed policies, where the class count already includes the\ninherited permissions, are unaffected."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:35.005Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2002ff745db64ac83ee1bb9ff78196d2d68bfdb3"
},
{
"url": "https://git.kernel.org/stable/c/38d91446630a20ce8c2a981810deea81fd61a3b5"
},
{
"url": "https://git.kernel.org/stable/c/638213f2e6ea52c06a25861616781338d154db35"
},
{
"url": "https://git.kernel.org/stable/c/2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7"
},
{
"url": "https://git.kernel.org/stable/c/a63011c009ea79439b800a05602b880eb4adbb05"
},
{
"url": "https://git.kernel.org/stable/c/acd5b09be98fd38b7392307880156fb0452a7276"
},
{
"url": "https://git.kernel.org/stable/c/1b995966c3ae5244751bdaee9bfe7e17567d4fbe"
},
{
"url": "https://git.kernel.org/stable/c/9a82dcd98b6e6e11cfd162410967951f12152528"
}
],
"title": "selinux: reject a class permission count below its inherited common",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80757",
"datePublished": "2026-09-03T08:26:35.005Z",
"dateReserved": "2026-08-26T14:34:25.791Z",
"dateUpdated": "2026-09-03T08:26:35.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80756 (GCVE-0-2026-80756)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
selinux: do not cancel a policy conversion that never started
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: do not cancel a policy conversion that never started
sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes()
fails, and that helper dereferences the outgoing policy to cancel its
sidtab conversion. On the first policy load there is no outgoing policy:
security_load_policy() returns early for that case, before it converts
anything, and state->policy is still NULL. A first load that fails while
building the selinuxfs tree therefore takes a NULL dereference in
selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.
Skip the cancel when there is no old policy, mirroring the check
security_load_policy() already makes before it converts.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 , < 2d29983104f06f5b0babcd5a25a0f0408272cd27
(git)
Affected: 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 , < a4f182f8715cb0819445f0850cd5436828f4bafc (git) Affected: 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 , < 1059789ae9f99cbbe3a78e361e9c0976beb5958b (git) Affected: 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 , < 1acc317d67a755a45e32419a15d70e403fa43f0e (git) Affected: 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 , < a42932c6aa33d0aac683cacdf1ec7009b955ba5d (git) Affected: 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 , < 1b4ff94ae7c580c880291519fb0e3e2bd075beef (git) Affected: 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 , < 219c96de5d9b6b4af7e8576ad897b774cc3ee9a7 (git) Affected: 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 , < e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e (git) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/services.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2d29983104f06f5b0babcd5a25a0f0408272cd27",
"status": "affected",
"version": "02a52c5c8c3b8cbad0f12009cde9f36dbefb6972",
"versionType": "git"
},
{
"lessThan": "a4f182f8715cb0819445f0850cd5436828f4bafc",
"status": "affected",
"version": "02a52c5c8c3b8cbad0f12009cde9f36dbefb6972",
"versionType": "git"
},
{
"lessThan": "1059789ae9f99cbbe3a78e361e9c0976beb5958b",
"status": "affected",
"version": "02a52c5c8c3b8cbad0f12009cde9f36dbefb6972",
"versionType": "git"
},
{
"lessThan": "1acc317d67a755a45e32419a15d70e403fa43f0e",
"status": "affected",
"version": "02a52c5c8c3b8cbad0f12009cde9f36dbefb6972",
"versionType": "git"
},
{
"lessThan": "a42932c6aa33d0aac683cacdf1ec7009b955ba5d",
"status": "affected",
"version": "02a52c5c8c3b8cbad0f12009cde9f36dbefb6972",
"versionType": "git"
},
{
"lessThan": "1b4ff94ae7c580c880291519fb0e3e2bd075beef",
"status": "affected",
"version": "02a52c5c8c3b8cbad0f12009cde9f36dbefb6972",
"versionType": "git"
},
{
"lessThan": "219c96de5d9b6b4af7e8576ad897b774cc3ee9a7",
"status": "affected",
"version": "02a52c5c8c3b8cbad0f12009cde9f36dbefb6972",
"versionType": "git"
},
{
"lessThan": "e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e",
"status": "affected",
"version": "02a52c5c8c3b8cbad0f12009cde9f36dbefb6972",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/services.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: do not cancel a policy conversion that never started\n\nsel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes()\nfails, and that helper dereferences the outgoing policy to cancel its\nsidtab conversion. On the first policy load there is no outgoing policy:\nsecurity_load_policy() returns early for that case, before it converts\nanything, and state-\u003epolicy is still NULL. A first load that fails while\nbuilding the selinuxfs tree therefore takes a NULL dereference in\nselinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.\n\nSkip the cancel when there is no old policy, mirroring the check\nsecurity_load_policy() already makes before it converts."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:34.396Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2d29983104f06f5b0babcd5a25a0f0408272cd27"
},
{
"url": "https://git.kernel.org/stable/c/a4f182f8715cb0819445f0850cd5436828f4bafc"
},
{
"url": "https://git.kernel.org/stable/c/1059789ae9f99cbbe3a78e361e9c0976beb5958b"
},
{
"url": "https://git.kernel.org/stable/c/1acc317d67a755a45e32419a15d70e403fa43f0e"
},
{
"url": "https://git.kernel.org/stable/c/a42932c6aa33d0aac683cacdf1ec7009b955ba5d"
},
{
"url": "https://git.kernel.org/stable/c/1b4ff94ae7c580c880291519fb0e3e2bd075beef"
},
{
"url": "https://git.kernel.org/stable/c/219c96de5d9b6b4af7e8576ad897b774cc3ee9a7"
},
{
"url": "https://git.kernel.org/stable/c/e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e"
}
],
"title": "selinux: do not cancel a policy conversion that never started",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80756",
"datePublished": "2026-09-03T08:26:34.396Z",
"dateReserved": "2026-08-26T14:34:25.791Z",
"dateUpdated": "2026-09-03T08:26:34.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80755 (GCVE-0-2026-80755)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
selinux: reject a permission value exceeding the class permission count
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: reject a permission value exceeding the class permission count
perm_read() bounds a permission value by SEL_VEC_MAX but never by the
nprim of the owning class or common, which is taken verbatim from the
policy image. security_get_permissions() then writes perms[value - 1]
into an nprim-sized kcalloc() array, so a class declaring fewer
permissions than its largest permission value drives an out-of-bounds
heap write. The top-level symbol tables are validated this way; the
nested per-class permission table is not.
Reject a permission whose value exceeds nprim, which is already set when
perm_read() runs. Well-formed policies are unaffected.
[PM: tweak comment for line length]
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < 6c2ab7c4549f4f2305848df834e784651dbf1676
(git)
Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < dfc59a062c386d3d4415ecdab781065a645f33cc (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < a7f3d4f22d920dc3c7d75f02ece0f7bf2c58437e (git) Affected: 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 , < d14b5d0e97fccd27974fedc03b903408872907fd (git) |
|
| Linux | Linux |
Affected:
2.6.23
Unaffected: 0 , < 2.6.23 (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/policydb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c2ab7c4549f4f2305848df834e784651dbf1676",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "dfc59a062c386d3d4415ecdab781065a645f33cc",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "a7f3d4f22d920dc3c7d75f02ece0f7bf2c58437e",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
},
{
"lessThan": "d14b5d0e97fccd27974fedc03b903408872907fd",
"status": "affected",
"version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/ss/policydb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: reject a permission value exceeding the class permission count\n\nperm_read() bounds a permission value by SEL_VEC_MAX but never by the\nnprim of the owning class or common, which is taken verbatim from the\npolicy image. security_get_permissions() then writes perms[value - 1]\ninto an nprim-sized kcalloc() array, so a class declaring fewer\npermissions than its largest permission value drives an out-of-bounds\nheap write. The top-level symbol tables are validated this way; the\nnested per-class permission table is not.\n\nReject a permission whose value exceeds nprim, which is already set when\nperm_read() runs. Well-formed policies are unaffected.\n\n[PM: tweak comment for line length]"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:33.797Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c2ab7c4549f4f2305848df834e784651dbf1676"
},
{
"url": "https://git.kernel.org/stable/c/dfc59a062c386d3d4415ecdab781065a645f33cc"
},
{
"url": "https://git.kernel.org/stable/c/a7f3d4f22d920dc3c7d75f02ece0f7bf2c58437e"
},
{
"url": "https://git.kernel.org/stable/c/d14b5d0e97fccd27974fedc03b903408872907fd"
}
],
"title": "selinux: reject a permission value exceeding the class permission count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80755",
"datePublished": "2026-09-03T08:26:33.797Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:33.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80754 (GCVE-0-2026-80754)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
During F55 sensor detection, the transmitter (TX) electrode count was
incorrectly assigned the value of the receiver (RX) electrode count
due to copy-paste typos.
This incorrect value was then propagated to the driver data and used
by F54 to determine the diagnostics report size. On devices with more
RX than TX electrodes, this inflated the perceived TX count, leading
to incorrect report size calculations and potential out-of-bounds
buffer accesses.
Fix the typos by correctly assigning the TX electrode counts.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6adba43fd222ea362c36296d1a6897c2e28fdc8e , < 6484e00d6778fdf2209cd75940bc3902b276457f
(git)
Affected: 6adba43fd222ea362c36296d1a6897c2e28fdc8e , < db4e20265ebda729610ca5cf45ca9437462c3f36 (git) Affected: 6adba43fd222ea362c36296d1a6897c2e28fdc8e , < a6d9646e77da7cab2dff7043a8e9f75e23b836bc (git) Affected: 6adba43fd222ea362c36296d1a6897c2e28fdc8e , < 0739c65e799d4a93fe573ed23255a71fcfcc5438 (git) Affected: 6adba43fd222ea362c36296d1a6897c2e28fdc8e , < 9759502f5cd71805923457f183ae5b9533e20c7b (git) Affected: 6adba43fd222ea362c36296d1a6897c2e28fdc8e , < 9b184c8337c6e12df129399007735a7fbcbbcb7b (git) Affected: 6adba43fd222ea362c36296d1a6897c2e28fdc8e , < a81cafe3c3c2f8494063385a7b0ea7ff407bf19f (git) Affected: 6adba43fd222ea362c36296d1a6897c2e28fdc8e , < 6058f0fea10f3caf63a435677358d1b8e9325114 (git) |
|
| Linux | Linux |
Affected:
4.10
Unaffected: 0 , < 4.10 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f55.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6484e00d6778fdf2209cd75940bc3902b276457f",
"status": "affected",
"version": "6adba43fd222ea362c36296d1a6897c2e28fdc8e",
"versionType": "git"
},
{
"lessThan": "db4e20265ebda729610ca5cf45ca9437462c3f36",
"status": "affected",
"version": "6adba43fd222ea362c36296d1a6897c2e28fdc8e",
"versionType": "git"
},
{
"lessThan": "a6d9646e77da7cab2dff7043a8e9f75e23b836bc",
"status": "affected",
"version": "6adba43fd222ea362c36296d1a6897c2e28fdc8e",
"versionType": "git"
},
{
"lessThan": "0739c65e799d4a93fe573ed23255a71fcfcc5438",
"status": "affected",
"version": "6adba43fd222ea362c36296d1a6897c2e28fdc8e",
"versionType": "git"
},
{
"lessThan": "9759502f5cd71805923457f183ae5b9533e20c7b",
"status": "affected",
"version": "6adba43fd222ea362c36296d1a6897c2e28fdc8e",
"versionType": "git"
},
{
"lessThan": "9b184c8337c6e12df129399007735a7fbcbbcb7b",
"status": "affected",
"version": "6adba43fd222ea362c36296d1a6897c2e28fdc8e",
"versionType": "git"
},
{
"lessThan": "a81cafe3c3c2f8494063385a7b0ea7ff407bf19f",
"status": "affected",
"version": "6adba43fd222ea362c36296d1a6897c2e28fdc8e",
"versionType": "git"
},
{
"lessThan": "6058f0fea10f3caf63a435677358d1b8e9325114",
"status": "affected",
"version": "6adba43fd222ea362c36296d1a6897c2e28fdc8e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f55.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - fix F55 transmitter electrode count typo\n\nDuring F55 sensor detection, the transmitter (TX) electrode count was\nincorrectly assigned the value of the receiver (RX) electrode count\ndue to copy-paste typos.\n\nThis incorrect value was then propagated to the driver data and used\nby F54 to determine the diagnostics report size. On devices with more\nRX than TX electrodes, this inflated the perceived TX count, leading\nto incorrect report size calculations and potential out-of-bounds\nbuffer accesses.\n\nFix the typos by correctly assigning the TX electrode counts."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:33.180Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6484e00d6778fdf2209cd75940bc3902b276457f"
},
{
"url": "https://git.kernel.org/stable/c/db4e20265ebda729610ca5cf45ca9437462c3f36"
},
{
"url": "https://git.kernel.org/stable/c/a6d9646e77da7cab2dff7043a8e9f75e23b836bc"
},
{
"url": "https://git.kernel.org/stable/c/0739c65e799d4a93fe573ed23255a71fcfcc5438"
},
{
"url": "https://git.kernel.org/stable/c/9759502f5cd71805923457f183ae5b9533e20c7b"
},
{
"url": "https://git.kernel.org/stable/c/9b184c8337c6e12df129399007735a7fbcbbcb7b"
},
{
"url": "https://git.kernel.org/stable/c/a81cafe3c3c2f8494063385a7b0ea7ff407bf19f"
},
{
"url": "https://git.kernel.org/stable/c/6058f0fea10f3caf63a435677358d1b8e9325114"
}
],
"title": "Input: synaptics-rmi4 - fix F55 transmitter electrode count typo",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80754",
"datePublished": "2026-09-03T08:26:33.180Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:33.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80753 (GCVE-0-2026-80753)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
ovpn: run deferred work on a module-owned workqueue
Summary
In the Linux kernel, the following vulnerability has been resolved:
ovpn: run deferred work on a module-owned workqueue
ovpn queues several work items whose callbacks execute module text.
These works currently run on the global system workqueues, so module
exit has no driver-owned drain point that guarantees the callbacks have
fully returned before the module text can be freed.
Object references protect the objects used by the callbacks, but they do
not prove that a workqueue function has returned. In particular, a
worker can drop the final reference that unblocks device teardown while
it is still executing ovpn code.
Add a module-owned workqueue and queue all ovpn work items on it. During
module exit, unregister rtnl and netlink first, flush the workqueue so
ordinary ovpn workers finish, run the final RCU barrier, and destroy the
workqueue last. This keeps the workqueue available for cleanup work
queued from RCU callbacks, while ensuring no ovpn work item can outlive
the module text.
The per-device delayed keepalive work remains explicitly disabled during
netdev teardown (disable_delayed_work_sync in ndo_uninit), since
flush_workqueue does not flush delayed work that is still only pending
on its timer.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
11851cbd60ea1e5abbd97619d69845ead99303d6 , < bbe81f40582d451ac849b20707784220f33a23bd
(git)
Affected: 11851cbd60ea1e5abbd97619d69845ead99303d6 , < e9714db8041763f59dde152c812b96b3de05c6d9 (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ovpn/main.c",
"drivers/net/ovpn/ovpnpriv.h",
"drivers/net/ovpn/peer.c",
"drivers/net/ovpn/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bbe81f40582d451ac849b20707784220f33a23bd",
"status": "affected",
"version": "11851cbd60ea1e5abbd97619d69845ead99303d6",
"versionType": "git"
},
{
"lessThan": "e9714db8041763f59dde152c812b96b3de05c6d9",
"status": "affected",
"version": "11851cbd60ea1e5abbd97619d69845ead99303d6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ovpn/main.c",
"drivers/net/ovpn/ovpnpriv.h",
"drivers/net/ovpn/peer.c",
"drivers/net/ovpn/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: run deferred work on a module-owned workqueue\n\novpn queues several work items whose callbacks execute module text.\nThese works currently run on the global system workqueues, so module\nexit has no driver-owned drain point that guarantees the callbacks have\nfully returned before the module text can be freed.\n\nObject references protect the objects used by the callbacks, but they do\nnot prove that a workqueue function has returned. In particular, a\nworker can drop the final reference that unblocks device teardown while\nit is still executing ovpn code.\n\nAdd a module-owned workqueue and queue all ovpn work items on it. During\nmodule exit, unregister rtnl and netlink first, flush the workqueue so\nordinary ovpn workers finish, run the final RCU barrier, and destroy the\nworkqueue last. This keeps the workqueue available for cleanup work\nqueued from RCU callbacks, while ensuring no ovpn work item can outlive\nthe module text.\n\nThe per-device delayed keepalive work remains explicitly disabled during\nnetdev teardown (disable_delayed_work_sync in ndo_uninit), since\nflush_workqueue does not flush delayed work that is still only pending\non its timer."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:32.564Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bbe81f40582d451ac849b20707784220f33a23bd"
},
{
"url": "https://git.kernel.org/stable/c/e9714db8041763f59dde152c812b96b3de05c6d9"
}
],
"title": "ovpn: run deferred work on a module-owned workqueue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80753",
"datePublished": "2026-09-03T08:26:32.564Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:32.564Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80752 (GCVE-0-2026-80752)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
Input: psxpad-spi - set driver data before use
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: psxpad-spi - set driver data before use
psxpad_spi_suspend() retrieves the controller state with
spi_get_drvdata(), but probe never stores it, so suspend dereferences a
NULL pointer. Store it during probe.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8be193c7b1f44d3f4dcb27107df0831709c2deb1 , < e980066e434a9c74ff1665ed9140427e95b0ee7c
(git)
Affected: 8be193c7b1f44d3f4dcb27107df0831709c2deb1 , < 1bba6bd6861b1e0c8ecf20cd1892f0d3877c02a2 (git) Affected: 8be193c7b1f44d3f4dcb27107df0831709c2deb1 , < 86531cdfb3a03213e2569deed5195412a4e3f7ee (git) Affected: 8be193c7b1f44d3f4dcb27107df0831709c2deb1 , < da6b8b05db0cf43e0cc198431fa8ee9739b3b817 (git) Affected: 8be193c7b1f44d3f4dcb27107df0831709c2deb1 , < 1edcb7ffee7ac4dc35cbe5bbd0e27bac3614ebe4 (git) Affected: 8be193c7b1f44d3f4dcb27107df0831709c2deb1 , < 8d622c58205adbc8af19864e277386528b671345 (git) Affected: 8be193c7b1f44d3f4dcb27107df0831709c2deb1 , < 62e25677d1440085381b047ec4984be9b6793759 (git) Affected: 8be193c7b1f44d3f4dcb27107df0831709c2deb1 , < 732f38c36059e68ba3b4b89c56911d777fd3185c (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/joystick/psxpad-spi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e980066e434a9c74ff1665ed9140427e95b0ee7c",
"status": "affected",
"version": "8be193c7b1f44d3f4dcb27107df0831709c2deb1",
"versionType": "git"
},
{
"lessThan": "1bba6bd6861b1e0c8ecf20cd1892f0d3877c02a2",
"status": "affected",
"version": "8be193c7b1f44d3f4dcb27107df0831709c2deb1",
"versionType": "git"
},
{
"lessThan": "86531cdfb3a03213e2569deed5195412a4e3f7ee",
"status": "affected",
"version": "8be193c7b1f44d3f4dcb27107df0831709c2deb1",
"versionType": "git"
},
{
"lessThan": "da6b8b05db0cf43e0cc198431fa8ee9739b3b817",
"status": "affected",
"version": "8be193c7b1f44d3f4dcb27107df0831709c2deb1",
"versionType": "git"
},
{
"lessThan": "1edcb7ffee7ac4dc35cbe5bbd0e27bac3614ebe4",
"status": "affected",
"version": "8be193c7b1f44d3f4dcb27107df0831709c2deb1",
"versionType": "git"
},
{
"lessThan": "8d622c58205adbc8af19864e277386528b671345",
"status": "affected",
"version": "8be193c7b1f44d3f4dcb27107df0831709c2deb1",
"versionType": "git"
},
{
"lessThan": "62e25677d1440085381b047ec4984be9b6793759",
"status": "affected",
"version": "8be193c7b1f44d3f4dcb27107df0831709c2deb1",
"versionType": "git"
},
{
"lessThan": "732f38c36059e68ba3b4b89c56911d777fd3185c",
"status": "affected",
"version": "8be193c7b1f44d3f4dcb27107df0831709c2deb1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/joystick/psxpad-spi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: psxpad-spi - set driver data before use\n\npsxpad_spi_suspend() retrieves the controller state with\nspi_get_drvdata(), but probe never stores it, so suspend dereferences a\nNULL pointer. Store it during probe."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:31.962Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e980066e434a9c74ff1665ed9140427e95b0ee7c"
},
{
"url": "https://git.kernel.org/stable/c/1bba6bd6861b1e0c8ecf20cd1892f0d3877c02a2"
},
{
"url": "https://git.kernel.org/stable/c/86531cdfb3a03213e2569deed5195412a4e3f7ee"
},
{
"url": "https://git.kernel.org/stable/c/da6b8b05db0cf43e0cc198431fa8ee9739b3b817"
},
{
"url": "https://git.kernel.org/stable/c/1edcb7ffee7ac4dc35cbe5bbd0e27bac3614ebe4"
},
{
"url": "https://git.kernel.org/stable/c/8d622c58205adbc8af19864e277386528b671345"
},
{
"url": "https://git.kernel.org/stable/c/62e25677d1440085381b047ec4984be9b6793759"
},
{
"url": "https://git.kernel.org/stable/c/732f38c36059e68ba3b4b89c56911d777fd3185c"
}
],
"title": "Input: psxpad-spi - set driver data before use",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80752",
"datePublished": "2026-09-03T08:26:31.962Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:31.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80751 (GCVE-0-2026-80751)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
Summary
In the Linux kernel, the following vulnerability has been resolved:
pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop,
in "if (prev_o && prev_o->freq == o->freq)", before prev_o is assigned
at the end of the loop body. On that first iteration, evaluating prev_o
reads an indeterminate value. If it is non-NULL, the condition
dereferences a stale or invalid pointer, potentially faulting or
incorrectly skipping the first OPP.
Initialize prev_o to NULL. This matches the intent as well: there is no
previous OPP to compare against on the first iteration.
Found with Clang's -Wconditional-uninitialized.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f08e7a4e8d6ac4de677727af352ea33c6ce9f444 , < de4eec0dfde8c0e27f8915bbb244d17ff68f2fb4
(git)
Affected: f08e7a4e8d6ac4de677727af352ea33c6ce9f444 , < 090a95dbe13df9965279b588d97eda134831769c (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pmdomain/mediatek/mtk-mfg-pmdomain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "de4eec0dfde8c0e27f8915bbb244d17ff68f2fb4",
"status": "affected",
"version": "f08e7a4e8d6ac4de677727af352ea33c6ce9f444",
"versionType": "git"
},
{
"lessThan": "090a95dbe13df9965279b588d97eda134831769c",
"status": "affected",
"version": "f08e7a4e8d6ac4de677727af352ea33c6ce9f444",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pmdomain/mediatek/mtk-mfg-pmdomain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()\n\nmtk_mfg_attach_dev() reads prev_o on the first iteration of its loop,\nin \"if (prev_o \u0026\u0026 prev_o-\u003efreq == o-\u003efreq)\", before prev_o is assigned\nat the end of the loop body. On that first iteration, evaluating prev_o\nreads an indeterminate value. If it is non-NULL, the condition\ndereferences a stale or invalid pointer, potentially faulting or\nincorrectly skipping the first OPP.\n\nInitialize prev_o to NULL. This matches the intent as well: there is no\nprevious OPP to compare against on the first iteration.\n\nFound with Clang\u0027s -Wconditional-uninitialized."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:31.347Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/de4eec0dfde8c0e27f8915bbb244d17ff68f2fb4"
},
{
"url": "https://git.kernel.org/stable/c/090a95dbe13df9965279b588d97eda134831769c"
}
],
"title": "pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80751",
"datePublished": "2026-09-03T08:26:31.347Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:31.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80750 (GCVE-0-2026-80750)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
pmdomain: mediatek: fix remaining %pOF after of_node_put()
Summary
In the Linux kernel, the following vulnerability has been resolved:
pmdomain: mediatek: fix remaining %pOF after of_node_put()
scpsys_get_bus_protection_legacy() looks up several legacy bus
protection regmaps from device-tree nodes.
Two error paths put the device node before checking whether the regmap
lookup failed, but still pass that node to dev_err_probe() with %pOF on
failure. If of_node_put() drops the last reference, the later %pOF
formatting can dereference a freed device node.
Keep the node reference until after the error message has been emitted in
the infracfg and SMI lookup paths. Also drop the SMI node before
returning when the SMI phandle is missing.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c29345fa5f66bea0790cf2219f57b974d4fc177b , < 970b9c83a07c405fdd32bcce7cc4c9e670e58875
(git)
Affected: c29345fa5f66bea0790cf2219f57b974d4fc177b , < 10bf2d7261d7f724ed43a09eea4c90c19c0230a0 (git) Affected: c29345fa5f66bea0790cf2219f57b974d4fc177b , < 3e013bc8b941bd52c8e3a99798d0ae8792cb71ca (git) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pmdomain/mediatek/mtk-pm-domains.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "970b9c83a07c405fdd32bcce7cc4c9e670e58875",
"status": "affected",
"version": "c29345fa5f66bea0790cf2219f57b974d4fc177b",
"versionType": "git"
},
{
"lessThan": "10bf2d7261d7f724ed43a09eea4c90c19c0230a0",
"status": "affected",
"version": "c29345fa5f66bea0790cf2219f57b974d4fc177b",
"versionType": "git"
},
{
"lessThan": "3e013bc8b941bd52c8e3a99798d0ae8792cb71ca",
"status": "affected",
"version": "c29345fa5f66bea0790cf2219f57b974d4fc177b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pmdomain/mediatek/mtk-pm-domains.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: mediatek: fix remaining %pOF after of_node_put()\n\nscpsys_get_bus_protection_legacy() looks up several legacy bus\nprotection regmaps from device-tree nodes.\n\nTwo error paths put the device node before checking whether the regmap\nlookup failed, but still pass that node to dev_err_probe() with %pOF on\nfailure. If of_node_put() drops the last reference, the later %pOF\nformatting can dereference a freed device node.\n\nKeep the node reference until after the error message has been emitted in\nthe infracfg and SMI lookup paths. Also drop the SMI node before\nreturning when the SMI phandle is missing."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:30.751Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/970b9c83a07c405fdd32bcce7cc4c9e670e58875"
},
{
"url": "https://git.kernel.org/stable/c/10bf2d7261d7f724ed43a09eea4c90c19c0230a0"
},
{
"url": "https://git.kernel.org/stable/c/3e013bc8b941bd52c8e3a99798d0ae8792cb71ca"
}
],
"title": "pmdomain: mediatek: fix remaining %pOF after of_node_put()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80750",
"datePublished": "2026-09-03T08:26:30.751Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:30.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80749 (GCVE-0-2026-80749)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
drm/connector/hdmi: Fix out of bounds memory read
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/connector/hdmi: Fix out of bounds memory read
A helper function was copying a given audio infoframe into the
connector's copy but using the size of the destination (a generic
target, sized to accept many different data blocks) not the source (a
very specific type of data block). Thus, it was copying 60 bytes of
data from a 28 byte allocation.
Fix that by using the source size instead, together with a build bug
on the source size actually being smaller than the destination.
I hit this running KUnit tests under KASAN (while debugging something
else entirely). In the real world, it seems unlikely to cause an
actual problem. It is a read not a write so it can't corrupt any
memory. However, it could potentially fall off the end of a page and
cause an accvio bug.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f378b77227bc4732922c57f92be89438bb1018a1 , < d9f7454c185c0c7f0973e11d62ad6c06862c324c
(git)
Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < e5b527804a1ea4f70e139179d3062cf5de8c06ab (git) Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < f72bb95732bc5ca87b50c52c8f087ba501950809 (git) Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < 9ecf8ba763d0ffe0673538eb4bf7806f20455d19 (git) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_hdmi_state_helper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d9f7454c185c0c7f0973e11d62ad6c06862c324c",
"status": "affected",
"version": "f378b77227bc4732922c57f92be89438bb1018a1",
"versionType": "git"
},
{
"lessThan": "e5b527804a1ea4f70e139179d3062cf5de8c06ab",
"status": "affected",
"version": "f378b77227bc4732922c57f92be89438bb1018a1",
"versionType": "git"
},
{
"lessThan": "f72bb95732bc5ca87b50c52c8f087ba501950809",
"status": "affected",
"version": "f378b77227bc4732922c57f92be89438bb1018a1",
"versionType": "git"
},
{
"lessThan": "9ecf8ba763d0ffe0673538eb4bf7806f20455d19",
"status": "affected",
"version": "f378b77227bc4732922c57f92be89438bb1018a1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_hdmi_state_helper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/connector/hdmi: Fix out of bounds memory read\n\nA helper function was copying a given audio infoframe into the\nconnector\u0027s copy but using the size of the destination (a generic\ntarget, sized to accept many different data blocks) not the source (a\nvery specific type of data block). Thus, it was copying 60 bytes of\ndata from a 28 byte allocation.\n\nFix that by using the source size instead, together with a build bug\non the source size actually being smaller than the destination.\n\nI hit this running KUnit tests under KASAN (while debugging something\nelse entirely). In the real world, it seems unlikely to cause an\nactual problem. It is a read not a write so it can\u0027t corrupt any\nmemory. However, it could potentially fall off the end of a page and\ncause an accvio bug."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:30.140Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d9f7454c185c0c7f0973e11d62ad6c06862c324c"
},
{
"url": "https://git.kernel.org/stable/c/e5b527804a1ea4f70e139179d3062cf5de8c06ab"
},
{
"url": "https://git.kernel.org/stable/c/f72bb95732bc5ca87b50c52c8f087ba501950809"
},
{
"url": "https://git.kernel.org/stable/c/9ecf8ba763d0ffe0673538eb4bf7806f20455d19"
}
],
"title": "drm/connector/hdmi: Fix out of bounds memory read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80749",
"datePublished": "2026-09-03T08:26:30.140Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:30.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80748 (GCVE-0-2026-80748)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
mmc: loongson2: Fix sg iteration in data reorder functions
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: loongson2: Fix sg iteration in data reorder functions
In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(),
the for_each_sg() macro already iterates over the scatterlist entries,
with 'sg' pointing to the current entry. However, the code incorrectly
uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, which treats
'sg' as an array base and indexes it again, leading to access of
wrong sg entries (or out-of-bounds if the list is not an array).
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2115772014bdac368317e997ed15016cf2792665 , < 8f7f7a6d5aed8f346a1c936fba02033c73a337dc
(git)
Affected: 2115772014bdac368317e997ed15016cf2792665 , < db368164383c46f256ed8152a41ae9300e615028 (git) Affected: 2115772014bdac368317e997ed15016cf2792665 , < 00179ed9fbe07799676e2cb63c4e7f0e7cd80a5c (git) |
|
| Linux | Linux |
Affected:
6.17
Unaffected: 0 , < 6.17 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/loongson2-mmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8f7f7a6d5aed8f346a1c936fba02033c73a337dc",
"status": "affected",
"version": "2115772014bdac368317e997ed15016cf2792665",
"versionType": "git"
},
{
"lessThan": "db368164383c46f256ed8152a41ae9300e615028",
"status": "affected",
"version": "2115772014bdac368317e997ed15016cf2792665",
"versionType": "git"
},
{
"lessThan": "00179ed9fbe07799676e2cb63c4e7f0e7cd80a5c",
"status": "affected",
"version": "2115772014bdac368317e997ed15016cf2792665",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/loongson2-mmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: loongson2: Fix sg iteration in data reorder functions\n\nIn ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(),\nthe for_each_sg() macro already iterates over the scatterlist entries,\nwith \u0027sg\u0027 pointing to the current entry. However, the code incorrectly\nuses \u0027\u0026sg[i]\u0027 and \u0027sg_dma_len(\u0026sg[i])\u0027 inside the loop, which treats\n\u0027sg\u0027 as an array base and indexes it again, leading to access of\nwrong sg entries (or out-of-bounds if the list is not an array)."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:29.532Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8f7f7a6d5aed8f346a1c936fba02033c73a337dc"
},
{
"url": "https://git.kernel.org/stable/c/db368164383c46f256ed8152a41ae9300e615028"
},
{
"url": "https://git.kernel.org/stable/c/00179ed9fbe07799676e2cb63c4e7f0e7cd80a5c"
}
],
"title": "mmc: loongson2: Fix sg iteration in data reorder functions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80748",
"datePublished": "2026-09-03T08:26:29.532Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:29.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80747 (GCVE-0-2026-80747)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
drm/amdkfd: Add bounds check for CRAT subtype length
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Add bounds check for CRAT subtype length
The CRAT parser validates that the subtype header fits within the image,
but does not verify that the advertised subtype length fits. A malformed
CRAT table with an oversized length field causes out-of-bounds reads when
kfd_parse_subtype() casts the header to specific subtype structures.
Add validation that sub_type_hdr + length does not exceed the image
boundary before parsing the subtype contents.
(cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ca91e0cc8087568e4b791648a7c01e804f48cb73
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6e7566ba4739dd573c331adde1c96690f7a567bd (git) Affected: 0 , < 7.1.10 (semver) |
|
| Linux | Linux |
Unaffected:
7.1.10 , ≤ 7.1.*
(semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_crat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ca91e0cc8087568e4b791648a7c01e804f48cb73",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6e7566ba4739dd573c331adde1c96690f7a567bd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7.1.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_crat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Add bounds check for CRAT subtype length\n\nThe CRAT parser validates that the subtype header fits within the image,\nbut does not verify that the advertised subtype length fits. A malformed\nCRAT table with an oversized length field causes out-of-bounds reads when\nkfd_parse_subtype() casts the header to specific subtype structures.\n\nAdd validation that sub_type_hdr + length does not exceed the image\nboundary before parsing the subtype contents.\n\n(cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:28.938Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ca91e0cc8087568e4b791648a7c01e804f48cb73"
},
{
"url": "https://git.kernel.org/stable/c/6e7566ba4739dd573c331adde1c96690f7a567bd"
}
],
"title": "drm/amdkfd: Add bounds check for CRAT subtype length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80747",
"datePublished": "2026-09-03T08:26:28.938Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:28.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80746 (GCVE-0-2026-80746)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
Eliza EVK (eliza-cqs-evk.dts) does not have display enabled, however its
Display Clock Controller is enabled and references parent clocks from
DSI PHYs, which causes clock reparenting issues during probe (init) and
warning on Eliza EVK:
disp_cc_mdss_mdp_clk_src: rcg didn't update its configuration.
WARNING: drivers/clk/qcom/clk-rcg2.c:136 at update_config+0xd4/0xe4, CPU#1: udevd/273
...
update_config (drivers/clk/qcom/clk-rcg2.c:136 (discriminator 2)) (P)
clk_rcg2_shared_disable (drivers/clk/qcom/clk-rcg2.c:1471)
clk_rcg2_shared_init (drivers/clk/qcom/clk-rcg2.c:1540)
__clk_register (drivers/clk/clk.c:3959 drivers/clk/clk.c:4368)
devm_clk_hw_register (drivers/clk/clk.c:4448 (discriminator 1) drivers/clk/clk.c:4672 (discriminator 1))
devm_clk_register_regmap (drivers/clk/qcom/clk-regmap.c:104)
qcom_cc_really_probe (drivers/clk/qcom/common.c:418)
qcom_cc_probe (drivers/clk/qcom/common.c:445)
disp_cc_eliza_probe (dispcc-eliza.c:?) dispcc_eliza
platform_probe (drivers/base/platform.c:1432)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0e66f10942b531a7521da97e4bdab0bdfcfc2e6f , < 9114f72b91618b89a390a64d6c92765e14d555ae
(git)
Affected: 0e66f10942b531a7521da97e4bdab0bdfcfc2e6f , < 2ef00630c5c0b7b2c08aba7643f47594952d357e (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/qcom/dispcc-eliza.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9114f72b91618b89a390a64d6c92765e14d555ae",
"status": "affected",
"version": "0e66f10942b531a7521da97e4bdab0bdfcfc2e6f",
"versionType": "git"
},
{
"lessThan": "2ef00630c5c0b7b2c08aba7643f47594952d357e",
"status": "affected",
"version": "0e66f10942b531a7521da97e4bdab0bdfcfc2e6f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/qcom/dispcc-eliza.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK\n\nEliza EVK (eliza-cqs-evk.dts) does not have display enabled, however its\nDisplay Clock Controller is enabled and references parent clocks from\nDSI PHYs, which causes clock reparenting issues during probe (init) and\nwarning on Eliza EVK:\n\n disp_cc_mdss_mdp_clk_src: rcg didn\u0027t update its configuration.\n WARNING: drivers/clk/qcom/clk-rcg2.c:136 at update_config+0xd4/0xe4, CPU#1: udevd/273\n ...\n update_config (drivers/clk/qcom/clk-rcg2.c:136 (discriminator 2)) (P)\n clk_rcg2_shared_disable (drivers/clk/qcom/clk-rcg2.c:1471)\n clk_rcg2_shared_init (drivers/clk/qcom/clk-rcg2.c:1540)\n __clk_register (drivers/clk/clk.c:3959 drivers/clk/clk.c:4368)\n devm_clk_hw_register (drivers/clk/clk.c:4448 (discriminator 1) drivers/clk/clk.c:4672 (discriminator 1))\n devm_clk_register_regmap (drivers/clk/qcom/clk-regmap.c:104)\n qcom_cc_really_probe (drivers/clk/qcom/common.c:418)\n qcom_cc_probe (drivers/clk/qcom/common.c:445)\n disp_cc_eliza_probe (dispcc-eliza.c:?) dispcc_eliza\n platform_probe (drivers/base/platform.c:1432)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:28.340Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9114f72b91618b89a390a64d6c92765e14d555ae"
},
{
"url": "https://git.kernel.org/stable/c/2ef00630c5c0b7b2c08aba7643f47594952d357e"
}
],
"title": "clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80746",
"datePublished": "2026-09-03T08:26:28.340Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:28.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80745 (GCVE-0-2026-80745)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
regulator: fp9931: Fix VPOS/VNEG voltage selector table
Summary
In the Linux kernel, the following vulnerability has been resolved:
regulator: fp9931: Fix VPOS/VNEG voltage selector table
The VPOSNEG_table[] mapping does not match the FP9931 datasheet.
The datasheet defines the VPOS/VNEG voltage mapping as:
00h-04h -> 7.04V (-7.04V)
05h -> 7.26V (-7.26V)
06h -> 7.49V (-7.49V)
...
28h-3Fh -> 15.06V (-15.06V)
However, VPOSNEG_table[] has two issues:
1. Selector 0x00~0x04 should all map to 7.04V (5 entries), but the
table has 6 entries of 7.04V, causing all subsequent entries to be
shifted by one position.
2. Selectors 0x29~0x3F should all clamp to 15.06V (23 entries), but
the table has only 41 entries. Any selector value above 0x28
would result in an out-of-bounds table access.
Fix both issues by removing the duplicate 7.04V entry and appending
the missing 23 clamped 15.06V entries, bringing the table to the
correct size of 64 entries (0x00~0x3F).
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
12d821bd13d42e6de3ecb1c13918b1f06a3ee213 , < 92a9594053831bf4c5886519688e155912befaee
(git)
Affected: 12d821bd13d42e6de3ecb1c13918b1f06a3ee213 , < 66694b5f90f3876fccb87bbd02b453cdc33b3ae4 (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/regulator/fp9931.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "92a9594053831bf4c5886519688e155912befaee",
"status": "affected",
"version": "12d821bd13d42e6de3ecb1c13918b1f06a3ee213",
"versionType": "git"
},
{
"lessThan": "66694b5f90f3876fccb87bbd02b453cdc33b3ae4",
"status": "affected",
"version": "12d821bd13d42e6de3ecb1c13918b1f06a3ee213",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/regulator/fp9931.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: fp9931: Fix VPOS/VNEG voltage selector table\n\nThe VPOSNEG_table[] mapping does not match the FP9931 datasheet.\n\nThe datasheet defines the VPOS/VNEG voltage mapping as:\n\n 00h-04h -\u003e 7.04V (-7.04V)\n 05h -\u003e 7.26V (-7.26V)\n 06h -\u003e 7.49V (-7.49V)\n ...\n 28h-3Fh -\u003e 15.06V (-15.06V)\n\nHowever, VPOSNEG_table[] has two issues:\n\n1. Selector 0x00~0x04 should all map to 7.04V (5 entries), but the\n table has 6 entries of 7.04V, causing all subsequent entries to be\n shifted by one position.\n\n2. Selectors 0x29~0x3F should all clamp to 15.06V (23 entries), but\n the table has only 41 entries. Any selector value above 0x28\n would result in an out-of-bounds table access.\n\nFix both issues by removing the duplicate 7.04V entry and appending\nthe missing 23 clamped 15.06V entries, bringing the table to the\ncorrect size of 64 entries (0x00~0x3F)."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:27.739Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/92a9594053831bf4c5886519688e155912befaee"
},
{
"url": "https://git.kernel.org/stable/c/66694b5f90f3876fccb87bbd02b453cdc33b3ae4"
}
],
"title": "regulator: fp9931: Fix VPOS/VNEG voltage selector table",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80745",
"datePublished": "2026-09-03T08:26:27.739Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:27.739Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80744 (GCVE-0-2026-80744)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every
error during rollback, including -ENOMEM. Memory allocation failures are
expected under low-memory conditions and do not indicate a kernel bug.
Trace for example:
nft_flow_offload_chain() // FLOW_BLOCK_BIND
nft_flow_block_chain()
nft_chain_offload_cmd()
nft_block_offload_cmd()
->ndo_setup_tc()
nsim_setup_tc()
flow_block_cb_setup_simple()
flow_block_cb_alloc() // fails to -ENOMEM
The warning was reproduced on the 5.10 stable kernel under memory pressure
via fault injection, but the underlying bug exists in mainline as well,
as demonstrated by the ENOMEM trace above. The following splat was
triggered during nf_tables transaction processing:
WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]
WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591
Modules linked in:
CPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]
RIP: 0010:nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591
Call Trace:
nf_tables_commit+0x3bd/0x4bd0 net/netfilter/nf_tables_api.c:8604
nfnetlink_rcv_batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:579 [inline]
nfnetlink_rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x6cd/0xa00 net/netfilter/af_netlink.c:1340
netlink_sendmsg+0x906/0xe10 net/netfilter/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
__sock_sendmsg+0x155/0x190 net/socket.c:663
____sys_sendmsg+0x705/0x870 net/socket.c:2379
___sys_sendmsg+0x100/0x170 net/socket.c:2433
__sys_sendmsg+0xe9/0x1c0 net/socket.c:2462
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
Change the condition to WARN_ON_ONCE(err && err != -ENOMEM) so that
warnings are only emitted for unexpected errors. This aligns with the
common kernel practice of not warning on -ENOMEM.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
63b48c73ff567bbab1f940d6e8f3f48607077a13 , < 2319033c4bf8bdb275a9e4e1f7af9bf8a457ad79
(git)
Affected: 63b48c73ff567bbab1f940d6e8f3f48607077a13 , < 6ee3803c22b72508c5baf1e5aecb21301b714be0 (git) Affected: 63b48c73ff567bbab1f940d6e8f3f48607077a13 , < 09bda4b6df222fd1819e8f188c3a6e90caf546d3 (git) Affected: 63b48c73ff567bbab1f940d6e8f3f48607077a13 , < 17c132e18ca5d1641ddbaed8d0e6ecfd1d38fa0b (git) Affected: 63b48c73ff567bbab1f940d6e8f3f48607077a13 , < 7ce9851be6f2b019e96e105a9de99715aec6deb4 (git) Affected: 63b48c73ff567bbab1f940d6e8f3f48607077a13 , < 4a923fe60939a194777bc605036ce2147ab00c9d (git) Affected: 63b48c73ff567bbab1f940d6e8f3f48607077a13 , < c23620a0fa5b1d80399f894c41a9f78bc29d6235 (git) Affected: 63b48c73ff567bbab1f940d6e8f3f48607077a13 , < d02f592064347e0c1e0d84f24941ad338838cc48 (git) |
|
| Linux | Linux |
Affected:
5.5
Unaffected: 0 , < 5.5 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2319033c4bf8bdb275a9e4e1f7af9bf8a457ad79",
"status": "affected",
"version": "63b48c73ff567bbab1f940d6e8f3f48607077a13",
"versionType": "git"
},
{
"lessThan": "6ee3803c22b72508c5baf1e5aecb21301b714be0",
"status": "affected",
"version": "63b48c73ff567bbab1f940d6e8f3f48607077a13",
"versionType": "git"
},
{
"lessThan": "09bda4b6df222fd1819e8f188c3a6e90caf546d3",
"status": "affected",
"version": "63b48c73ff567bbab1f940d6e8f3f48607077a13",
"versionType": "git"
},
{
"lessThan": "17c132e18ca5d1641ddbaed8d0e6ecfd1d38fa0b",
"status": "affected",
"version": "63b48c73ff567bbab1f940d6e8f3f48607077a13",
"versionType": "git"
},
{
"lessThan": "7ce9851be6f2b019e96e105a9de99715aec6deb4",
"status": "affected",
"version": "63b48c73ff567bbab1f940d6e8f3f48607077a13",
"versionType": "git"
},
{
"lessThan": "4a923fe60939a194777bc605036ce2147ab00c9d",
"status": "affected",
"version": "63b48c73ff567bbab1f940d6e8f3f48607077a13",
"versionType": "git"
},
{
"lessThan": "c23620a0fa5b1d80399f894c41a9f78bc29d6235",
"status": "affected",
"version": "63b48c73ff567bbab1f940d6e8f3f48607077a13",
"versionType": "git"
},
{
"lessThan": "d02f592064347e0c1e0d84f24941ad338838cc48",
"status": "affected",
"version": "63b48c73ff567bbab1f940d6e8f3f48607077a13",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path\n\nIn nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every\nerror during rollback, including -ENOMEM. Memory allocation failures are\nexpected under low-memory conditions and do not indicate a kernel bug.\n\nTrace for example:\nnft_flow_offload_chain() // FLOW_BLOCK_BIND\n nft_flow_block_chain()\n nft_chain_offload_cmd()\n nft_block_offload_cmd()\n -\u003endo_setup_tc()\n nsim_setup_tc()\n flow_block_cb_setup_simple()\n flow_block_cb_alloc() // fails to -ENOMEM\n\nThe warning was reproduced on the 5.10 stable kernel under memory pressure\nvia fault injection, but the underlying bug exists in mainline as well,\nas demonstrated by the ENOMEM trace above. The following splat was\ntriggered during nf_tables transaction processing:\n\nWARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]\nWARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591\nModules linked in:\nCPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]\nRIP: 0010:nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591\nCall Trace:\n nf_tables_commit+0x3bd/0x4bd0 net/netfilter/nf_tables_api.c:8604\n nfnetlink_rcv_batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:579 [inline]\n nfnetlink_rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597\n netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\n netlink_unicast+0x6cd/0xa00 net/netfilter/af_netlink.c:1340\n netlink_sendmsg+0x906/0xe10 net/netfilter/af_netlink.c:1919\n sock_sendmsg_nosec net/socket.c:651 [inline]\n __sock_sendmsg+0x155/0x190 net/socket.c:663\n ____sys_sendmsg+0x705/0x870 net/socket.c:2379\n ___sys_sendmsg+0x100/0x170 net/socket.c:2433\n __sys_sendmsg+0xe9/0x1c0 net/socket.c:2462\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nChange the condition to WARN_ON_ONCE(err \u0026\u0026 err != -ENOMEM) so that\nwarnings are only emitted for unexpected errors. This aligns with the\ncommon kernel practice of not warning on -ENOMEM.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:27.137Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2319033c4bf8bdb275a9e4e1f7af9bf8a457ad79"
},
{
"url": "https://git.kernel.org/stable/c/6ee3803c22b72508c5baf1e5aecb21301b714be0"
},
{
"url": "https://git.kernel.org/stable/c/09bda4b6df222fd1819e8f188c3a6e90caf546d3"
},
{
"url": "https://git.kernel.org/stable/c/17c132e18ca5d1641ddbaed8d0e6ecfd1d38fa0b"
},
{
"url": "https://git.kernel.org/stable/c/7ce9851be6f2b019e96e105a9de99715aec6deb4"
},
{
"url": "https://git.kernel.org/stable/c/4a923fe60939a194777bc605036ce2147ab00c9d"
},
{
"url": "https://git.kernel.org/stable/c/c23620a0fa5b1d80399f894c41a9f78bc29d6235"
},
{
"url": "https://git.kernel.org/stable/c/d02f592064347e0c1e0d84f24941ad338838cc48"
}
],
"title": "netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80744",
"datePublished": "2026-09-03T08:26:27.137Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:27.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80743 (GCVE-0-2026-80743)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
The irq handlers take a struct device pointer and call
dev_get_drvdata() to obtain the driver data. However, the driver
data is only set at the end of probe, after devm_request_irq(),
so an interrupt taken in between causes the handlers to pass a
NULL pointer to readl() and crash.
Pass the private data directly as the devm_request_irq() argument
instead of the device pointer, matching what the handlers expect.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6f6c3c36f0917be24587eeba818ab4fdfcb5465a , < 7d857aec162fb02d10ce326aecc1ac7509c31f43
(git)
Affected: 6f6c3c36f0917be24587eeba818ab4fdfcb5465a , < a85315f2eb06adc5597a7103e1910fc7d0d35ffd (git) Affected: 6f6c3c36f0917be24587eeba818ab4fdfcb5465a , < 721cfeb0b9572084435695ae535411b921d1ea68 (git) Affected: 6f6c3c36f0917be24587eeba818ab4fdfcb5465a , < b4ef887bee4d3c177adac5d1eab8b2de31b08ac3 (git) Affected: 6f6c3c36f0917be24587eeba818ab4fdfcb5465a , < 0d58a70b6dc7b65772e3ef7c43beb91882cf9ed5 (git) Affected: 6f6c3c36f0917be24587eeba818ab4fdfcb5465a , < f51a540b14eecb8667bbe450192318271b87631e (git) Affected: 6f6c3c36f0917be24587eeba818ab4fdfcb5465a , < 09e4c486348e176c083f8bee9169ae8f408cf8d1 (git) Affected: 6f6c3c36f0917be24587eeba818ab4fdfcb5465a , < f12afefb7b01f94d6d66d397f323a9914edbf70e (git) |
|
| Linux | Linux |
Affected:
5.1
Unaffected: 0 , < 5.1 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/xilinx/xlnx_formatter_pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d857aec162fb02d10ce326aecc1ac7509c31f43",
"status": "affected",
"version": "6f6c3c36f0917be24587eeba818ab4fdfcb5465a",
"versionType": "git"
},
{
"lessThan": "a85315f2eb06adc5597a7103e1910fc7d0d35ffd",
"status": "affected",
"version": "6f6c3c36f0917be24587eeba818ab4fdfcb5465a",
"versionType": "git"
},
{
"lessThan": "721cfeb0b9572084435695ae535411b921d1ea68",
"status": "affected",
"version": "6f6c3c36f0917be24587eeba818ab4fdfcb5465a",
"versionType": "git"
},
{
"lessThan": "b4ef887bee4d3c177adac5d1eab8b2de31b08ac3",
"status": "affected",
"version": "6f6c3c36f0917be24587eeba818ab4fdfcb5465a",
"versionType": "git"
},
{
"lessThan": "0d58a70b6dc7b65772e3ef7c43beb91882cf9ed5",
"status": "affected",
"version": "6f6c3c36f0917be24587eeba818ab4fdfcb5465a",
"versionType": "git"
},
{
"lessThan": "f51a540b14eecb8667bbe450192318271b87631e",
"status": "affected",
"version": "6f6c3c36f0917be24587eeba818ab4fdfcb5465a",
"versionType": "git"
},
{
"lessThan": "09e4c486348e176c083f8bee9169ae8f408cf8d1",
"status": "affected",
"version": "6f6c3c36f0917be24587eeba818ab4fdfcb5465a",
"versionType": "git"
},
{
"lessThan": "f12afefb7b01f94d6d66d397f323a9914edbf70e",
"status": "affected",
"version": "6f6c3c36f0917be24587eeba818ab4fdfcb5465a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/xilinx/xlnx_formatter_pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers\n\nThe irq handlers take a struct device pointer and call\ndev_get_drvdata() to obtain the driver data. However, the driver\ndata is only set at the end of probe, after devm_request_irq(),\nso an interrupt taken in between causes the handlers to pass a\nNULL pointer to readl() and crash.\n\nPass the private data directly as the devm_request_irq() argument\ninstead of the device pointer, matching what the handlers expect."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:26.524Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d857aec162fb02d10ce326aecc1ac7509c31f43"
},
{
"url": "https://git.kernel.org/stable/c/a85315f2eb06adc5597a7103e1910fc7d0d35ffd"
},
{
"url": "https://git.kernel.org/stable/c/721cfeb0b9572084435695ae535411b921d1ea68"
},
{
"url": "https://git.kernel.org/stable/c/b4ef887bee4d3c177adac5d1eab8b2de31b08ac3"
},
{
"url": "https://git.kernel.org/stable/c/0d58a70b6dc7b65772e3ef7c43beb91882cf9ed5"
},
{
"url": "https://git.kernel.org/stable/c/f51a540b14eecb8667bbe450192318271b87631e"
},
{
"url": "https://git.kernel.org/stable/c/09e4c486348e176c083f8bee9169ae8f408cf8d1"
},
{
"url": "https://git.kernel.org/stable/c/f12afefb7b01f94d6d66d397f323a9914edbf70e"
}
],
"title": "ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80743",
"datePublished": "2026-09-03T08:26:26.524Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:26.524Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80742 (GCVE-0-2026-80742)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
af_packet: Don't send zero-byte data in tpacket_snd().
Summary
In the Linux kernel, the following vulnerability has been resolved:
af_packet: Don't send zero-byte data in tpacket_snd().
syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():
skb_assert_len
WARNING: at include/linux/skbuff.h:2753 skb_assert_len
WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781
Call Trace:
<TASK>
dev_queue_xmit include/linux/netdevice.h:3448 [inline]
packet_xmit+0x243/0x310 net/packet/af_packet.c:276
tpacket_snd net/packet/af_packet.c:2907 [inline]
packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134
When sending 0-byte packets via TPACKET ring buffer on devices with no
hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb()
populates an skb with skb->len == 0 and returns 0. tpacket_snd() then
forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to
hit skb_assert_len(skb).
Similar checks exist in packet_snd() via commit dc633700f00f
("net/af_packet: check len when min_header_len equals to 0") and in
packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send
zero-byte data in packet_sendmsg_spkt().").
Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject
zero-length packets in tpacket_snd().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dde212f8622f5cb36223fff1ebd6e6f2a3dc61fe
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 80a702964467b998d254f16cc61c2c9a20540c9d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7521e691c7c4f2231634c95053281ac888d1f452 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1fc70b3d513bafb16b17540178870ef46e81c0bb (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3fa110f9e2ea96f567f2194c673c4bc327640111 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 98c5914d6b7bd4b4675535908e57dea31f1efd6a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f09ac5682f1bb67981fcb6ead4d3cfe439225876 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6bcd76c134c55c697148acb5c0194e9666abdf84 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dde212f8622f5cb36223fff1ebd6e6f2a3dc61fe",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "80a702964467b998d254f16cc61c2c9a20540c9d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7521e691c7c4f2231634c95053281ac888d1f452",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1fc70b3d513bafb16b17540178870ef46e81c0bb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3fa110f9e2ea96f567f2194c673c4bc327640111",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "98c5914d6b7bd4b4675535908e57dea31f1efd6a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f09ac5682f1bb67981fcb6ead4d3cfe439225876",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6bcd76c134c55c697148acb5c0194e9666abdf84",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: Don\u0027t send zero-byte data in tpacket_snd().\n\nsyzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():\n\nskb_assert_len\nWARNING: at include/linux/skbuff.h:2753 skb_assert_len\nWARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781\n\nCall Trace:\n \u003cTASK\u003e\n dev_queue_xmit include/linux/netdevice.h:3448 [inline]\n packet_xmit+0x243/0x310 net/packet/af_packet.c:276\n tpacket_snd net/packet/af_packet.c:2907 [inline]\n packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134\n\nWhen sending 0-byte packets via TPACKET ring buffer on devices with no\nhard header (e.g. dev-\u003ehard_header_len == 0), tpacket_fill_skb()\npopulates an skb with skb-\u003elen == 0 and returns 0. tpacket_snd() then\nforwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to\nhit skb_assert_len(skb).\n\nSimilar checks exist in packet_snd() via commit dc633700f00f\n(\"net/af_packet: check len when min_header_len equals to 0\") and in\npacket_sendmsg_spkt() via commit 6a341729fb31 (\"af_packet: Don\u0027t send\nzero-byte data in packet_sendmsg_spkt().\").\n\nReturn -EINVAL in tpacket_fill_skb() when skb-\u003elen is zero to reject\nzero-length packets in tpacket_snd()."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:25.920Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dde212f8622f5cb36223fff1ebd6e6f2a3dc61fe"
},
{
"url": "https://git.kernel.org/stable/c/80a702964467b998d254f16cc61c2c9a20540c9d"
},
{
"url": "https://git.kernel.org/stable/c/7521e691c7c4f2231634c95053281ac888d1f452"
},
{
"url": "https://git.kernel.org/stable/c/1fc70b3d513bafb16b17540178870ef46e81c0bb"
},
{
"url": "https://git.kernel.org/stable/c/3fa110f9e2ea96f567f2194c673c4bc327640111"
},
{
"url": "https://git.kernel.org/stable/c/98c5914d6b7bd4b4675535908e57dea31f1efd6a"
},
{
"url": "https://git.kernel.org/stable/c/f09ac5682f1bb67981fcb6ead4d3cfe439225876"
},
{
"url": "https://git.kernel.org/stable/c/6bcd76c134c55c697148acb5c0194e9666abdf84"
}
],
"title": "af_packet: Don\u0027t send zero-byte data in tpacket_snd().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80742",
"datePublished": "2026-09-03T08:26:25.920Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:25.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80741 (GCVE-0-2026-80741)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
drm/log: Fix out-of-bounds read on empty message length
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fix out-of-bounds read on empty message length
drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing
newline, but len is unsigned int. If len is 0, the subtraction wraps
to UINT_MAX, causing an out-of-bounds read.
Add an early return when len is 0.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
25e2c2a3eff55683bbe77b108db2a7e389246666 , < 16a2716910ecf7d31bf3c033ee7c506a0b00b2ee
(git)
Affected: 25e2c2a3eff55683bbe77b108db2a7e389246666 , < 16bcea56f4205314ec2aa04a7ec74e5261d253c7 (git) Affected: 25e2c2a3eff55683bbe77b108db2a7e389246666 , < 60baa179ed1333535f6e2da4133511db55278ee4 (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/clients/drm_log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "16a2716910ecf7d31bf3c033ee7c506a0b00b2ee",
"status": "affected",
"version": "25e2c2a3eff55683bbe77b108db2a7e389246666",
"versionType": "git"
},
{
"lessThan": "16bcea56f4205314ec2aa04a7ec74e5261d253c7",
"status": "affected",
"version": "25e2c2a3eff55683bbe77b108db2a7e389246666",
"versionType": "git"
},
{
"lessThan": "60baa179ed1333535f6e2da4133511db55278ee4",
"status": "affected",
"version": "25e2c2a3eff55683bbe77b108db2a7e389246666",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/clients/drm_log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/log: Fix out-of-bounds read on empty message length\n\ndrm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing\nnewline, but len is unsigned int. If len is 0, the subtraction wraps\nto UINT_MAX, causing an out-of-bounds read.\n\nAdd an early return when len is 0."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:25.322Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/16a2716910ecf7d31bf3c033ee7c506a0b00b2ee"
},
{
"url": "https://git.kernel.org/stable/c/16bcea56f4205314ec2aa04a7ec74e5261d253c7"
},
{
"url": "https://git.kernel.org/stable/c/60baa179ed1333535f6e2da4133511db55278ee4"
}
],
"title": "drm/log: Fix out-of-bounds read on empty message length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80741",
"datePublished": "2026-09-03T08:26:25.322Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:25.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80740 (GCVE-0-2026-80740)
Vulnerability from nvd – Published: 2026-09-03 08:26 – Updated: 2026-09-03 08:26
VLAI
EPSS
VEX
Title
drm/log: Fix infinite loop when scale is too large for display
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fix infinite loop when scale is too large for display
When scale is large enough that scaled_font exceeds the display
dimensions, rows or columns become 0. A columns value of 0 causes
an infinite loop in drm_log_draw_kmsg_record() because the loop
never decrements len.
Check for zero rows/columns in drm_log_setup_modeset() and return
an error, cleaning up the already allocated buffer to avoid a leak.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8a4b913df427b8f900bcc7849cc15a7b81628d57 , < a7d172b27aa3e1ad56e39949bfe4e5caa25fb20b
(git)
Affected: 8a4b913df427b8f900bcc7849cc15a7b81628d57 , < 50ca4dbbaf3eb6deb74daca360b4dabc739a6fa6 (git) Affected: 8a4b913df427b8f900bcc7849cc15a7b81628d57 , < f4f2bba28df9b9aaa00262a462139dbbcdc38d9f (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/clients/drm_log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7d172b27aa3e1ad56e39949bfe4e5caa25fb20b",
"status": "affected",
"version": "8a4b913df427b8f900bcc7849cc15a7b81628d57",
"versionType": "git"
},
{
"lessThan": "50ca4dbbaf3eb6deb74daca360b4dabc739a6fa6",
"status": "affected",
"version": "8a4b913df427b8f900bcc7849cc15a7b81628d57",
"versionType": "git"
},
{
"lessThan": "f4f2bba28df9b9aaa00262a462139dbbcdc38d9f",
"status": "affected",
"version": "8a4b913df427b8f900bcc7849cc15a7b81628d57",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/clients/drm_log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/log: Fix infinite loop when scale is too large for display\n\nWhen scale is large enough that scaled_font exceeds the display\ndimensions, rows or columns become 0. A columns value of 0 causes\nan infinite loop in drm_log_draw_kmsg_record() because the loop\nnever decrements len.\n\nCheck for zero rows/columns in drm_log_setup_modeset() and return\nan error, cleaning up the already allocated buffer to avoid a leak."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:26:24.706Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7d172b27aa3e1ad56e39949bfe4e5caa25fb20b"
},
{
"url": "https://git.kernel.org/stable/c/50ca4dbbaf3eb6deb74daca360b4dabc739a6fa6"
},
{
"url": "https://git.kernel.org/stable/c/f4f2bba28df9b9aaa00262a462139dbbcdc38d9f"
}
],
"title": "drm/log: Fix infinite loop when scale is too large for display",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80740",
"datePublished": "2026-09-03T08:26:24.706Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-03T08:26:24.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80739 (GCVE-0-2026-80739)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
In case __mlx5e_add_fdb_flow() fails in lower levels, the flow is
deleted via mlx5e_tc_del_flow(), and mlx5e_tc_del_flow() is acquiring
ESW devcom lock without condition. In addition, in case of peer_flow,
__mlx5e_add_fdb_flow() is called while holding ESW devcom comp lock.
This results in an AA deadlock.
To fix this, introduce a new PEER flag that is set on flows created as
peer flows (the duplicate flows on peer devices), and check it in
mlx5e_tc_del_flow() before acquiring ESW devcom lock.
Lockdep splat:
============================================
WARNING: possible recursive locking detected
============================================
Possible unsafe locking scenario:
CPU0
----
lock(&comp->lock_key#2);
lock(&comp->lock_key#2);
*** DEADLOCK ***
Call Trace:
<TASK>
dump_stack_lvl+0x69/0xa0
print_deadlock_bug.cold+0xbd/0xca
__lock_acquire+0x1671/0x2ec0
lock_acquire+0x10e/0x2e0
down_read+0x95/0x430
mlx5_devcom_for_each_peer_begin+0x4e/0xe0 [mlx5_core]
mlx5e_tc_del_flow+0x11d/0xa70 [mlx5_core]
mlx5e_flow_put+0x99/0x100 [mlx5_core]
__mlx5e_add_fdb_flow+0x409/0xf00 [mlx5_core]
mlx5e_configure_flower+0x2a86/0x4100 [mlx5_core]
mlx5e_rep_setup_tc_cls_flower+0x12f/0x1b0 [mlx5_core]
mlx5e_rep_setup_tc_cb+0x153/0x750 [mlx5_core]
tc_setup_cb_add+0x1dc/0x470
fl_change+0x2f4d/0x626d [cls_flower]
tc_new_tfilter+0x79b/0x2310
rtnetlink_rcv_msg+0x778/0xad0
do_syscall_64+0x70/0x960
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d , < 607adbda01053abf5f93e322fe39325da8828cb8
(git)
Affected: 04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d , < 585df8643081e6f616579bc52cd49ac823a57c82 (git) Affected: 04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d , < ff9e7d5e3500be389ce7a0e46db3a77149830bc9 (git) Affected: 04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d , < 7165fe321c61ec138850c02f030f274797761f5f (git) Affected: 04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d , < 6ddfba2ea98db21b001e0e5c472499156224650c (git) |
|
| Linux | Linux |
Affected:
5.0
Unaffected: 0 , < 5.0 (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/tc_priv.h",
"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "607adbda01053abf5f93e322fe39325da8828cb8",
"status": "affected",
"version": "04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d",
"versionType": "git"
},
{
"lessThan": "585df8643081e6f616579bc52cd49ac823a57c82",
"status": "affected",
"version": "04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d",
"versionType": "git"
},
{
"lessThan": "ff9e7d5e3500be389ce7a0e46db3a77149830bc9",
"status": "affected",
"version": "04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d",
"versionType": "git"
},
{
"lessThan": "7165fe321c61ec138850c02f030f274797761f5f",
"status": "affected",
"version": "04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d",
"versionType": "git"
},
{
"lessThan": "6ddfba2ea98db21b001e0e5c472499156224650c",
"status": "affected",
"version": "04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/tc_priv.h",
"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: TC, Check if flow is PEER before acquiring devcom lock\n\nIn case __mlx5e_add_fdb_flow() fails in lower levels, the flow is\ndeleted via mlx5e_tc_del_flow(), and mlx5e_tc_del_flow() is acquiring\nESW devcom lock without condition. In addition, in case of peer_flow,\n__mlx5e_add_fdb_flow() is called while holding ESW devcom comp lock.\nThis results in an AA deadlock.\n\nTo fix this, introduce a new PEER flag that is set on flows created as\npeer flows (the duplicate flows on peer devices), and check it in\nmlx5e_tc_del_flow() before acquiring ESW devcom lock.\n\nLockdep splat:\n============================================\nWARNING: possible recursive locking detected\n============================================\n Possible unsafe locking scenario:\n CPU0\n ----\n lock(\u0026comp-\u003elock_key#2);\n lock(\u0026comp-\u003elock_key#2);\n *** DEADLOCK ***\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x69/0xa0\n print_deadlock_bug.cold+0xbd/0xca\n __lock_acquire+0x1671/0x2ec0\n lock_acquire+0x10e/0x2e0\n down_read+0x95/0x430\n mlx5_devcom_for_each_peer_begin+0x4e/0xe0 [mlx5_core]\n mlx5e_tc_del_flow+0x11d/0xa70 [mlx5_core]\n mlx5e_flow_put+0x99/0x100 [mlx5_core]\n __mlx5e_add_fdb_flow+0x409/0xf00 [mlx5_core]\n mlx5e_configure_flower+0x2a86/0x4100 [mlx5_core]\n mlx5e_rep_setup_tc_cls_flower+0x12f/0x1b0 [mlx5_core]\n mlx5e_rep_setup_tc_cb+0x153/0x750 [mlx5_core]\n tc_setup_cb_add+0x1dc/0x470\n fl_change+0x2f4d/0x626d [cls_flower]\n tc_new_tfilter+0x79b/0x2310\n rtnetlink_rcv_msg+0x778/0xad0\n do_syscall_64+0x70/0x960\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:53.739Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/607adbda01053abf5f93e322fe39325da8828cb8"
},
{
"url": "https://git.kernel.org/stable/c/585df8643081e6f616579bc52cd49ac823a57c82"
},
{
"url": "https://git.kernel.org/stable/c/ff9e7d5e3500be389ce7a0e46db3a77149830bc9"
},
{
"url": "https://git.kernel.org/stable/c/7165fe321c61ec138850c02f030f274797761f5f"
},
{
"url": "https://git.kernel.org/stable/c/6ddfba2ea98db21b001e0e5c472499156224650c"
}
],
"title": "net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80739",
"datePublished": "2026-09-03T08:21:53.739Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:53.739Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80738 (GCVE-0-2026-80738)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer
'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access
sk->sk_protocol without validating whether 'sk' represents a full socket.
Fix this issue by checking sk->sk_state != TCP_LISTEN before inspecting
sk->sk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie.
Since mini-sockets are never in the TCP_LISTEN state, the condition
short-circuits and prevents dereferencing fullsock-specific fields.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
399040847084a69f345e0a52fd62f04654e0fce3 , < 23f682083aa3fbc0c49667818efd6979a8bc5ac2
(git)
Affected: 399040847084a69f345e0a52fd62f04654e0fce3 , < 31a420a822ff92e2090bd5d65efe8e34e2d6d9b8 (git) |
|
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "23f682083aa3fbc0c49667818efd6979a8bc5ac2",
"status": "affected",
"version": "399040847084a69f345e0a52fd62f04654e0fce3",
"versionType": "git"
},
{
"lessThan": "31a420a822ff92e2090bd5d65efe8e34e2d6d9b8",
"status": "affected",
"version": "399040847084a69f345e0a52fd62f04654e0fce3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie\n\nbpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer\n\u0027sk\u0027 with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access\nsk-\u003esk_protocol without validating whether \u0027sk\u0027 represents a full socket.\n\nFix this issue by checking sk-\u003esk_state != TCP_LISTEN before inspecting\nsk-\u003esk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie.\nSince mini-sockets are never in the TCP_LISTEN state, the condition\nshort-circuits and prevents dereferencing fullsock-specific fields."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:53.143Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/23f682083aa3fbc0c49667818efd6979a8bc5ac2"
},
{
"url": "https://git.kernel.org/stable/c/31a420a822ff92e2090bd5d65efe8e34e2d6d9b8"
}
],
"title": "bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80738",
"datePublished": "2026-09-03T08:21:53.143Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:53.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80737 (GCVE-0-2026-80737)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
serial: amba-pl011: synchronize DMA teardown
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: amba-pl011: synchronize DMA teardown
dmaengine_terminate_all() does not wait for a running callback, so the TX
callback can still touch the TX buffer after it is freed. The RX poll
timer reads the RX buffers without the port lock.
Switch to dmaengine_terminate_sync() and delete the RX timer before
freeing the buffers.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ead76f329f777c7301e0a5456a0a1c7a081570bd , < a38fae9d212e2d3ed5e9ec0ef773f8c0a27fb76e
(git)
Affected: ead76f329f777c7301e0a5456a0a1c7a081570bd , < 44bd0ecc3444882d08ecfbc2b2418d2f463d3186 (git) Affected: ead76f329f777c7301e0a5456a0a1c7a081570bd , < f70c9d4fba46463a5b1c7b3ee9ee3b40c90dac03 (git) Affected: ead76f329f777c7301e0a5456a0a1c7a081570bd , < c8c8e895f65fbf71ea6224e27cf8dab91b776e0d (git) Affected: ead76f329f777c7301e0a5456a0a1c7a081570bd , < 9f6989e477f03a4721d34bb4b09b17accd40283e (git) Affected: ead76f329f777c7301e0a5456a0a1c7a081570bd , < 5974cb66681eac367107b05924744d7e3b49d41c (git) Affected: ead76f329f777c7301e0a5456a0a1c7a081570bd , < fdfb46c387241b4eddd36d746793764413285913 (git) Affected: ead76f329f777c7301e0a5456a0a1c7a081570bd , < 440915499231e9db1c361aa45bb702e8fd3b4a32 (git) |
|
| Linux | Linux |
Affected:
2.6.39
Unaffected: 0 , < 2.6.39 (semver) Unaffected: 5.10.267 , ≤ 5.10.* (semver) Unaffected: 5.15.218 , ≤ 5.15.* (semver) Unaffected: 6.1.185 , ≤ 6.1.* (semver) Unaffected: 6.6.154 , ≤ 6.6.* (semver) Unaffected: 6.12.106 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/amba-pl011.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a38fae9d212e2d3ed5e9ec0ef773f8c0a27fb76e",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "44bd0ecc3444882d08ecfbc2b2418d2f463d3186",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "f70c9d4fba46463a5b1c7b3ee9ee3b40c90dac03",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "c8c8e895f65fbf71ea6224e27cf8dab91b776e0d",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "9f6989e477f03a4721d34bb4b09b17accd40283e",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "5974cb66681eac367107b05924744d7e3b49d41c",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "fdfb46c387241b4eddd36d746793764413285913",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "440915499231e9db1c361aa45bb702e8fd3b4a32",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/amba-pl011.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: amba-pl011: synchronize DMA teardown\n\ndmaengine_terminate_all() does not wait for a running callback, so the TX\ncallback can still touch the TX buffer after it is freed. The RX poll\ntimer reads the RX buffers without the port lock.\n\nSwitch to dmaengine_terminate_sync() and delete the RX timer before\nfreeing the buffers."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:52.539Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a38fae9d212e2d3ed5e9ec0ef773f8c0a27fb76e"
},
{
"url": "https://git.kernel.org/stable/c/44bd0ecc3444882d08ecfbc2b2418d2f463d3186"
},
{
"url": "https://git.kernel.org/stable/c/f70c9d4fba46463a5b1c7b3ee9ee3b40c90dac03"
},
{
"url": "https://git.kernel.org/stable/c/c8c8e895f65fbf71ea6224e27cf8dab91b776e0d"
},
{
"url": "https://git.kernel.org/stable/c/9f6989e477f03a4721d34bb4b09b17accd40283e"
},
{
"url": "https://git.kernel.org/stable/c/5974cb66681eac367107b05924744d7e3b49d41c"
},
{
"url": "https://git.kernel.org/stable/c/fdfb46c387241b4eddd36d746793764413285913"
},
{
"url": "https://git.kernel.org/stable/c/440915499231e9db1c361aa45bb702e8fd3b4a32"
}
],
"title": "serial: amba-pl011: synchronize DMA teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80737",
"datePublished": "2026-09-03T08:21:52.539Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:52.539Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80736 (GCVE-0-2026-80736)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
thunderbolt: Fix bandwidth group reservation indexing
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Fix bandwidth group reservation indexing
Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group
ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly
to index its local group_reserved[] array.
The array currently has MAX_GROUPS entries, so its valid indices are 0
through MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one
element past the end, and the final group's reserved bandwidth is not
included when the array is summed.
Give group_reserved[] MAX_GROUPS + 1 entries so direct Group ID
indexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 , < 0bfb67ba366cd68d1d0ad935760577bae1d5df27
(git)
Affected: 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 , < 9977321835c7ae71d12a43bed7baa5bd514d01c3 (git) Affected: 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 , < 0a8c9ed4f166216642a8c084f0de415169c88088 (git) Affected: 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 , < d2ee4d47aacbd2ba456092eeec670dba35fde291 (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/tb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0bfb67ba366cd68d1d0ad935760577bae1d5df27",
"status": "affected",
"version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
"versionType": "git"
},
{
"lessThan": "9977321835c7ae71d12a43bed7baa5bd514d01c3",
"status": "affected",
"version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
"versionType": "git"
},
{
"lessThan": "0a8c9ed4f166216642a8c084f0de415169c88088",
"status": "affected",
"version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
"versionType": "git"
},
{
"lessThan": "d2ee4d47aacbd2ba456092eeec670dba35fde291",
"status": "affected",
"version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/tb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix bandwidth group reservation indexing\n\nValid bandwidth group IDs range from 1 through MAX_GROUPS, while Group\nID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly\nto index its local group_reserved[] array.\n\nThe array currently has MAX_GROUPS entries, so its valid indices are 0\nthrough MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one\nelement past the end, and the final group\u0027s reserved bandwidth is not\nincluded when the array is summed.\n\nGive group_reserved[] MAX_GROUPS + 1 entries so direct Group ID\nindexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:51.946Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0bfb67ba366cd68d1d0ad935760577bae1d5df27"
},
{
"url": "https://git.kernel.org/stable/c/9977321835c7ae71d12a43bed7baa5bd514d01c3"
},
{
"url": "https://git.kernel.org/stable/c/0a8c9ed4f166216642a8c084f0de415169c88088"
},
{
"url": "https://git.kernel.org/stable/c/d2ee4d47aacbd2ba456092eeec670dba35fde291"
}
],
"title": "thunderbolt: Fix bandwidth group reservation indexing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80736",
"datePublished": "2026-09-03T08:21:51.946Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:51.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80735 (GCVE-0-2026-80735)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
ovpn: ensure socket is owned by ovpn before deref sk_user_data
Summary
In the Linux kernel, the following vulnerability has been resolved:
ovpn: ensure socket is owned by ovpn before deref sk_user_data
Some subsystems, like BPF SOCKMAP, set sk_user_data without
actually setting the encap_type.
For this reason, we must make sure that the type is the
one ovpn expects before dereferencing sk_user_data.
Failing to do so may lead to out-of-bounds reads.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f6226ae7a0cd47aaa9175aca6a1e19600f884cbf , < 61fb3cca40ff938671474f4a16adb908c19032d7
(git)
Affected: f6226ae7a0cd47aaa9175aca6a1e19600f884cbf , < 43a31142e1d22b3cf5490bd94a94db7196901734 (git) Affected: f6226ae7a0cd47aaa9175aca6a1e19600f884cbf , < 59aed1eb60d70678a53acccb0cb337a26ce6680e (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ovpn/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "61fb3cca40ff938671474f4a16adb908c19032d7",
"status": "affected",
"version": "f6226ae7a0cd47aaa9175aca6a1e19600f884cbf",
"versionType": "git"
},
{
"lessThan": "43a31142e1d22b3cf5490bd94a94db7196901734",
"status": "affected",
"version": "f6226ae7a0cd47aaa9175aca6a1e19600f884cbf",
"versionType": "git"
},
{
"lessThan": "59aed1eb60d70678a53acccb0cb337a26ce6680e",
"status": "affected",
"version": "f6226ae7a0cd47aaa9175aca6a1e19600f884cbf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ovpn/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: ensure socket is owned by ovpn before deref sk_user_data\n\nSome subsystems, like BPF SOCKMAP, set sk_user_data without\nactually setting the encap_type.\n\nFor this reason, we must make sure that the type is the\none ovpn expects before dereferencing sk_user_data.\n\nFailing to do so may lead to out-of-bounds reads."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:51.344Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/61fb3cca40ff938671474f4a16adb908c19032d7"
},
{
"url": "https://git.kernel.org/stable/c/43a31142e1d22b3cf5490bd94a94db7196901734"
},
{
"url": "https://git.kernel.org/stable/c/59aed1eb60d70678a53acccb0cb337a26ce6680e"
}
],
"title": "ovpn: ensure socket is owned by ovpn before deref sk_user_data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80735",
"datePublished": "2026-09-03T08:21:51.344Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:51.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80734 (GCVE-0-2026-80734)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
btrfs: initialize inode mapping flags for cached inodes
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: initialize inode mapping flags for cached inodes
[BUG]
When running generic/795 with 8K block size, 4K page size, the test
always fails, triggering some ASSERT()s related to folio size:
795 (241074): drop_caches: 3
assertion failed: IS_ALIGNED(start, blocksize) && IS_ALIGNED(end + 1, blocksize), in extent_io.c:1404 (blocksize=8192 root=262 ino=258 start=16826368 end=16830463 mapping min order=0)
------------[ cut here ]------------
kernel BUG at extent_io.c:1404!
Oops: invalid opcode: 0000 [#1] SMP
CPU: 8 UID: 0 PID: 241105 Comm: fsstress Tainted: G OE 7.2.0-rc5-custom+ #442 PREEMPT(full) f4bfb352566f3949f29c233ce6f735050a03b245
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
RIP: 0010:assert_folio_range.cold+0x3d/0x3f [btrfs]
Call Trace:
<TASK>
btrfs_read_folio+0x9e/0x170 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]
prepare_one_folio.constprop.0+0x104/0x2a0 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]
btrfs_buffered_write+0x285/0xa50 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]
btrfs_do_write_iter+0x1aa/0x210 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]
iter_file_splice_write+0x31a/0x540
direct_splice_actor+0x53/0x170
splice_direct_to_actor+0xe9/0x240
do_splice_direct+0x76/0xb0
vfs_copy_file_range+0x1fd/0x630
__x64_sys_copy_file_range+0xf9/0x220
do_syscall_64+0xe1/0x790
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
---[ end trace 0000000000000000 ]---
The ASSERT() itself is added by a later patch.
The crash is triggered with that new debug patch, and without this fix.
[CAUSE]
In the above case, the start 16826368 is properly 8K aligned, but the
end (16830463 + 1) is not 8K aligned.
Furthermore the mapping's minimal folio order is 0, not the expected 1
for 8K block size with 4K page size.
So this means some inodes do not have btrfs_set_inode_mapping_order()
called on it.
The missing btrfs_set_inode_mapping_order() call happens for cached
inodes, through the following events:
- btrfs_create_new_inode() called for inode X
Which properly sets minimal folio order for the VFS inode.
- btrfs_update_inode() called for inode X
Which calls btrfs_delayed_update_inode() to create a delayed_node
into root->delayed_nodes xarray.
- Drop cache/memory pressure, evicting in-memory inode X
Which evicted the inode X, but delayed_node is still in
root->delayed_nodes for future reuse.
- btrfs_iget() for inode X called again
btrfs_iget()
|- btrfs_iget_locked()
| |- iget5_locked_rcu()
| Which creates a new vfs_inode for btrfs, whose mapping still
| has the minimal order as 0.
|
|- btrfs_read_locked_inode()
|- btrfs_fill_inode()
| |- btrfs_get_delayed_node()
| Which found out the previous node, and use that delayed
| node to initialize the new inode.
|
|- filled = true;
|- if (filled) goto cache_index;
Which skips the btrfs_update_inode_mapping_flags() and
btrfs_set_inode_mapping_order() calls.
So the inode still has minimal folio order set as 0, not
the required 1.
Thus later page cache read will get a folio whose size is smaller than
block size, as the mapping has its minimal folio order set as 0 not 1,
then trigger the ASSERT().
[FIX]
Move the btrfs_update_inode_mapping_flags() and
btrfs_set_inode_mapping_order() calls under cache_index label,
so that the mapping flags and minimal folio order is always set
no matter if we have a cached inode.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ecde48a1a6b3256bd49db8780bf37556b157783c , < 0d26249671171ab759cb4fdce673554a690fa655
(git)
Affected: ecde48a1a6b3256bd49db8780bf37556b157783c , < 0ef349734a93227b45f65fc50a3311d1cc5f03e9 (git) Affected: ae584726e6eddf6cfbe49b3f4a78b3197716b6f8 (git) Affected: 6.14.6 , < 6.15 (semver) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0d26249671171ab759cb4fdce673554a690fa655",
"status": "affected",
"version": "ecde48a1a6b3256bd49db8780bf37556b157783c",
"versionType": "git"
},
{
"lessThan": "0ef349734a93227b45f65fc50a3311d1cc5f03e9",
"status": "affected",
"version": "ecde48a1a6b3256bd49db8780bf37556b157783c",
"versionType": "git"
},
{
"status": "affected",
"version": "ae584726e6eddf6cfbe49b3f4a78b3197716b6f8",
"versionType": "git"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: initialize inode mapping flags for cached inodes\n\n[BUG]\nWhen running generic/795 with 8K block size, 4K page size, the test\nalways fails, triggering some ASSERT()s related to folio size:\n\n 795 (241074): drop_caches: 3\n assertion failed: IS_ALIGNED(start, blocksize) \u0026\u0026 IS_ALIGNED(end + 1, blocksize), in extent_io.c:1404 (blocksize=8192 root=262 ino=258 start=16826368 end=16830463 mapping min order=0)\n ------------[ cut here ]------------\n kernel BUG at extent_io.c:1404!\n Oops: invalid opcode: 0000 [#1] SMP\n CPU: 8 UID: 0 PID: 241105 Comm: fsstress Tainted: G OE 7.2.0-rc5-custom+ #442 PREEMPT(full) f4bfb352566f3949f29c233ce6f735050a03b245\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n RIP: 0010:assert_folio_range.cold+0x3d/0x3f [btrfs]\n Call Trace:\n \u003cTASK\u003e\n btrfs_read_folio+0x9e/0x170 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n prepare_one_folio.constprop.0+0x104/0x2a0 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n btrfs_buffered_write+0x285/0xa50 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n btrfs_do_write_iter+0x1aa/0x210 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n iter_file_splice_write+0x31a/0x540\n direct_splice_actor+0x53/0x170\n splice_direct_to_actor+0xe9/0x240\n do_splice_direct+0x76/0xb0\n vfs_copy_file_range+0x1fd/0x630\n __x64_sys_copy_file_range+0xf9/0x220\n do_syscall_64+0xe1/0x790\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\nThe ASSERT() itself is added by a later patch.\nThe crash is triggered with that new debug patch, and without this fix.\n\n[CAUSE]\nIn the above case, the start 16826368 is properly 8K aligned, but the\nend (16830463 + 1) is not 8K aligned.\nFurthermore the mapping\u0027s minimal folio order is 0, not the expected 1\nfor 8K block size with 4K page size.\n\nSo this means some inodes do not have btrfs_set_inode_mapping_order()\ncalled on it.\n\nThe missing btrfs_set_inode_mapping_order() call happens for cached\ninodes, through the following events:\n\n- btrfs_create_new_inode() called for inode X\n Which properly sets minimal folio order for the VFS inode.\n\n- btrfs_update_inode() called for inode X\n Which calls btrfs_delayed_update_inode() to create a delayed_node\n into root-\u003edelayed_nodes xarray.\n\n- Drop cache/memory pressure, evicting in-memory inode X\n Which evicted the inode X, but delayed_node is still in\n root-\u003edelayed_nodes for future reuse.\n\n- btrfs_iget() for inode X called again\n\n btrfs_iget()\n |- btrfs_iget_locked()\n | |- iget5_locked_rcu()\n | Which creates a new vfs_inode for btrfs, whose mapping still\n | has the minimal order as 0.\n |\n |- btrfs_read_locked_inode()\n |- btrfs_fill_inode()\n | |- btrfs_get_delayed_node()\n | Which found out the previous node, and use that delayed\n | node to initialize the new inode.\n |\n |- filled = true;\n |- if (filled) goto cache_index;\n Which skips the btrfs_update_inode_mapping_flags() and\n\tbtrfs_set_inode_mapping_order() calls.\n\tSo the inode still has minimal folio order set as 0, not\n\tthe required 1.\n\nThus later page cache read will get a folio whose size is smaller than\nblock size, as the mapping has its minimal folio order set as 0 not 1,\nthen trigger the ASSERT().\n\n[FIX]\nMove the btrfs_update_inode_mapping_flags() and\nbtrfs_set_inode_mapping_order() calls under cache_index label,\nso that the mapping flags and minimal folio order is always set\nno matter if we have a cached inode."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:50.734Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d26249671171ab759cb4fdce673554a690fa655"
},
{
"url": "https://git.kernel.org/stable/c/0ef349734a93227b45f65fc50a3311d1cc5f03e9"
}
],
"title": "btrfs: initialize inode mapping flags for cached inodes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80734",
"datePublished": "2026-09-03T08:21:50.734Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:50.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80733 (GCVE-0-2026-80733)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
net: remove WARN_ON_ONCE() from sk_mc_loop()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: remove WARN_ON_ONCE() from sk_mc_loop()
sk_mc_loop() can be called for sockets that are neither AF_INET
nor AF_INET6 (e.g. AF_PACKET sockets when sending packets via raw/packet
socket over virtual devices such as VRF or ipvlan).
In such cases, sk_family is not AF_INET/AF_INET6 and sk_mc_loop() falls
through the switch statement and triggers WARN_ON_ONCE(1).
Non-INET sockets do not support IP_MULTICAST_LOOP or IPV6_MULTICAST_LOOP
options, so loopback should default to true without generating a warning.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90 , < 97133c4d42654578fab95abe47359ebe784dde18
(git)
Affected: f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90 , < f625c742b33dc137c209dd13d1c5f12b1c18d71c (git) Affected: f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90 , < ad7fa2f411cb30f63d6725f111be134064cdb718 (git) Affected: f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90 , < d2adc4e80b29e58b5162ae09f0f657a215806c8c (git) Affected: f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90 , < ad7dbb1d14b1b4406eca8ef9478e8de312ba0cfe (git) Affected: f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90 , < c8f256dc849205ccb2bd78bd99a3497b972b44e0 (git) Affected: f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90 , < 0d75f2c1d0764efa756ad9c1e078d8c09ea8fc1f (git) Affected: f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90 , < b8a39a09ae4eaae04309e1e38ed6a1101d967496 (git) Affected: c91f81773cd4bbebfe744e9ab30a7ce093f9b930 (git) Affected: c8c30b2b17f2133e953850c547e3902c3a3d80e2 (git) Affected: 3fe207e4637a2e792c46a08666aa722f77d7f8f7 (git) Affected: 3.14.40 , < 3.15 (semver) Affected: 3.18.13 , < 3.19 (semver) Affected: 3.19.6 , < 3.20 (semver) |
|
| Linux | Linux |
Affected:
4.0
Unaffected: 0 , < 4.0 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "97133c4d42654578fab95abe47359ebe784dde18",
"status": "affected",
"version": "f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90",
"versionType": "git"
},
{
"lessThan": "f625c742b33dc137c209dd13d1c5f12b1c18d71c",
"status": "affected",
"version": "f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90",
"versionType": "git"
},
{
"lessThan": "ad7fa2f411cb30f63d6725f111be134064cdb718",
"status": "affected",
"version": "f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90",
"versionType": "git"
},
{
"lessThan": "d2adc4e80b29e58b5162ae09f0f657a215806c8c",
"status": "affected",
"version": "f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90",
"versionType": "git"
},
{
"lessThan": "ad7dbb1d14b1b4406eca8ef9478e8de312ba0cfe",
"status": "affected",
"version": "f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90",
"versionType": "git"
},
{
"lessThan": "c8f256dc849205ccb2bd78bd99a3497b972b44e0",
"status": "affected",
"version": "f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90",
"versionType": "git"
},
{
"lessThan": "0d75f2c1d0764efa756ad9c1e078d8c09ea8fc1f",
"status": "affected",
"version": "f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90",
"versionType": "git"
},
{
"lessThan": "b8a39a09ae4eaae04309e1e38ed6a1101d967496",
"status": "affected",
"version": "f60e5990d9c1424af9dbca60a23ba2a1c7c1ce90",
"versionType": "git"
},
{
"status": "affected",
"version": "c91f81773cd4bbebfe744e9ab30a7ce093f9b930",
"versionType": "git"
},
{
"status": "affected",
"version": "c8c30b2b17f2133e953850c547e3902c3a3d80e2",
"versionType": "git"
},
{
"status": "affected",
"version": "3fe207e4637a2e792c46a08666aa722f77d7f8f7",
"versionType": "git"
},
{
"lessThan": "3.15",
"status": "affected",
"version": "3.14.40",
"versionType": "semver"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.13",
"versionType": "semver"
},
{
"lessThan": "3.20",
"status": "affected",
"version": "3.19.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.14.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.19.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: remove WARN_ON_ONCE() from sk_mc_loop()\n\nsk_mc_loop() can be called for sockets that are neither AF_INET\nnor AF_INET6 (e.g. AF_PACKET sockets when sending packets via raw/packet\nsocket over virtual devices such as VRF or ipvlan).\n\nIn such cases, sk_family is not AF_INET/AF_INET6 and sk_mc_loop() falls\nthrough the switch statement and triggers WARN_ON_ONCE(1).\n\nNon-INET sockets do not support IP_MULTICAST_LOOP or IPV6_MULTICAST_LOOP\noptions, so loopback should default to true without generating a warning."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:50.136Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/97133c4d42654578fab95abe47359ebe784dde18"
},
{
"url": "https://git.kernel.org/stable/c/f625c742b33dc137c209dd13d1c5f12b1c18d71c"
},
{
"url": "https://git.kernel.org/stable/c/ad7fa2f411cb30f63d6725f111be134064cdb718"
},
{
"url": "https://git.kernel.org/stable/c/d2adc4e80b29e58b5162ae09f0f657a215806c8c"
},
{
"url": "https://git.kernel.org/stable/c/ad7dbb1d14b1b4406eca8ef9478e8de312ba0cfe"
},
{
"url": "https://git.kernel.org/stable/c/c8f256dc849205ccb2bd78bd99a3497b972b44e0"
},
{
"url": "https://git.kernel.org/stable/c/0d75f2c1d0764efa756ad9c1e078d8c09ea8fc1f"
},
{
"url": "https://git.kernel.org/stable/c/b8a39a09ae4eaae04309e1e38ed6a1101d967496"
}
],
"title": "net: remove WARN_ON_ONCE() from sk_mc_loop()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80733",
"datePublished": "2026-09-03T08:21:50.136Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:50.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80732 (GCVE-0-2026-80732)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
ata: pata_sl82c105: fix bridge revision use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved:
ata: pata_sl82c105: fix bridge revision use-after-free
pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b
("PCI: Change all drivers to use pci_device->revision") replaced a
configuration-space read with direct access to the cached revision field,
but left that access after pci_dev_put(). The bridge may therefore be freed
before its revision is read.
Read the revision before dropping the reference.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
44c10138fd4bbc4b6d6bff0873c24902f2a9da65 , < 1268ca9418e2217f2b60705cf4a280b689b26678
(git)
Affected: 44c10138fd4bbc4b6d6bff0873c24902f2a9da65 , < a626dfca96041842053cf2d1efceb436c4cd8dcf (git) Affected: 44c10138fd4bbc4b6d6bff0873c24902f2a9da65 , < 5ef87b1b4656d675440ceab32a56e69ad958d3a1 (git) Affected: 44c10138fd4bbc4b6d6bff0873c24902f2a9da65 , < fa0dca89b4fb0909ffda7b9ab6051af33270f95e (git) Affected: 44c10138fd4bbc4b6d6bff0873c24902f2a9da65 , < dc711fb137b33c12e6ca22b6a9c9b9f21d49e4de (git) Affected: 44c10138fd4bbc4b6d6bff0873c24902f2a9da65 , < a837deeaa37cc3f0e8c4e5c096787047f272c956 (git) Affected: 44c10138fd4bbc4b6d6bff0873c24902f2a9da65 , < 56fd78c8c820f527f8003e379ab71004b2e79a44 (git) Affected: 44c10138fd4bbc4b6d6bff0873c24902f2a9da65 , < 7700a31039cdc6715cb6cce7e7a664ee4e945f67 (git) |
|
| Linux | Linux |
Affected:
2.6.23
Unaffected: 0 , < 2.6.23 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ata/pata_sl82c105.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1268ca9418e2217f2b60705cf4a280b689b26678",
"status": "affected",
"version": "44c10138fd4bbc4b6d6bff0873c24902f2a9da65",
"versionType": "git"
},
{
"lessThan": "a626dfca96041842053cf2d1efceb436c4cd8dcf",
"status": "affected",
"version": "44c10138fd4bbc4b6d6bff0873c24902f2a9da65",
"versionType": "git"
},
{
"lessThan": "5ef87b1b4656d675440ceab32a56e69ad958d3a1",
"status": "affected",
"version": "44c10138fd4bbc4b6d6bff0873c24902f2a9da65",
"versionType": "git"
},
{
"lessThan": "fa0dca89b4fb0909ffda7b9ab6051af33270f95e",
"status": "affected",
"version": "44c10138fd4bbc4b6d6bff0873c24902f2a9da65",
"versionType": "git"
},
{
"lessThan": "dc711fb137b33c12e6ca22b6a9c9b9f21d49e4de",
"status": "affected",
"version": "44c10138fd4bbc4b6d6bff0873c24902f2a9da65",
"versionType": "git"
},
{
"lessThan": "a837deeaa37cc3f0e8c4e5c096787047f272c956",
"status": "affected",
"version": "44c10138fd4bbc4b6d6bff0873c24902f2a9da65",
"versionType": "git"
},
{
"lessThan": "56fd78c8c820f527f8003e379ab71004b2e79a44",
"status": "affected",
"version": "44c10138fd4bbc4b6d6bff0873c24902f2a9da65",
"versionType": "git"
},
{
"lessThan": "7700a31039cdc6715cb6cce7e7a664ee4e945f67",
"status": "affected",
"version": "44c10138fd4bbc4b6d6bff0873c24902f2a9da65",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ata/pata_sl82c105.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: pata_sl82c105: fix bridge revision use-after-free\n\npci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b\n(\"PCI: Change all drivers to use pci_device-\u003erevision\") replaced a\nconfiguration-space read with direct access to the cached revision field,\nbut left that access after pci_dev_put(). The bridge may therefore be freed\nbefore its revision is read.\n\nRead the revision before dropping the reference."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:49.526Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1268ca9418e2217f2b60705cf4a280b689b26678"
},
{
"url": "https://git.kernel.org/stable/c/a626dfca96041842053cf2d1efceb436c4cd8dcf"
},
{
"url": "https://git.kernel.org/stable/c/5ef87b1b4656d675440ceab32a56e69ad958d3a1"
},
{
"url": "https://git.kernel.org/stable/c/fa0dca89b4fb0909ffda7b9ab6051af33270f95e"
},
{
"url": "https://git.kernel.org/stable/c/dc711fb137b33c12e6ca22b6a9c9b9f21d49e4de"
},
{
"url": "https://git.kernel.org/stable/c/a837deeaa37cc3f0e8c4e5c096787047f272c956"
},
{
"url": "https://git.kernel.org/stable/c/56fd78c8c820f527f8003e379ab71004b2e79a44"
},
{
"url": "https://git.kernel.org/stable/c/7700a31039cdc6715cb6cce7e7a664ee4e945f67"
}
],
"title": "ata: pata_sl82c105: fix bridge revision use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80732",
"datePublished": "2026-09-03T08:21:49.526Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:49.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80731 (GCVE-0-2026-80731)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
dev_validate_header() reads dev->hard_header_len directly when
zero-padding short link layer headers for CAP_SYS_RAWIO holders:
if (capable(CAP_SYS_RAWIO)) {
memset(ll_header + len, 0, dev->hard_header_len - len);
return true;
}
Packet send paths call dev_validate_header() on skbs whose headroom was
allocated from an earlier hard_header_len read. If the device is
reconfigured so that dev->hard_header_len increases before validation,
the memset writes past the reserved buffer, an out-of-bounds write.
This out-of-bounds write is masked in some SOCK_RAW paths today because
the same concurrent increase can first make skb_push() exceed the
reserved headroom and trigger skb_under_panic(). Remove the zero-padding
branch before making those hard_header_len reads consistent, so the
snapshot fixes do not turn a loud panic into a silent overwrite.
This path is only reached for variable length L2 protocols, where
len < hard_header_len but len >= min_header_len. No remaining in-tree
variable length L2 protocol implements header_ops->validate, and the
CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no
real value beyond allowing testing of intentionally malformed input.
Drop the CAP_SYS_RAWIO branch. The remaining reads of
dev->hard_header_len in dev_validate_header() are comparisons only and
have no memory safety impact.
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b5518429e70cd783b8ca52335456172c1a0589f6 , < 53fd7f912c0877647d6a1e1877f5ea8535ee0b4a
(git)
Affected: 2793a23aacbd754dbbb5cb75093deb7e4103bace , < fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6 (git) Affected: 2793a23aacbd754dbbb5cb75093deb7e4103bace , < 8fc9816404166a90ed8d544dc52482fafffb6d9f (git) Affected: 2793a23aacbd754dbbb5cb75093deb7e4103bace , < b0f92a5731dc82556a9ae005cc35f71ab136307b (git) Affected: 2793a23aacbd754dbbb5cb75093deb7e4103bace , < 99df6b7a713f96eda206680d100b76e15f9d9b69 (git) Affected: 2793a23aacbd754dbbb5cb75093deb7e4103bace , < 74e035f07f53feca09e2352e77fccb09cad5e208 (git) Affected: 2793a23aacbd754dbbb5cb75093deb7e4103bace , < dbb30dc943a93e083f1e531bfdc6779e57de40d0 (git) Affected: 2793a23aacbd754dbbb5cb75093deb7e4103bace , < fc902f52a02298c7432b2334c0c82a2885a1a8b6 (git) Affected: 2793a23aacbd754dbbb5cb75093deb7e4103bace , < 3b9a324e646d3657a8d9806dfbfe4f3e4066e882 (git) Affected: f58a6c08ebdfa978178bbca78c2ba744a2665912 (git) Affected: 1df16498dfd0d5a129bdf2982d9a08df73e8923d (git) Affected: 8b8d278aa4de9335682bbd4a3bb619af015c859e (git) Affected: 6804052fa9d86e9a512c88b24a5debbfc1a490fc (git) Affected: 3.2.80 , < 3.2.81 (semver) Affected: 3.16.36 , < 3.17 (semver) Affected: 4.1.28 , < 4.2 (semver) Affected: 4.4.8 , < 4.5 (semver) Affected: 4.5.2 , < 4.6 (semver) |
|
| Linux | Linux |
Affected:
4.6
Unaffected: 0 , < 4.6 (semver) Unaffected: 3.2.81 , ≤ 3.2.* (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "53fd7f912c0877647d6a1e1877f5ea8535ee0b4a",
"status": "affected",
"version": "b5518429e70cd783b8ca52335456172c1a0589f6",
"versionType": "git"
},
{
"lessThan": "fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6",
"status": "affected",
"version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
"versionType": "git"
},
{
"lessThan": "8fc9816404166a90ed8d544dc52482fafffb6d9f",
"status": "affected",
"version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
"versionType": "git"
},
{
"lessThan": "b0f92a5731dc82556a9ae005cc35f71ab136307b",
"status": "affected",
"version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
"versionType": "git"
},
{
"lessThan": "99df6b7a713f96eda206680d100b76e15f9d9b69",
"status": "affected",
"version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
"versionType": "git"
},
{
"lessThan": "74e035f07f53feca09e2352e77fccb09cad5e208",
"status": "affected",
"version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
"versionType": "git"
},
{
"lessThan": "dbb30dc943a93e083f1e531bfdc6779e57de40d0",
"status": "affected",
"version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
"versionType": "git"
},
{
"lessThan": "fc902f52a02298c7432b2334c0c82a2885a1a8b6",
"status": "affected",
"version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
"versionType": "git"
},
{
"lessThan": "3b9a324e646d3657a8d9806dfbfe4f3e4066e882",
"status": "affected",
"version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
"versionType": "git"
},
{
"status": "affected",
"version": "f58a6c08ebdfa978178bbca78c2ba744a2665912",
"versionType": "git"
},
{
"status": "affected",
"version": "1df16498dfd0d5a129bdf2982d9a08df73e8923d",
"versionType": "git"
},
{
"status": "affected",
"version": "8b8d278aa4de9335682bbd4a3bb619af015c859e",
"versionType": "git"
},
{
"status": "affected",
"version": "6804052fa9d86e9a512c88b24a5debbfc1a490fc",
"versionType": "git"
},
{
"lessThan": "3.2.81",
"status": "affected",
"version": "3.2.80",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.36",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.28",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.8",
"versionType": "semver"
},
{
"lessThan": "4.6",
"status": "affected",
"version": "4.5.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "3.2.*",
"status": "unaffected",
"version": "3.2.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.81",
"versionStartIncluding": "3.2.80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: remove CAP_SYS_RAWIO zero-padding in dev_validate_header\n\ndev_validate_header() reads dev-\u003ehard_header_len directly when\nzero-padding short link layer headers for CAP_SYS_RAWIO holders:\n\n if (capable(CAP_SYS_RAWIO)) {\n memset(ll_header + len, 0, dev-\u003ehard_header_len - len);\n return true;\n }\n\nPacket send paths call dev_validate_header() on skbs whose headroom was\nallocated from an earlier hard_header_len read. If the device is\nreconfigured so that dev-\u003ehard_header_len increases before validation,\nthe memset writes past the reserved buffer, an out-of-bounds write.\n\nThis out-of-bounds write is masked in some SOCK_RAW paths today because\nthe same concurrent increase can first make skb_push() exceed the\nreserved headroom and trigger skb_under_panic(). Remove the zero-padding\nbranch before making those hard_header_len reads consistent, so the\nsnapshot fixes do not turn a loud panic into a silent overwrite.\n\nThis path is only reached for variable length L2 protocols, where\nlen \u003c hard_header_len but len \u003e= min_header_len. No remaining in-tree\nvariable length L2 protocol implements header_ops-\u003evalidate, and the\nCAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no\nreal value beyond allowing testing of intentionally malformed input.\n\nDrop the CAP_SYS_RAWIO branch. The remaining reads of\ndev-\u003ehard_header_len in dev_validate_header() are comparisons only and\nhave no memory safety impact."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:48.924Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a"
},
{
"url": "https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6"
},
{
"url": "https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f"
},
{
"url": "https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b"
},
{
"url": "https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69"
},
{
"url": "https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208"
},
{
"url": "https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0"
},
{
"url": "https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6"
},
{
"url": "https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882"
}
],
"title": "net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80731",
"datePublished": "2026-09-03T08:21:48.924Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:48.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80730 (GCVE-0-2026-80730)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
In test_ringbuffer()'s out_free cleanup loop, the check
`!rb_threads[cpu]` only catches NULL entries and misses entries that
hold an ERR_PTR.
rb_threads[] is static, so unassigned slots are NULL. But when
kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or
-EINTR) in rb_threads[cpu] before the creation loop jumps to out_free.
That entry is non-NULL, so the old `!ptr` check does not break, and the
cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop()
then dereferences the bogus pointer, crashing the kernel during the
late_initcall self-test.
crash logs:
BUG: kernel NULL pointer dereference, address: 000000000000001c
Oops: 0002 [#1] SMP NOPTI
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy)
RIP: 0010:kthread_stop+0x2e/0x220
RBX: fffffffffffffff4
CR2: 000000000000001c
Call Trace:
<TASK>
test_ringbuffer+0x1ec/0x650
do_one_initcall+0x6c/0x2c0
kernel_init_freeable+0x21d/0x420
kernel_init+0x15/0x1c0
ret_from_fork+0x21b/0x320
</TASK>
Kernel panic - not syncing: Fatal exception
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
64ed3a049e3e81b801e7c5bb052416152443f585 , < 51d78fad30dd9ae45721224103662bdbcf210096
(git)
Affected: 64ed3a049e3e81b801e7c5bb052416152443f585 , < 93e7044b548a72022208595d2c1b188bb225ce83 (git) Affected: 64ed3a049e3e81b801e7c5bb052416152443f585 , < 8532983c312e8b875d7c9e440f8ee4674ea4b711 (git) Affected: 64ed3a049e3e81b801e7c5bb052416152443f585 , < 6dd7a06894d6d3dc84319bd0b7d1a7c27df9d902 (git) Affected: 64ed3a049e3e81b801e7c5bb052416152443f585 , < 3ea2fd344d93e3cf9503739b09fd702c0d8f8f0b (git) Affected: 64ed3a049e3e81b801e7c5bb052416152443f585 , < 91542863abade2fd4f2b361991f5386ad9d19c8c (git) |
|
| Linux | Linux |
Affected:
5.17
Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51d78fad30dd9ae45721224103662bdbcf210096",
"status": "affected",
"version": "64ed3a049e3e81b801e7c5bb052416152443f585",
"versionType": "git"
},
{
"lessThan": "93e7044b548a72022208595d2c1b188bb225ce83",
"status": "affected",
"version": "64ed3a049e3e81b801e7c5bb052416152443f585",
"versionType": "git"
},
{
"lessThan": "8532983c312e8b875d7c9e440f8ee4674ea4b711",
"status": "affected",
"version": "64ed3a049e3e81b801e7c5bb052416152443f585",
"versionType": "git"
},
{
"lessThan": "6dd7a06894d6d3dc84319bd0b7d1a7c27df9d902",
"status": "affected",
"version": "64ed3a049e3e81b801e7c5bb052416152443f585",
"versionType": "git"
},
{
"lessThan": "3ea2fd344d93e3cf9503739b09fd702c0d8f8f0b",
"status": "affected",
"version": "64ed3a049e3e81b801e7c5bb052416152443f585",
"versionType": "git"
},
{
"lessThan": "91542863abade2fd4f2b361991f5386ad9d19c8c",
"status": "affected",
"version": "64ed3a049e3e81b801e7c5bb052416152443f585",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix crash passing ERR_PTR to kthread_stop()\n\nIn test_ringbuffer()\u0027s out_free cleanup loop, the check\n`!rb_threads[cpu]` only catches NULL entries and misses entries that\nhold an ERR_PTR.\n\nrb_threads[] is static, so unassigned slots are NULL. But when\nkthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or\n-EINTR) in rb_threads[cpu] before the creation loop jumps to out_free.\nThat entry is non-NULL, so the old `!ptr` check does not break, and the\ncleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop()\nthen dereferences the bogus pointer, crashing the kernel during the\nlate_initcall self-test.\n\ncrash logs:\n BUG: kernel NULL pointer dereference, address: 000000000000001c\n Oops: 0002 [#1] SMP NOPTI\n CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy)\n RIP: 0010:kthread_stop+0x2e/0x220\n RBX: fffffffffffffff4\n CR2: 000000000000001c\n Call Trace:\n \u003cTASK\u003e\n test_ringbuffer+0x1ec/0x650\n do_one_initcall+0x6c/0x2c0\n kernel_init_freeable+0x21d/0x420\n kernel_init+0x15/0x1c0\n ret_from_fork+0x21b/0x320\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:48.325Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/51d78fad30dd9ae45721224103662bdbcf210096"
},
{
"url": "https://git.kernel.org/stable/c/93e7044b548a72022208595d2c1b188bb225ce83"
},
{
"url": "https://git.kernel.org/stable/c/8532983c312e8b875d7c9e440f8ee4674ea4b711"
},
{
"url": "https://git.kernel.org/stable/c/6dd7a06894d6d3dc84319bd0b7d1a7c27df9d902"
},
{
"url": "https://git.kernel.org/stable/c/3ea2fd344d93e3cf9503739b09fd702c0d8f8f0b"
},
{
"url": "https://git.kernel.org/stable/c/91542863abade2fd4f2b361991f5386ad9d19c8c"
}
],
"title": "ring-buffer: Fix crash passing ERR_PTR to kthread_stop()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80730",
"datePublished": "2026-09-03T08:21:48.325Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:48.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80729 (GCVE-0-2026-80729)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
mm/huge_memory: initialise workingset state before folio split
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: initialise workingset state before folio split
xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but
__folio_split() leaves the xa_state's xa_lru unset. That lets a live,
memcg-charged xa_node exist without being linked into the mapping's
shadow_nodes list_lru; when reclaim later walks the list_lru it trips
VM_WARN_ON(!css_is_dying()).
Use mapping_set_update() to install both the workingset update callback
and the shadow_nodes list_lru on the xa_state.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
58729c04cf1092b87aeef0bf0998c9e2e4771133 , < d858f7c9fc514f1d9d3be7d00b2dd4e2f2383b55
(git)
Affected: 58729c04cf1092b87aeef0bf0998c9e2e4771133 , < aca1f2d5de17e138bc6c4859126b77e516b82541 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/huge_memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d858f7c9fc514f1d9d3be7d00b2dd4e2f2383b55",
"status": "affected",
"version": "58729c04cf1092b87aeef0bf0998c9e2e4771133",
"versionType": "git"
},
{
"lessThan": "aca1f2d5de17e138bc6c4859126b77e516b82541",
"status": "affected",
"version": "58729c04cf1092b87aeef0bf0998c9e2e4771133",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/huge_memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: initialise workingset state before folio split\n\nxas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but\n__folio_split() leaves the xa_state\u0027s xa_lru unset. That lets a live,\nmemcg-charged xa_node exist without being linked into the mapping\u0027s\nshadow_nodes list_lru; when reclaim later walks the list_lru it trips\nVM_WARN_ON(!css_is_dying()).\n\nUse mapping_set_update() to install both the workingset update callback\nand the shadow_nodes list_lru on the xa_state."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:47.722Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d858f7c9fc514f1d9d3be7d00b2dd4e2f2383b55"
},
{
"url": "https://git.kernel.org/stable/c/aca1f2d5de17e138bc6c4859126b77e516b82541"
}
],
"title": "mm/huge_memory: initialise workingset state before folio split",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80729",
"datePublished": "2026-09-03T08:21:47.722Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:47.722Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80728 (GCVE-0-2026-80728)
Vulnerability from nvd – Published: 2026-09-03 08:21 – Updated: 2026-09-03 08:21
VLAI
EPSS
VEX
Title
Revert "drm/amdgpu: fix aperture mapping leak"
Summary
In the Linux kernel, the following vulnerability has been resolved:
Revert "drm/amdgpu: fix aperture mapping leak"
devres teardown is LIFO. The aperture devres node was registered after
the DRM device node, so devres_release_all() unmaps the aperture before
the DRM device release callback fires amdgpu_device_fini_sw(). IP
sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a
pointer derived from aper_base_kaddr, causing a kernel page fault on
probe failure / rollback:
BUG: unable to handle page fault ... PMD 0
RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu]
Call Trace:
amdgpu_device_fini_sw
amdgpu_driver_release_kms
devm_drm_dev_init_release
devres_release_all
This reverts commit d871e99879cb5fd1fa798b006b4888887e63a17a.
(cherry picked from commit 336e0cd576817ac64a4b394ca2b3680029f3e37f)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7380f1bfe9d7ed3a4ca9d99a5c4df840fff9af2a
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 96d26143882f9cb47dcc1f3dd4e26d047e53ab9b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 496846a9411136eb9e86ad4f4e62d751bd1e1db5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b96c529cd2551b78316a4afa3237b2ed96ba03c8 (git) Affected: 0 , < 6.6.152 (semver) Affected: 0 , < 6.12.104 (semver) Affected: 0 , < 6.18.45 (semver) Affected: 0 , < 7.1.9 (semver) |
|
| Linux | Linux |
Unaffected:
6.6.152 , ≤ 6.6.*
(semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c",
"drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7380f1bfe9d7ed3a4ca9d99a5c4df840fff9af2a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "96d26143882f9cb47dcc1f3dd4e26d047e53ab9b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "496846a9411136eb9e86ad4f4e62d751bd1e1db5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b96c529cd2551b78316a4afa3237b2ed96ba03c8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.6.152",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.104",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.45",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c",
"drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"drm/amdgpu: fix aperture mapping leak\"\n\ndevres teardown is LIFO. The aperture devres node was registered after\nthe DRM device node, so devres_release_all() unmaps the aperture before\nthe DRM device release callback fires amdgpu_device_fini_sw(). IP\nsw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a\npointer derived from aper_base_kaddr, causing a kernel page fault on\nprobe failure / rollback:\n\n BUG: unable to handle page fault ... PMD 0\n RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu]\n Call Trace:\n amdgpu_device_fini_sw\n amdgpu_driver_release_kms\n devm_drm_dev_init_release\n devres_release_all\n\nThis reverts commit d871e99879cb5fd1fa798b006b4888887e63a17a.\n\n(cherry picked from commit 336e0cd576817ac64a4b394ca2b3680029f3e37f)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T08:21:47.126Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7380f1bfe9d7ed3a4ca9d99a5c4df840fff9af2a"
},
{
"url": "https://git.kernel.org/stable/c/96d26143882f9cb47dcc1f3dd4e26d047e53ab9b"
},
{
"url": "https://git.kernel.org/stable/c/a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d"
},
{
"url": "https://git.kernel.org/stable/c/496846a9411136eb9e86ad4f4e62d751bd1e1db5"
},
{
"url": "https://git.kernel.org/stable/c/b96c529cd2551b78316a4afa3237b2ed96ba03c8"
}
],
"title": "Revert \"drm/amdgpu: fix aperture mapping leak\"",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80728",
"datePublished": "2026-09-03T08:21:47.126Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-03T08:21:47.126Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}