Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2026-80977High· 7.8net: skbuff: don't touch shared zerocopy state in skb_tx_error()
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skb_tx_error() skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_mana…
CVE-2026-80976Critical· 9.8⚖ disputedseg6: reset IP6CB after IPv6 decapsulation
In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap_and_validate() pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block …
CVE-2026-80973Low· 3.2kernel: ALSA: 6fire: bound the MIDI event length from the device (CVE-2026-80973)
A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem, specifically within the 6fire driver. This vulnerability allows a malicious USB device to trigger an out-of-bounds read by sending a specially craft…
CVE-2026-80972Medium· 5.5ALSA: aloop: Check card index validity at probe
In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK fo…
CVE-2026-80971High· 7.8ALSA: bcd2000: clear the URB pointers on disconnect
In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000_free_usb_related_resources() frees both URBs and leaves the pointers behind: usb_kill_urb(bcd2k->midi_out…
CVE-2026-80970Low· 3.3kernel: ALSA: FCP: do not copy out an uninitialised init response (CVE-2026-80970)
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) FireWire Control Protocol (FCP) subsystem. This vulnerability allows a local attacker to trigger the copying of uninitialized kernel memory to userspace. By se…
CVE-2026-80969Medium· 5.5ALSA: mpu401: Check card index validity at probe
In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK …
CVE-2026-80968Medium· 5.5ALSA: mts64: Check card index validity at probe
In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: Check card index validity at probe Although mts64 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often giv…
CVE-2026-80967High· 8.4⚖ disputedALSA: pcxhr: initialize mutexes before requesting threaded IRQ
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ pcxhr_probe() requests pcxhr_threaded_irq() before initializing mgr->lock, even though the threaded hand…
CVE-2026-80966Medium· 5.5ALSA: portman2x4: Check card index validity at probe
In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is…
CVE-2026-80965Medium· 5.5ALSA: serial-u16550: Check card index validity at probe
In the Linux kernel, the following vulnerability has been resolved: ALSA: serial-u16550: Check card index validity at probe serial-u16550 driver blindly trusts that the given devptr->id value is within the proper card index range at pr…
CVE-2026-80963Medium· 5.5dm-stats: fix a crash if allocation of per-cpu data fails
In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code jumps to the "out" label and calls dm_s…
CVE-2026-80952Medium· 6.1kernel: i3c: master: Fix info leak and UAF in device unregister path (CVE-2026-80952)
A flaw was found in the Linux kernel's i3c master component. During device unregistration, a race condition can occur where the device descriptor is prematurely cleared. This can lead to an information leak, exposing kernel stack contents …
CVE-2026-80951High· 7.8i3c: master: svc: bound IBI payload to the requested max_payload_len
In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested max_payload_len svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into the IBI slot. The loop is …
CVE-2026-80949Medium· 5.5wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() The memory allocated for buf is not freed in some of the error paths in brcmf_sdio_read_control(). Fix tha…
CVE-2026-80944Medium· 4.7kernel: wifi: mwifiex: Detach sync cmd buffer on interrupted wait (CVE-2026-80944)
A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. When a synchronous command's wait operation is interrupted, the driver can attempt to write data to a memory location that has already been released. This memory corruption can l…
CVE-2026-80941Medium· 5.5wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() The skb passed to the rtw_hci_tx_write() is expected to be freed when the function fails, but the error pa…
CVE-2026-80939Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot Since the hardware rfkill polling was introduced, arm64 platforms can panic with an asynchron…
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot Since the hardware rfkill polling was introduced, arm64 platforms can panic with an asynchron…
CVE-2026-80938Medium· 5.5wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615_suspend() acquired the mt76 mutex and then called cancel_delayed_work_sync() on mac_work. m…
CVE-2026-80935High· 8.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address …
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address …
CVE-2026-80933High· 7.8⚖ disputedwifi: mt76: mt7996: validate default EEPROM firmware size
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated fi…
CVE-2026-80931High· 7.8⚖ disputedw1: ds28e17: reject an oversize length on an I2C block read
In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN …
CVE-2026-80930Medium· 5.5tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout i2c_nuvoton_wait_for_stat() enables the IRQ before waiting for the interrupt handler to report a status change. If th…
CVE-2026-80928High· 7.8⚖ disputedsmack: fix cred UAF in smack_file_send_sigiotask()
In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smack_file_send_sigiotask() When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) mu…
CVE-2026-89440High· 7.8mmc: via-sdmmc: stop card-detect handling on probe failure
In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure request_irq() registers the SD card-detect interrupt and the probe enables it before mmc_add_host() runs. If…
CVE-2026-89438Medium· 5.5platform/x86: ISST: Validate logical CPU id and clos id
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number gre…
CVE-2026-89437Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sar_probe() The memory allocated for device_mode_info in parse_package() called by sar_get_data() is not freed in s…
In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sar_probe() The memory allocated for device_mode_info in parse_package() called by sar_get_data() is not freed in s…
CVE-2026-81017High· 8.4⚖ disputedplatform/chrome: sensorhub: Bound the EC-reported sensor number
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number (in->sensor_num). cros_ec_sensorhub_ring_handler() va…
CVE-2026-81014Medium· 5.5platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() sk_store() and kek_store() strip a trailing newline from the sysfs write before allocating th…
CVE-2026-81013Medium· 5.5platform/x86: hp-bioscfg: fix heap OOB read on empty password write
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate_password_input() computes length = strlen(buf) and then checks buf[length - 1] to strip a …