Android SDK: Seven Linux Kernel Vulnerabilities Patched in Single Disclosure Event
A batch of seven Linux kernel vulnerabilities, including two critical flaws, were disclosed and patched on August 26, 2026, impacting the Android SDK.
Key findings
- Seven Linux kernel vulnerabilities disclosed together on August 26, 2026, affecting the Android SDK.
- Vulnerabilities span input handling, driver validation, and core kernel subsystems.
- Two critical vulnerabilities (CVE-2026-80528, CVE-2026-74744) were patched the same day.
- Patches were released for all seven issues on the disclosure date, August 26, 2026.
On August 26, 2026, a batch of seven vulnerabilities was disclosed in the Linux kernel, a core component of the Android SDK. These vulnerabilities, all patched on the same day, span various subsystems and range in severity from High to Critical. The disclosures highlight ongoing security challenges within the kernel's complex codebase.
Several vulnerabilities relate to input handling and device drivers. CVE-2026-80575 in the cs40l50-vibra driver allows for the copying of custom data from userspace without proper validation. Similarly, CVE-2026-80568 in the synaptics-rmi4 driver addresses an issue where input reports could be changed mid-stream, potentially leading to buffer allocation problems. CVE-2026-80566, affecting the hynitron_cstxxx touchscreen driver, involves improper validation of touch counts and finger IDs, which could lead to out-of-bounds access.
Other vulnerabilities impact different kernel areas. CVE-2026-80546 in the s390/zcrypt module improves input validation for CCA CPRB data, addressing potential integer overflows. CVE-2026-80539 in the amdgpu graphics driver prevents multiple FENCE chunks in a single submission, mitigating a potential issue with chunk ID handling. A critical vulnerability, CVE-2026-80528, in the ceph filesystem client could lead to a denial-of-service condition by causing filesystem reclaim operations while a journal is in use. Another critical vulnerability, CVE-2026-74744, in the ipvlan networking module, concerns the inheritance of headroom and tailroom values, which could impact network packet handling.
All seven vulnerabilities were resolved and patched on the same day, indicating a coordinated disclosure and rapid response. Users of the Android SDK, and systems relying on the Linux kernel, are advised to ensure their systems are updated to incorporate these patches to mitigate potential security risks. The clustering of these disclosures underscores the importance of continuous security auditing and timely patching for foundational software components.