Linux Kernel: 25 Vulnerabilities Disclosed Together on August 26, 2026
Key findings • 25 Linux kernel vulnerabilities disclosed together on August 26, 2026. • Vulnerabilities span critical subsystems including networking, input handling, and graphics drivers. …
Key findings
- 25 Linux kernel vulnerabilities disclosed together on August 26, 2026.
- Vulnerabilities span critical subsystems including networking, input handling, and graphics drivers.
- Multiple critical vulnerabilities (CVSSv3 9.8) were patched in this batch.
- Patches for all 25 issues were released on the disclosure date.
- Affected components include MPTCP, fbdev, amdgpu, and various input device drivers.
On August 26, 2026, a significant batch of 25 vulnerabilities was disclosed in the Linux kernel, affecting various subsystems and ranging in severity from High to Critical. This coordinated disclosure event highlights the ongoing challenges in maintaining the security of the kernel, a foundational component for numerous operating systems and embedded systems, including the Android SDK.
Several vulnerabilities cluster around input handling and device drivers. CVE-2026-80575 and CVE-2026-80568, both rated High, stem from issues in input device processing, with CVE-2026-80575 involving validation of custom data and CVE-2026-80568 related to blocking input when a queue is busy. Other input-related vulnerabilities include CVE-2026-80574 (High) for array out-of-bounds in focaltech drivers, CVE-2026-80573 (High) for validating packet lengths in iforce, CVE-2026-80572 (High) for synchronizing timer deletion in byd, CVE-2026-80570 (High) and CVE-2026-80569 (High) concerning Synaptics RMI4 devices, and CVE-2026-80559 (High) for input device registration ordering in sur40.
The networking stack also saw several disclosures. CVE-2026-80589, a Critical vulnerability, addresses a race condition in the block layer related to timer management during disk release. The Multipath TCP (MPTCP) protocol is affected by multiple issues: CVE-2026-80587 (Critical) for improper handling of suboptions, CVE-2026-80586 (Critical) for resetting DSS fields with unexpected sizes, and CVE-2026-80584 (High) for reclaiming forward-allocated memory on RX path errors.
Other notable vulnerabilities include CVE-2026-80580 (High) and CVE-2026-80579 (High) in the fbdev subsystem, related to buffer overflows and mode deletion respectively. The graphics drivers are impacted by CVE-2026-80576 (High) for rejecting oversized IBs in amdgpu, and CVE-2026-80582 (High) for checking VMA boundaries in drm/shmem_helper. Additionally, CVE-2026-80565 (High) affects the crypto subsystem with an error path issue in devm_qce_register_algs, CVE-2026-80561 (Critical) impacts libceph with unsafe decodes, and CVE-2026-80560 (High) relates to signal handling on openrisc architectures.
The disclosures also touch upon audio and system management components. CVE-2026-80583 (High) and CVE-2026-80581 (severity not specified) affect ASoC codecs and SOF IPC4-PCM respectively, dealing with control accesses and pipeline triggers. CVE-2026-80562 (severity not specified) involves the use of spinlocks in the gpio subsystem.
All 25 vulnerabilities were disclosed on the same day, August 26, 2026, indicating a coordinated disclosure effort. Patches for all identified issues were made available concurrently with the disclosure, emphasizing the urgency of applying these updates to mitigate potential risks. Users of the Linux kernel, particularly those in the Android ecosystem, are advised to update to the latest patched versions promptly.
This extensive batch of vulnerabilities underscores the complexity and continuous security maintenance required for the Linux kernel. While patches were released simultaneously, the sheer number and variety of affected subsystems highlight the importance of ongoing vigilance and timely updates for all users. The coordinated nature of this disclosure suggests a proactive approach by the security community in identifying and addressing potential threats within the kernel.