Linux Kernel: Twelve Vulnerabilities Disclosed Together on September 9, 2026
Key findings • Twelve Linux kernel vulnerabilities disclosed together on September 9, 2026. • Flaws affect diverse subsystems including networking, crypto, HID, PCI, KVM, and Bluetooth. •…
Key findings
- Twelve Linux kernel vulnerabilities disclosed together on September 9, 2026.
- Flaws affect diverse subsystems including networking, crypto, HID, PCI, KVM, and Bluetooth.
- Fixes address race conditions, memory management issues, and NULL pointer dereferences.
- No specific exploitation or threat actor information was provided for this batch.
- Users are urged to update their Linux kernel to patch these issues.
On September 9, 2026, a batch of twelve vulnerabilities was disclosed in the Linux kernel. These vulnerabilities span multiple subsystems, including networking, cryptography, and device drivers, with fixes addressing issues in feature toggling, memory management, and error handling. The disclosures highlight the ongoing need for diligent patching and security auditing within the kernel.
Several vulnerabilities relate to networking and device management. CVE-2026-80925 addresses a race condition in the vlan module related to hardware VLAN offload toggling, ensuring proper handling of feature changes. CVE-2026-80923 resolves an issue in the xhci dbgtty driver where a failure in registering the TTY driver could lead to a double unregister call upon module exit. CVE-2026-80918 fixes a type confusion vulnerability in the HID core when processing long items, preventing potential data corruption. Additionally, CVE-2026-80917 addresses a NULL pointer dereference in the PCI host-generic driver on 32-bit systems when dealing with large configuration spaces. CVE-2026-80915 aims to fix Direct Page Table (DPT) allocation paths in the drm/xe driver, removing a problematic fallback to system memory.
The cryptography subsystem also saw attention with multiple fixes. CVE-2026-80924 ensures that derived key buffers in the krb5 module are freed using kfree_sensitive() to prevent sensitive material from lingering in memory. CVE-2026-80921 addresses an issue in KVM for s390 where stale crypto bits in shadowed access control blocks could grant nested guests unintended access. CVE-2026-80922 allows zero as a valid random number output for the qcom-rng driver, preventing the output from being distinguishable from true random data.
Other areas addressed include I/O and debugging. CVE-2026-80920 defers eventfd signaling in io_uring when queued from a wakeup handler, preventing potential race conditions. CVE-2026-80916 fixes data corruption and race conditions in the kcov module, particularly on PREEMPT_RT kernels, by correctly managing per-CPU areas for remote KCOV state. CVE-2026-80919 resolves a recursive mutex acquisition issue in the drm/amdgpu driver during core dump formatting, preventing deadlocks. Finally, CVE-2026-80914 fixes a use-after-free vulnerability in the Bluetooth ISO subsystem related to listener sockets.
These twelve vulnerabilities were all disclosed on September 9, 2026, indicating a coordinated disclosure event. While the provided information does not detail specific exploitation campaigns or threat actors, the breadth of affected subsystems underscores the importance of timely kernel updates for all Linux users. Users are advised to consult their distribution's security advisories for specific patch availability and recommended actions.
The fixes for these vulnerabilities are expected to be integrated into upcoming kernel releases. Maintaining an up-to-date kernel is crucial for mitigating potential security risks arising from these types of flaws. The disclosures serve as a reminder of the complexity of the Linux kernel and the continuous effort required to ensure its security and stability.