CVE-2026-80794

A flaw in the Linux kernel's NTFS3 LZNT decompression path can expose uninitialized kernel page contents when reading a crafted compressed file. Bynario demonstrated that the disclosure can recover kernel pointers and determine the randomized kernel base, defeating KASLR and providing information useful for follow-on exploitation.

The Linux kernel's NFC/NCI subsystem can write beyond its fixed-size discovered-target array when an NFC controller repeatedly restarts discovery and reports automatically activated targets. The unchecked target count causes a kernel heap out-of-bounds write and can also make subsequent code walk beyond the array.

An unauthenticated client can bypass a FreeRDP server's configured transport policy and enter RDSTLS after receiving a terminal negotiation failure. Improper failure-state handling causes an error code to be interpreted as a protocol bitmask, exposing RDSTLS parsers and callbacks before the required NLA authentication; the flaw does not by itself authenticate the peer.