Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-80945

crypto: iaa - unmap dst before software fallback on decompress

CVSS 9.1 CriticalCriticalEPSS 0.0050 · 43rd percentile

Critical, because:

  • CVSS score 9.1: 9.0 or more.

How we decide what’s critical

Published by the CVE Program (CNA: Linux) at 11 Sept 2026, 19:42 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected 2ec6761df889fdf896fde761abd447596dd8f8c2 to before c0279e5ea2aad99d8b91f1a6579d751cc9eb2408 git
  • affected 2ec6761df889fdf896fde761abd447596dd8f8c2 to before fc933a4a419ba8a75da28666a018602c44846953 git
  • affected 2ec6761df889fdf896fde761abd447596dd8f8c2 to before fcd86180ef78b0e41763faef7c6d2de7dfb50c1a git
  • affected 2ec6761df889fdf896fde761abd447596dd8f8c2 to before 94a25930477113730372e0fa2985da4c5ac95c9a git
Other versions: unaffected
Linux Linux
  • affected 6.8
  • unaffected before 6.8 semver
  • unaffected 6.12.111 to 6.12.*, inclusive semver
  • unaffected 6.18.51 to 6.18.*, inclusive semver
  • unaffected 7.2.4 to 7.2.*, inclusive semver
  • unaffected 7.3 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-80945
CNA
Linux
Tags
Published
11 Sept 2026
Updated
19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
9.1 Critical 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CNA (Linux)
  • CISA KEV Not listed.
  • EPSS 0.0050, the 43rd percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 11 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.