CVE-2026-89699

CVE-2026-89699 is a denial-of-service vulnerability in the Linux kernel's nfsd (Network File System Daemon). The function nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for NFSv4 symlink targets, allowing a remote, unauthenticated attacker to force a kmalloc of up to several ...

EUVD-2026-76611

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

CVE-2026-89699

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

CVE-2026-89699 nfsd: validate symlink target length in NFSv4 CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

CVE-2026-89699 nfsd: validate symlink target length in NFSv4 CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

CVE-2026-89668 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89668 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89644 btrfs: fix extent map leak in NOCOW direct I/O write

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfsdioiomapbegin calls btrfsgetextent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range,...

CVE-2026-89644

CVE-2026-89644 affects the btrfs filesystem in the Linux kernel. The root cause is an extent map reference leak in the NOCOW direct I/O write path: btrfs_get_blocks_direct_write() fails to drop the extent map obtained from btrfs_get_extent() when btrfs_create_dio_extent() returns an error (e.g., ...

CVE-2026-89614 ntfs: bound the free-cluster bitmap scan to the volume

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

EUVD-2026-76526

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-89614 ntfs: bound the free-cluster bitmap scan to the volume

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-89614

CVE-2026-89614 affects the Linux kernel's NTFS file system driver . The flaw is in ntfs_cluster_alloc(), which bounds its free-cluster bitmap scan by the size of the on-disk $Bitmap rather than by the volume's actual cluster count (nr_clusters). Because these are independent quantities, a special...

CVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-89592

CVE-2026-89592 affects the Linux kernel's accel/rocket driver , specifically the rocket_job_push() function. Two distinct bugs exist: (1) a missing NULL check after a kvmalloc_array() call, which can cause a kernel NULL pointer dereference if the allocation fails; and (2) an integer overflow wher...

CVE-2026-89591 accel/rocket: initialize job domain before cleanup paths

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

CVE-2026-89579 bpf: Harden bloom filter sizing and indexing on 32-bit kernels

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

CVE-2026-89579

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

CVE-2026-89579 bpf: Harden bloom filter sizing and indexing on 32-bit kernels

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

EUVD-2026-76491

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...