CVE-2026-89502 ring-buffer: Free cpu_buffer::free_page with subbuf_order

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpubuffer::freepage with subbuforder When sub-buffers use an order greater than 0, cpubuffer-freepage is allocated with subbuforder. Use the correct order for cpubuffer-freepage...

CVE-2026-89497

A heap buffer overflow exists in the Linux kernel's OrangeFS (orangefs) client, specifically in the function orangefs_prepare_cdm_array(). The function sizes each client debug keyword buffer using strcspn(cds_head, " "), which does not skip leading spaces, but then parses the keyword with the %s ...

CVE-2026-89497 orangefs: skip leading spaces before parsing client debug masks

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefspreparecdmarray sizes each client debug keyword buffer with strcspncdshead, " ", but then parses the keyword with %s. The %s conversion skips leading...

CVE-2026-89484 lockd: fix NULL dereference on lockowner allocation failure

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclntlocksinitprivate installs NLM file lock operations even when nlmclntfindlockowner fails to allocate a lockowner. nlmclntproc then returns -ENOMEM, but the VFS sti...

EUVD-2026-76390

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclntlocksinitprivate installs NLM file lock operations even when nlmclntfindlockowner fails to allocate a lockowner. nlmclntproc then returns -ENOMEM, but the VFS sti...

CVE-2026-89484 lockd: fix NULL dereference on lockowner allocation failure

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclntlocksinitprivate installs NLM file lock operations even when nlmclntfindlockowner fails to allocate a lockowner. nlmclntproc then returns -ENOMEM, but the VFS sti...

EUVD-2026-76337

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in skstore and kekstore skstore and kekstore strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == '\n' length--;...

CVE-2026-81008 interconnect: Fix use after free in icc_get() and of_icc_get_by_index()

In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix use after free in iccget and oficcgetbyindex In oficcgetbyindex and iccget, if the dynamic allocation for path-name fails via kasprintf, the error handling path directly calls kfreepath to free the path object a...

CVE-2026-81000 net: tun: bound receive headroom

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

CVE-2026-81000 net: tun: bound receive headroom

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

CVE-2026-80990

CVE-2026-80990 is a resource-leak bug in the Linux kernel Thunderbolt networking (tbnet ) subsystem. In tbnet_connected_work(), the function requests a specific Rx HopID from tb_xdomain_alloc_in_hopid(), which uses ida_alloc_range() with the desired ID as a lower bound. If the requested ID is alr...

CVE-2026-80990 net: thunderbolt: Release the Rx HopID that was handed out on mismatch

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Release the Rx HopID that was handed out on mismatch tbxdomainallocinhopid passes the wanted HopID to idaallocrange as the lower bound, so a taken id is not an error there: the allocator returns the next free on...

CVE-2026-80990

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Release the Rx HopID that was handed out on mismatch tbxdomainallocinhopid passes the wanted HopID to idaallocrange as the lower bound, so a taken id is not an error there: the allocator returns the next free on...

CVE-2026-80963 dm-stats: fix a crash if allocation of per-cpu data fails

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

CVE-2026-80963

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

CVE-2026-80963

CVE-2026-80963 affects the Linux kernel 's dm-stats module (device-mapper statistics). The root cause is a NULL pointer dereference in the dm_stat_free function: when the per-CPU allocation via dm_kvzalloc fails, execution jumps to an error path that calls dm_stat_free, which iterates over all po...

EUVD-2026-76286

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

CVE-2026-80963 dm-stats: fix a crash if allocation of per-cpu data fails

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

EUVD-2026-76269

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

Security Bulletin: Security Vulnerability identified in libthrift-0.23.0.jar used by IBM Maximo Application Suite - MREF ( CVE-2026-43871, CVE-2026-45112, CVE-2026-48586 )

Summary There is a vulnerability in libthrift-0.23.0.jar used by IBM Maximo Application Suite - MREF Vulnerability Details CVEID:CVE-2026-43871 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects...