EUVD-2026-82309

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate segid fields from persistent memory cacheposdecode, cachekeydecode and the last-kset branches of cachereplay, the writeback worker and the GC worker take a cache segment id from the cache device metadata and...

CVE-2026-93201 dm-pcache: validate seg_id fields from persistent memory

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate segid fields from persistent memory cacheposdecode, cachekeydecode and the last-kset branches of cachereplay, the writeback worker and the GC worker take a cache segment id from the cache device metadata and...

CVE-2026-93201

CVE-2026-93201 affects the Linux kernel dm-pcache (persistent cache) subsystem. The functions cache_pos_decode(), cache_key_decode(), and the last-kset branches of cache_replay(), the writeback worker, and the GC worker index cache->segments[] using a segment ID read from on-disk metadata with...

CVE-2026-93201 dm-pcache: validate seg_id fields from persistent memory

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate segid fields from persistent memory cacheposdecode, cachekeydecode and the last-kset branches of cachereplay, the writeback worker and the GC worker take a cache segment id from the cache device metadata and...

CVE-2026-93198

CVE-2026-93198 affects the Linux kernel component dm-pcache (device-mapper persistent cache). The writeback worker follows the persisted dirty_tail chain, which is decoded from the cache device independently of the key_tail chain that cache_replay() validates. Because on-media fields are authenti...

EUVD-2026-82306

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate the persisted dirtytail chain at load The writeback worker follows the persisted dirtytail chain, which is decoded from the cache device independently of the keytail chain that cachereplay walks and bounds. A...

CVE-2026-93198 dm-pcache: validate the persisted dirty_tail chain at load

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate the persisted dirtytail chain at load The writeback worker follows the persisted dirtytail chain, which is decoded from the cache device independently of the keytail chain that cachereplay walks and bounds. A...

CVE-2026-93198 dm-pcache: validate the persisted dirty_tail chain at load

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate the persisted dirtytail chain at load The writeback worker follows the persisted dirtytail chain, which is decoded from the cache device independently of the keytail chain that cachereplay walks and bounds. A...

EUVD-2026-82214

In the Linux kernel, the following vulnerability has been resolved: crashdump: release keyring reference at the correct time restoredmcryptkeystothreadkeyring gets a reference to the user keyring before restoring the saved dm-crypt keys. The same keyring reference is then passed to addkeytokeyrin...

CVE-2026-93106

CVE-2026-93106 affects the Linux kernel crash_dump subsystem. The function restore_dm_crypt_keys_to_thread_keyring() passes a keyring reference to add_key_to_keyring() for each saved dm-crypt key, but that function drops the reference on every call . When more than one key is restored, the refere...

CVE-2026-93068 drm/amd/display: Fix DM I2C teardown race

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

EUVD-2026-81994

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

CVE-2026-90333

This CVE affects the dm-integrity target in the Linux kernel (standalone mode). The discard-block check in dm_integrity_rw_tag() treats a stored tag of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded, skipping HMAC verification. An attacker with raw write access to the backing devi...

CVE-2026-90333 dm-integrity: replace forgeable discard filler with a keyed sector marker

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

CVE-2026-90333 dm-integrity: replace forgeable discard filler with a keyed sector marker

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

CVE-2026-90052

CVE-2026-90052 is a buffer overflow in the Linux kernel's dm-integrity subsystem. Since commit 68c5c42567bc, integrity_metadata computes a checksum for every discarded block, but integrity_sector_checksum always writes the full digest regardless of the configured tag size. When the tag size is sm...

CVE-2026-90052 dm-integrity: fix buffer overflow with keyed discard

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc "dm-integrity: replace forgeable discard filler with a keyed sector marker", integritymetadata computes a checksum for every discarded block into the...

EUVD-2026-81913

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc "dm-integrity: replace forgeable discard filler with a keyed sector marker", integritymetadata computes a checksum for every discarded block into the...

CVE-2026-90052 dm-integrity: fix buffer overflow with keyed discard

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc "dm-integrity: replace forgeable discard filler with a keyed sector marker", integritymetadata computes a checksum for every discarded block into the...

kernel: dm_early_create: fix freeing used table on dm_resume failure

A flaw was found in the Linux kernel's device mapper DM subsystem. During certain resume operations, the kernel might attempt to free a memory table that has already been released. This error, known as a double-free vulnerability, can lead to memory corruption. A successful exploit could result i...