CVE-2026-89763

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...

CVE-2026-89763 KEYS: trusted: Fix TPM teardown ordering

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...

EUVD-2026-76662

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...

CVE-2026-89740

In the Linux kernel, the following vulnerability has been resolved: serial: imx: serialize imxuartports lifetime imxuartprobe publishes its devm-allocated port in imxuartports before uartaddoneport because console setup uses the table. The entry is not cleared when adding the port fails or after...

EUVD-2026-76575

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

CVE-2026-89635 ksmbd: only rebind the reopened file's own oplock on durable reconnect

In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...

CVE-2026-89628 HID: picolcd: clamp eeprom debugfs read to bytes actually received

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

CVE-2026-89628

A slab-out-of-bounds read vulnerability exists in the Linux kernel's hid_picolcd driver. The function picolcd_debug_eeprom_read() trusts a length byte supplied by the device in its REPORT_EE_DATA reply, clamping it only to the caller's read count but never checking resp->raw_size—the actual nu...

CVE-2026-89628

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

EUVD-2026-76512

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotifyprecontent builds its filerange on the triggering task's stack. fanotifyallocpermevent saves a pointer to range.pos in the heap-allocated permission event so...

EUVD-2026-76499

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability querycapability copies four ACPI buffer objects returned by the firmware DSM into fixed-size u816 fields in struct pfruupdatecapinfo using memcpy with the...

CVE-2026-89587 ACPI: pfr_update: fix stack buffer overflow in query_capability()

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability querycapability copies four ACPI buffer objects returned by the firmware DSM into fixed-size u816 fields in struct pfruupdatecapinfo using memcpy with the...

CVE-2026-89587

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfrupdate: fix stack buffer overflow in querycapability querycapability copies four ACPI buffer objects returned by the firmware DSM into fixed-size u816 fields in struct pfruupdatecapinfo using memcpy with the...

EUVD-2026-76419

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-89482

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in writezeroes processing" established that blkrqpayloadbytes must not be read without first checking...

CVE-2026-89482

CVE-2026-89482 is a wild-memory-access vulnerability in the Linux kernel's nvme-tcp module. The root cause is an incorrect receive-side gate: for REQ_OP_WRITE_ZEROES commands, blk_rq_payload_bytes() returns a non-zero value despite the absence of physical segments, so the setup phase leaves req-&...

EUVD-2026-76388

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in writezeroes processing" established that blkrqpayloadbytes must not be read without first checking...

CVE-2026-81014

CVE-2026-81014 is a heap out-of-bounds read in the Linux kernel's platform/x86: hp-bioscfg driver, affecting the sk_store() and kek_store() sysfs write handlers. Both functions strip a trailing newline from user input and allocate a key buffer of size length (one byte shorter), but then pass the ...

CVE-2026-81013

CVE-2026-81013 is a heap out-of-bounds read in the Linux kernel's hp-bioscfg platform driver. The root cause is in validate_password_input(), which computes length = strlen(buf) and then checks buf[length - 1] to strip a trailing newline without first verifying that length is nonzero. Writing a b...

CVE-2026-81002

CVE-2026-81002 is a critical (CVSS 9.8) memory corruption flaw in the Linux kernel's XDP component. The xdp_convert_zc_to_xdp_frame() function clones an AF_XDP zero-copy packet into an order-0 page but incorrectly advertises PAGE_SIZE as the frame size, allowing the frame to overlap skb_shared_in...