CVE-2026-89966 mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as a fallback to allocate from all nodes. If order is gigantic,...

CVE-2026-89963 powerpc/kexec_file: Fix null-ptr-def in extra size calculation

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89963 powerpc/kexec_file: Fix null-ptr-def in extra size calculation

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89963

CVE-2026-89963 affects the Linux kernel in the powerpc/kexec_file subsystem. A potential NULL pointer dereference exists in the function kexec_extra_fdt_size_ppc64() : on platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving the pointer 'rmem' unal...

EUVD-2026-80563

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89887 media: i2c: ov7740: fix use-after-destroy in remove

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740remove function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a...

CVE-2026-89887

CVE-2026-89887 is a use-after-destroy and double-free bug in the Linux kernel's ov7740 I2C media (camera sensor) driver . The ov7740_remove() function destroyed the driver's mutex before freeing the V4L2 control handler that relies on it, causing a kernel panic . Additionally, v4l2_ctrl_handler_f...

EUVD-2026-80487

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740remove function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a...

CVE-2026-89887 media: i2c: ov7740: fix use-after-destroy in remove

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740remove function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a...

CVE-2026-89866 media: chips-media: wave5: Resume device before setting EOS flag

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Resume device before setting EOS flag Setting the EOS flag talks to the firmware via sendfirmwarecommand, which accesses VPU registers. Both the STREAMOFF path wave5vpudecjobabort and the V4L2DECCMDSTOP...

EUVD-2026-80466

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Resume device before setting EOS flag Setting the EOS flag talks to the firmware via sendfirmwarecommand, which accesses VPU registers. Both the STREAMOFF path wave5vpudecjobabort and the V4L2DECCMDSTOP...

CVE-2026-89866

This vulnerability affects the chips-media wave5 VPU driver in the Linux kernel . When the End-of-Stream (EOS) flag is set via send_firmware_command(), it accesses VPU registers that may be powered down if the device is in a runtime-suspended state. Both the STREAMOFF path (wave5_vpu_dec_job_abor...

CVE-2026-89866 media: chips-media: wave5: Resume device before setting EOS flag

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Resume device before setting EOS flag Setting the EOS flag talks to the firmware via sendfirmwarecommand, which accesses VPU registers. Both the STREAMOFF path wave5vpudecjobabort and the V4L2DECCMDSTOP...

EUVD-2026-80428

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...

CVE-2026-89828 drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...

CVE-2026-89828

This CVE affects the Linux kernel's amdgpu DRM driver . The root cause is an initialization ordering bug in amdgpu_vram_mgr_init(): the function drmm_cgroup_register_region() is called before the list heads and buddy allocator are initialized. If it fails, the early return skips those initializat...

CVE-2026-89828 drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...

CVE-2026-89807 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

CVE-2026-89807

A NULL pointer dereference in the Linux kernel's drm/amdkfd driver allows a local user holding CAP_CHECKPOINT_RESTORE to panic the machine. Both create_queue_cpsch() and create_queue_nocpsch() call mqd_mgr->restore_mqd() unconditionally during CRIU restore, with no NULL guard. When restore_mqd...

CVE-2026-89807 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...