CVE-2026-89772

A flaw was found in the Btrfs filesystem of the Linux kernel. This vulnerability allows a local attacker with write access to a memory-mapped file to modify data while it is being written to disk. This can lead to data corruption, where the integrity of the stored information is compromised, or...

CVE-2026-89758

A flaw was found in the Linux kernel's memory management subsystem. When an HMM-based Graphics Processing Unit GPU driver migrates a Transparent Huge Page THP to device memory, it can leave a device-private Page Middle Directory PMD entry. If a user-space application then attempts to manage this...

CVE-2026-89756

A flaw was found in the Linux kernel. When performing memory migration on KVM Kernel-based Virtual Machine hosts, the migratepagesbatch function fails to report RCU Read-Copy Update tasks quiescent states during large batch unmapping operations. This oversight causes the migrating task to become ...

CVE-2026-89751

A flaw was found in the Linux kernel's x86/tdx component. An off-by-one error in the handlein and handleout functions, specifically in the GENMASK calculation for port I/O operations, causes the mask to be one bit too wide. This incorrect handling of I/O sizes could potentially lead to unintended...

CVE-2026-89742

A flaw was found in the Linux kernel. A local user could exploit a use-after-free vulnerability in the dmareqfree function within the RapidIO mport character device interface. This flaw occurs when the dmareqfree function attempts to dereference a freed object after dropping the last reference to...

CVE-2026-89771

A flaw was found in the Linux kernel. A race condition exists in the ring buffer resizing mechanism, where tracebuffer subbufsize can be read without proper locking while it is being simultaneously resized. This could allow a local attacker to trigger unpredictable behavior or a denial of service...

CVE-2026-89760

A flaw was found in the Linux kernel's memory management mm and swap subsystem. This vulnerability occurs when the swapfreehibernationslot function incorrectly frees a hibernation slot while a memory page folio is still present in the swap cache. This can lead to silent memory corruption, process...

CVE-2026-89757

A flaw was found in the Linux kernel's memory management unit MMU, specifically within the multi-generational Least Recently Used mglru mechanism. A bug in how the kernel handles unevictable memory pages can lead to these pages remaining locked in memory even after they should be released. This c...

CVE-2026-89753

A flaw was found in the Linux kernel's memory management subsystem. The shrinklruvec function, responsible for memory reclaim, fails to properly report Read-Copy-Update RCU task quiescent states on systems with preemption enabled. This can lead to RCU task stalls, causing system unresponsiveness ...

CVE-2026-89720

A flaw was found in the Linux kernel's Unsorted Block Image File System UBIFS. An incorrect bounds check in the ubifssbverifysignature function allows a crafted signed UBIFS image to declare a signature length larger than its actual size. This can lead to an out-of-bounds read when processing the...

CVE-2026-89722

A flaw was found in the Linux kernel's PCI/sysfs component. A local user with root privileges could trigger an out-of-bounds read in the pciwritelegacyio function by writing to the legacyio sysfs file with a size less than four bytes. This improper handling of the write buffer can lead to memory...

CVE-2026-89710

A flaw was found in the Linux kernel's NFSv4.1 implementation. When a server returns a new layout state identifier while an existing one is still active, the pnfslayoutprocess function fails to properly release memory associated with layout segments. This oversight leads to a memory leak, which...

CVE-2026-80930

A flaw was found in the Linux kernel's TPM I2C Nuvoton driver. The i2cnuvotonwaitforstat function enables an interrupt IRQ but fails to disable it if the wait operation times out or is interrupted. This oversight can lead to an unbalanced IRQ state, potentially causing system instability or...

CVE-2026-89655

A flaw was found in the Linux kernel's Ceph file system component. A race condition exists in the kickflushingcaps function during the handling of capability messages. This allows a separate process to free a data structure cf entry while kickflushingcaps is still iterating over it. This...

CVE-2026-89638

A flaw was found in the Linux kernel's Server Message Block SMB client. When a file with the setuid or setgid bit is written to on certain Common Internet File System CIFS mounts specifically those using 'cifsacl', 'modefromsid' options, or SMB3.1.1 POSIX extensions, the kernel fails to properly...

CVE-2026-89623

A flaw was found in the Linux kernel's HID Human Interface Device mcp2221 driver. This vulnerability occurs when the device's input/output IO operations are not properly stopped before hardware teardown during device removal or probe failure. This timing issue can lead to a use-after-free...

CVE-2026-89612

A flaw was found in the Linux kernel's NTFS filesystem driver. A local attacker could provide a specially crafted NTFS boot sector containing an invalid Master File Table MFT Logical Cluster Number LCN. Due to an integer overflow during parsing, this could lead to an out-of-bounds memory access...

CVE-2026-89574

A flaw was found in the Linux kernel's device mapper dm array component. Insufficient validation of array block headers during read operations allows a local attacker to craft a malicious on-disk nrentries value. This can lead to an out-of-bounds read from the dm-bufio buffer, potentially resulti...

CVE-2026-89567

A flaw was found in the Linux kernel's jbd2 shrinker. This component, which manages journal buffers, does not correctly account for busy checkpoint buffers. This oversight can cause the shrinker to hold a critical system lock for an extended period when processing many busy buffers. The prolonged...

CVE-2026-89559

A flaw was found in the Linux kernel's libnvdimm/labels component. An integer overflow vulnerability exists in the ndlabelvalidate function, where a 32-bit calculation of a namespace index field nslot can wrap around. This allows a local attacker, or an attacker with control over the storage...