EUVD-2026-80310

In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronizenet in gtpnewlink error path to prevent use-after-free gtpnewlink's error path frees tidhash and addrhash without waiting for an RCU grace period after clearing skuserdata. A concurrent gtpencaprecv in softirq...

CVE-2026-89787 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4searchdir For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name EXT4DIRENTHASHES, at an offset derived from de-namelen. On the...

CVE-2026-89787 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4searchdir For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name EXT4DIRENTHASHES, at an offset derived from de-namelen. On the...

EUVD-2026-80308

In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4searchdir For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name EXT4DIRENTHASHES, at an offset derived from de-namelen. On the...

EUVD-2026-80306

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEXROOT in reparse/objid init ntfsreparseinit and ntfsobjidinit parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles the INDEXROOT attributes named $R and $O. They read i...

CVE-2026-89786

In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4readinlinedir ext4readinlinedir can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64: BUG: KASAN: slab-out-of-bounds in...

EUVD-2026-80307

In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4readinlinedir ext4readinlinedir can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64: BUG: KASAN: slab-out-of-bounds in...

CVE-2026-89785 fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEXROOT in reparse/objid init ntfsreparseinit and ntfsobjidinit parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles the INDEXROOT attributes named $R and $O. They read i...

CVE-2026-89786 ext4: fix out-of-bounds read in ext4_read_inline_dir()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4readinlinedir ext4readinlinedir can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64: BUG: KASAN: slab-out-of-bounds in...

CVE-2026-89786 ext4: fix out-of-bounds read in ext4_read_inline_dir()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4readinlinedir ext4readinlinedir can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64: BUG: KASAN: slab-out-of-bounds in...

CVE-2026-89786

CVE-2026-89786 is an out-of-bounds read in the Linux kernel's ext4 filesystem, specifically in ext4_read_inline_dir(). The dirent buffer is allocated as inline_size bytes, but directory iteration operates in a larger position space (extra_size). Because ext4_check_dir_entry() is called with extra...

CVE-2026-89784

CVE-2026-89784 affects the Linux kernel SUNRPC subsystem. The functions rpcb_register_inet4() and rpcb_register_inet6() store the result of rpc_sockaddr2uaddr() into map->r_addr without checking for NULL . When the final kstrdup() inside rpc_sockaddr2uaddr() fails under memory pressure , the u...

CVE-2026-89784 SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2026-89784 SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

EUVD-2026-80305

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2026-89783 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...

CVE-2026-89782

CVE-2026-89782 affects the Linux kernel's ntfs3 filesystem driver (fs/ntfs3). During $LogFile replay , log_replay() uses transact_id from a log record header as an index into the restart table without checking its magnitude. When the resulting growth request exceeds U16_MAX , the count is truncat...

CVE-2026-89782 fs/ntfs3: reject restart table growth beyond U16_MAX entries

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16MAX entries During $LogFile replay, logreplay indexes the transaction table by the transactid taken from the log record header. checklogrec only verifies that transactid is non-zero...

CVE-2026-89783 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...

CVE-2026-89783

CVE-2026-89783 is an out-of-bounds write in the Linux kernel's xfrm6_input_addr() function (net/ipv6/xfrm6_input.c). An off-by-one in the depth check (1 + sp->len == XFRM_MAX_DEPTH instead of >=) allows a write to index 6 of a 6-element xvec[] array when the security path is already at maxi...