CVE-2026-89659

A flaw was found in the Linux kernel's Network File System Daemon NFSD. This use-after-free vulnerability occurs during the delegation revoke process. When an expired delegation is unhashed, a timing window exists where the client can be prematurely freed before the revocation is complete. This c...

CVE-2026-89550

A flaw was found in the Linux kernel's SUNRPC svcauthgss module. A remote attacker could send a specially crafted Kerberos krb5 token with an insufficient length. This could lead to a division-by-zero error within the gsskrb5unwrapv2 function, resulting in a Denial of Service DoS for the affected...

CVE-2026-89538

A flaw was found in the Linux kernel's Server Unix Remote Procedure Call SUNRPC component. A remote attacker, with a valid Generic Security Service GSS context, could send a specially crafted Kerberos v2 wrap token with an oversized "extra count" ec field. This improper handling of malformed toke...

CVE-2026-89482

A flaw was found in the nvme-tcp module of the Linux kernel. This vulnerability arises from improper handling of C2HData for REQOPWRITEZEROES commands, where the system fails to adequately validate the data length. A remote attacker could exploit this by sending specially crafted C2HData, leading...

CVE-2026-89687

A flaw was found in the Linux kernel's Network File System Daemon nfsd. The nfsdfiledoacquire function might attempt to use a file that has not been fully opened, as the -atomicopen operation could return success prematurely. While this scenario is considered highly improbable, it could lead to...

CVE-2026-89684

A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOADCANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a denial of service DoS by causing the server to crash...

CVE-2026-89650

A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph monitor, or an on-path attacker, can send a specially crafted Metadata Server MDS map. This map, with an oversized numexporttargets field and a per-MDS info version of 2 or 3, can trigger an out-of-bounds read in...

CVE-2026-89631

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

CVE-2026-89560

A flaw was found in the Linux kernel's Landlock security module. This vulnerability allowed for the creation of 'whiteout' objects without proper permission checks. Whiteout objects are special files used in OverlayFS to hide underlying files, and their unauthorized creation could lead to...

CVE-2026-89537

A flaw was found in the Linux kernel's SUNRPC implementation, specifically within the gsskrb5verifymicv2 function. A remote malicious Network File System NFS server could provide a specially crafted, short Kerberos Message Integrity Code MIC token. This could lead to the kernel reading past an...

CVE-2026-89516

A flaw was found in the Linux kernel's schedext component. When a Deferred Scheduling Queue DSQ is destroyed, a pending deferred re-enqueue DRU operation might still attempt to access the destroyed DSQ. This can lead to a BUGON condition, causing a kernel panic and resulting in a Denial of Servic...

CVE-2026-89504

A flaw was found in the Linux kernel's regulator subsystem. This vulnerability arises from a programming error where a device tree node pointer is released too early, creating a "dangling pointer"—a reference to memory that is no longer valid. This can lead to system instability, potentially...

CVE-2026-89480

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

CVE-2026-89475

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the bq24257 power supply driver. This issue occurs when the STAT-pin interrupt handler attempts to reschedule work and access memory that has already been freed during the device removal process. This can lead to syste...

CVE-2026-89464

A flaw was found in the Linux kernel's twl4030charger driver. When the driver's remove function is called, it fails to properly cancel pending worker tasks. This oversight allows a worker to attempt to access memory that has already been deallocated, leading to a use-after-free vulnerability. A...

CVE-2026-89467

A flaw was found in the Linux kernel's qcombattmgr component. This flaw is a use-after-free vulnerability that occurs because the qcombattmgrpdrnotify function can queue enablework even after the associated battmgr object has been deallocated. A local attacker could exploit this by triggering the...

CVE-2026-89446

A flaw was found in the Linux kernel's iommufd component. When the system attempts to store an Input/Output Address Space IOAS object and the storage operation fails, the IOAS object's associated resources, such as its write lock and object reference, are not properly released. This oversight can...

CVE-2026-81010

A flaw was found in the Linux kernel's iouring/waitid component. The iowaitidcb function, when running from a kernel worker, fails to properly acknowledge task work cancellation. This oversight causes the dowait function to execute within an incorrect task context, which is critical as waitid...

CVE-2026-80981

A flaw was found in the Linux kernel's net/smc component. A local attacker could exploit a use-after-free vulnerability in the smcllcsrvaddlink function, where a freed memory region is improperly accessed. This can lead to memory corruption and potentially result in a denial of service DoS...

CVE-2026-80971

A flaw was found in the ALSA bcd2000 driver of the Linux kernel. When a USB device using this driver is disconnected while a rawmidi substream is still active, the driver fails to clear the Universal Serial Bus Request Block URB pointers. This oversight allows a local attacker to trigger a...