CVE-2026-89908

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVMMRFLAGSONLY kvmarchpreparememoryregion computes new-arch.flags, i.e. whether a memslot is KVMMEMHUGEPAGECAPABLE or KVMMEMHUGEPAGEINCAPABLE, only for KVMMRCREATE and KVMMRMOVE, and...

CVE-2026-89902

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

UBUNTU-CVE-2026-89869

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...

UBUNTU-CVE-2026-89876

In the Linux kernel, the following vulnerability has been resolved: media: tda18250: fix possible integer overflow Integer overflow may occur, when variable exp equals to zero. Result of shift 1 exp - 1 may then leads to undefined behavior...

UBUNTU-CVE-2026-89870

In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered videodevice twice zoraninitvideodevice installs zoranvdevrelease as the videodevice release callback through zorantemplate. After videoregisterdevice succeeds, videounregisterdevice drops...

UBUNTU-CVE-2026-89795

In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, which use a machine level hypervisor, PCI devices are always accessed through a form of PCI pass-through which fundamentally operates on a per PCI...

UBUNTU-CVE-2026-89797

In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500fg: fix use-after-free on remove ab8500fgremove destroys the driver workqueue while the threaded interrupt handlers are still armed; they are devm-managed and freed only after -remove returns, so a handler th...

UBUNTU-CVE-2026-89841

In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...

CVE-2026-89895

In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice sndcobaltcardcreate stores cobsc in sc-privatedata and installs sndcobaltcardprivatefree as sc-privatefree. From that point, sndcardfreesc releases cobsc through the ALSA card...

CVE-2026-89841

In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...

CVE-2026-89796

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamondmergeregions internal loop Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races", v1.1. Sashiko found a few issues in DAMON that could cause infinite loop, NULL...

CVE-2026-89800

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty and defers the teardown to nouveauuvmmbindjobcleanup; it does not remove the...

CVE-2026-89825

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthorinitcsiface and panthorinitcsgiface validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are...

CVE-2026-89823

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...

CVE-2026-89857

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

CVE-2026-89812

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-89811

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

CVE-2026-89803

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event before the fence context nouveauchanneldel tears the fence context down first and only drops the channel-kill subscription later, in the middle of the nvif object teardown: if...

CVE-2026-89804

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migration maps migration buffers with pagesize and records that length in dmainfo-size. For a compound folio pagesize is PAGESIZE 0 folio this...

CVE-2026-89809

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...