EUVD-2026-80620

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...

CVE-2026-90012 spi: Fix DMA mapping ownership on partial map failure

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...

CVE-2026-90012

CVE-2026-90012 is a Linux kernel SPI bug in DMA mapping ownership on partial map failure. When RX mapping fails after TX mapping succeeds, __spi_map_msg() unmaps TX but leaves tx_sg_mapped set, and cur_{tx,rx}_dma_dev are not yet updated. The subsequent spi_unmap_msg() can then double-free a TX m...

CVE-2026-90012 spi: Fix DMA mapping ownership on partial map failure

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...

CVE-2026-89993 dmaengine: dw-edma: Initialize IRQ data before requesting IRQs

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...

CVE-2026-89993 dmaengine: dw-edma: Initialize IRQ data before requesting IRQs

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...

EUVD-2026-80601

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...

CVE-2026-89993

CVE-2026-89993 affects the Linux kernel in the dmaengine dw-edma driver. The root cause is an initialization-order bug: dw_edma_irq_request() passes struct dw_edma_irq to request_irq() before dw_edma_channel_setup() fills the back pointer. As a result, a shared interrupt can enter the handler wit...

EUVD-2026-80566

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as a fallback to allocate from all nodes. If order is gigantic,...

CVE-2026-89966

CVE-2026-89966 affects the Linux kernel in the mm/hugetlb_cma subsystem. The root cause is a NULL nodemask dereference in hugetlb_cma_alloc_frozen_folio(): when alloc_buddy_hugetlb_folio_with_mpol() passes a NULL nodemask as a fallback for gigantic (e.g., 1 GB) hugepage allocations, the function ...

EUVD-2026-80563

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89963

CVE-2026-89963 affects the Linux kernel in the powerpc/kexec_file subsystem. A potential NULL pointer dereference exists in the function kexec_extra_fdt_size_ppc64() : on platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving the pointer 'rmem' unal...

CVE-2026-89963 powerpc/kexec_file: Fix null-ptr-def in extra size calculation

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89958

This vulnerability affects the Linux kernel 's s390/vfio-ap driver. The root cause is a NULL pointer dereference : the vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete callback functions acquire the matrix_mdev->kvm->lock mutex without first checking whether matrix_mdev->kvm is NULL. ...

EUVD-2026-80558

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...

CVE-2026-89958 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...

CVE-2026-89955

A NULL pointer dereference vulnerability exists in the Linux kernel's s390/vfio-ap module. The race occurs when vfio_ap_mdev_probe_queue() creates the sysfs attribute group before the queue's driver data is set; a concurrent read of the status attribute then retrieves NULL via dev_get_drvdata() a...

CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

EUVD-2026-80555

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...