CVE-2026-89552 params: fix charp corruption on allocation failure

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure paramsetcharp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...

CVE-2026-89552 params: fix charp corruption on allocation failure

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure paramsetcharp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...

CVE-2026-89552

This Linux kernel vulnerability affects param_set_charp() in the kernel's params subsystem. The root cause is that the previous parameter value is freed before the replacement allocation succeeds; if kmalloc_parameter() fails, the parameter is left as NULL , leading to a kernel NULL pointer deref...

CVE-2026-89528

CVE-2026-89528 affects the Linux kernel's svcrdma (RPC-over-RDMA) server. Individual Read segment lengths are validated at decode time, but nothing prevents a remote requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page...

EUVD-2026-76434

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages arra...

CVE-2026-89528 svcrdma: Reject Read lists that exceed the page budget

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages arra...

CVE-2026-89528 svcrdma: Reject Read lists that exceed the page budget

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages arra...

CVE-2026-89528

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages arra...

CVE-2026-89511

CVE-2026-89511 is a NULL pointer dereference in the qede driver (QLogic 10GbE Ethernet) of the Linux kernel , leading to a kernel panic and Denial of Service (CVSS 3.1: 7.5 HIGH , AV:N/AC:L/PR:N). The root cause is a dropped assignment of tpa_info->buffer.data in qede_tpa_start(), introduced b...

CVE-2026-89511

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

CVE-2026-89511 qede: Fix NULL pointer dereference in TPA fragment processing

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

EUVD-2026-76417

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

CVE-2026-89511 qede: Fix NULL pointer dereference in TPA fragment processing

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

CVE-2026-89509

CVE-2026-89509 affects the Linux kernel 's RDMA/ionic driver . The root cause is that the ionic driver was merged without adapting to the rdma_zalloc_drv_obj() API introduced by commit 7e53b31acc7f, which requires drivers to embed struct rdma_counter in a driver-specific struct and register its s...

EUVD-2026-76415

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

CVE-2026-89509 RDMA/ionic: Embed counter driver data in rdma_counter allocation

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

CVE-2026-89509

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

CVE-2026-89509 RDMA/ionic: Embed counter driver data in rdma_counter allocation

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

CVE-2026-89506

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBSATTRUHW to UVERBSMETHODREGMR The original commit missed that three drivers mthca, irdma, siw have UHW data associated with regmr that cannot be passed through the ioctl. They also assume that the udata cann...

CVE-2026-89506

CVE-2026-89506 affects the Linux kernel RDMA/uverbs subsystem. The root cause is a missing UVERBS_ATTR_UHW attribute in the UVERBS_METHOD_REG_MR ioctl definition. Three drivers—mthca , irdma , and siw —associate UHW data with reg_mr but assume the udata pointer is non-NULL. Because the attribute ...