CVE-2026-89506

CVE-2026-89506 affects the Linux kernel RDMA/uverbs subsystem. The root cause is a missing UVERBS_ATTR_UHW attribute in the UVERBS_METHOD_REG_MR ioctl definition. Three drivers—mthca , irdma , and siw —associate UHW data with reg_mr but assume the udata pointer is non-NULL. Because the attribute ...

CVE-2026-89505 RDMA/uverbs: Guard legacy bundles without method_elm

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...

CVE-2026-89460 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

CVE-2026-89460 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

CVE-2026-89460

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

EUVD-2026-76366

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

CVE-2026-89457 s390/dasd: Guard sysfs discipline callbacks against unallocated private data

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device-private, either directly or through the DASDDEFINEATTR macro. Duri...

CVE-2026-89457

CVE-2026-89457 affects the s390/dasd subsystem in the Linux kernel. During dasd_generic_set_online(), a device's discipline is assigned before check_device() allocates device->private. Several sysfs show/store handlers dereference this pointer without a null check, so an unprivileged read of a...

CVE-2026-89457 s390/dasd: Guard sysfs discipline callbacks against unallocated private data

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device-private, either directly or through the DASDDEFINEATTR macro. Duri...

CVE-2026-89457

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device-private, either directly or through the DASDDEFINEATTR macro. Duri...

EUVD-2026-76357

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

CVE-2026-89451

CVE-2026-89451 is a race condition in the Linux kernel 's iommu/sva subsystem. iommu_attach_device_pasid() installs the SVA attach handle into the group PASID lookup before iommu_sva_bind_device() returns, allowing a concurrent bind to find and reuse the handle after iommu_sva_lock is dropped. Ho...

CVE-2026-89451

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

CVE-2026-89442 platform/x86: ISST: Validate socket ID in clos_assoc ioctl

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89439 platform/x86: ISST: Add a NULL check for sst_inst[]

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sstinst To be consistent with other places, add a NULL check for failed socket loading by checking isstcommon.sstinst...

CVE-2026-81005

CVE-2026-81005 affects the Linux kernel IPMI SI driver (ipmi_si). When BMC registration fails—typically because the BMC does not return a successful response to the Get Device ID command—the shutdown_smi() callback frees the si_sm pointer and sets it to NULL , but the intf->in_shutdown flag is...

EUVD-2026-76328

In the Linux kernel, the following vulnerability has been resolved: ipmi: si: Fix NULL pointer dereference after failed registration trysmiinit allocates newsmi-sism and later calls ipmiregistersmimod, which maps to ipmiaddsmi. During ipmiaddsmi, the upper IPMI message handler obtains the initial...

CVE-2026-81005

In the Linux kernel, the following vulnerability has been resolved: ipmi: si: Fix NULL pointer dereference after failed registration trysmiinit allocates newsmi-sism and later calls ipmiregistersmimod, which maps to ipmiaddsmi. During ipmiaddsmi, the upper IPMI message handler obtains the initial...

CVE-2026-81005 ipmi: si: Fix NULL pointer dereference after failed registration

In the Linux kernel, the following vulnerability has been resolved: ipmi: si: Fix NULL pointer dereference after failed registration trysmiinit allocates newsmi-sism and later calls ipmiregistersmimod, which maps to ipmiaddsmi. During ipmiaddsmi, the upper IPMI message handler obtains the initial...

CVE-2026-81005 ipmi: si: Fix NULL pointer dereference after failed registration

In the Linux kernel, the following vulnerability has been resolved: ipmi: si: Fix NULL pointer dereference after failed registration trysmiinit allocates newsmi-sism and later calls ipmiregistersmimod, which maps to ipmiaddsmi. During ipmiaddsmi, the upper IPMI message handler obtains the initial...