PT-2026-94443

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the fuse implementation where the fuse uring cmd function fails to refuse IORING OP URING CMD requests if the connection was not enabled due to a missing FUSE OVER IO...

CVE-2026-93151: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...

PT-2026-94818

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA core component. When accessing a Shared Receive Queue SRQ via the netlink path, the synchronization relies on rdma restrack get. Because rdma...

PT-2026-94948

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-apple driver where the apple nvme init queue function initializes queue state and marks the queue as enabled. The interrupt and request paths check the enable...

PT-2026-94723

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt76 wifi driver where the mt76 tx queue skb function overrides the wireless client identifier wcid passed by the driver. This causes the non aql packets counter t...

CVE-2026-90229: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

DEBIAN-CVE-2026-89894

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

AZL-101478 CVE-2026-89894 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

CVE-2026-89811

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

DEBIAN-CVE-2026-89811

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

AZL-101690 CVE-2026-89811 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

CVE-2026-89955

A NULL pointer dereference vulnerability exists in the Linux kernel's s390/vfio-ap module. The race occurs when vfio_ap_mdev_probe_queue() creates the sysfs attribute group before the queue's driver data is set; a concurrent read of the status attribute then retrieves NULL via dev_get_drvdata() a...

CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-89894 media: cx231xx: reject geometry changes while the VBI queue is busy

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

EUVD-2026-80494

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

CVE-2026-89894

CVE-2026-89894 is a heap out-of-bounds write in the Linux kernel cx231xx media driver. The vulnerability arises because vidioc_s_fmt_vid_cap() and vidioc_s_std() can change the device-wide geometry (dev->width/dev->norm) while only checking whether the video queue is busy, not the VBI queue...

CVE-2026-89894 media: cx231xx: reject geometry changes while the VBI queue is busy

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

EUVD-2026-80411

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

CVE-2026-89811

CVE-2026-89811 affects the Linux kernel in the drm/amdkfd subsystem (AMD KFD driver). The MES (Micro Engine Scheduler) fails to perform a heavy-weight TLB invalidation after unmapping GPU queues—unlike HWS, which does so automatically. This creates a race condition where in-flight DMA descriptors...

CVE-2026-89811 drm/amdkfd: Add TLB flush after MES queue eviction/suspension

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...