CVE-2026-89626

A flaw was found in the Linux kernel's Human Interface Device HID sensor custom driver. When creating sysfs groups for custom sensor fields, the hidsensorcustomaddattributes function fails to properly clean up previously created groups if an error occurs. This improper resource management could...

CVE-2026-89593

A flaw was found in the Linux kernel's huge page hugetlb subsystem. This vulnerability occurs when a huge page of memory is shared between a parent and a child process. If the parent process unmaps the huge page before the child, the system can incorrectly reduce the count of reserved huge pages...

CVE-2026-89555

A flaw was found in the Linux kernel's Multiprotocol Label Switching MPLS subsystem. When processing specially crafted Geneve packets through an MPLS multipath setup, a use-after-free vulnerability occurs. This issue arises because a cached header pointer hdr is not reloaded after pskbmaypull...

CVE-2026-89529

A flaw was found in the Linux kernel's svcrdma component, which handles Remote Procedure Call over Remote Direct Memory Access RPC/RDMA Read operations. This vulnerability occurs because the Read list decoder does not properly validate the lengths of incoming data segments. An attacker could send...

CVE-2026-89518

A flaw was found in the Linux kernel's schedext component. Under core scheduling, incorrect assumptions in dispatch kfuncs regarding thisrq can lead to a deadlock. This occurs when an rq lock is acquired on a CPU different from the dispatched rq's, potentially causing the system to become...

CVE-2026-89503

A flaw was found in the Linux kernel's ring-buffer component. A race condition exists in the ringbufferallocreadpage function when it interacts with ringbuffersubbuforderset. This can lead to an incorrect memory allocation where the buffer page's order bpage-order does not match the actual...

CVE-2026-89534

A flaw was found in the Linux kernel's svcrdma module. This vulnerability occurs when the system attempts to handle an RDMA Remote Direct Memory Access address change, and a critical memory allocation fails. This can lead to a 'use-after-free' error, where the system tries to access memory that h...

CVE-2026-89510

A flaw was found in the Linux kernel's RDMA/cxgb4 component. This vulnerability occurs when the c4iwremove function frees a device while its registration work regwork is still pending or actively running. This timing issue can lead to the c4iwregisterdevice function attempting to access memory th...

CVE-2026-89494

A flaw was found in ocfs2, a component of the Linux kernel. A remote attacker, by sending a specially crafted Distributed Lock Manager DLM migration message, could exploit a lack of validation in the dlmmiglockreshandler. This flaw allows for an out-of-bounds write to the heap, potentially leadin...

CVE-2026-80788

A flaw was found in the Linux kernel's nvmet-tcp component. A remote attacker can send a specially crafted command with an oversized Scatter-Gather List SGL allocation. This can lead to an excessive memory allocation, triggering a kernel warning. On systems configured to panic on warnings, this...

DEBIAN-CVE-2026-89727

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID vgicv2deactivate passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq, and treats a failed lookup as a "can't happen" condition with WARNONONCE. The gues...

CVE-2026-89727

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID vgicv2deactivate passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq, and treats a failed lookup as a "can't happen" condition with WARNONONCE. The gues...

CVE-2026-89744

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnodeforeachchildnode When iterate over children of a fwnode that has a secondary fwnode, fwnodegetnextchildnode can enter an infinite loop if the secondary fwnode has more than one child...

UBUNTU-CVE-2026-89727

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID vgicv2deactivate passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq, and treats a failed lookup as a "can't happen" condition with WARNONONCE. The gues...

CVE-2026-89699

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

DEBIAN-CVE-2026-89695

In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...

CVE-2026-89695

In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...

DEBIAN-CVE-2026-89685

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clientsstillreclaiming clientsstillreclaiming computes a deadline from nn-boottime CLOCKREALTIME, 1.7 billion but compares it against ktimegetboottimeseconds CLOCKBOOTTIME, seconds since boot. T...

AZL-100544 CVE-2026-89685 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clientsstillreclaiming clientsstillreclaiming computes a deadline from nn-boottime CLOCKREALTIME, 1.7 billion but compares it against ktimegetboottimeseconds CLOCKBOOTTIME, seconds since boot. T...

AZL-100455 CVE-2026-89686 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...