CVE-2026-89773 drm/amd/display: Skip Update HDCP Config In Transition State

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dmstreamctx that should skip configuring HDCP routine. The routine is valid to go through only when a valid stream is created...

CVE-2026-89773

CVE-2026-89773 affects the drm/amd/display driver in the Linux kernel. The root cause is that the HDCP configuration routine was being invoked during a transition state , in which no valid dm_stream_ctx exists. The fix skips updating HDCP configuration unless a valid stream has been created, as r...

EUVD-2026-76685

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dmstreamctx that should skip configuring HDCP routine. The routine is valid to go through only when a valid stream is created...

CVE-2026-89756 mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migratepagesbatch migratepagesbatch unmaps each folio before moving it, and every unmap runs the mmunotifier invalidate callbacks. On KVM hosts trytomigrate ends up in...

CVE-2026-89756 mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migratepagesbatch migratepagesbatch unmaps each folio before moving it, and every unmap runs the mmunotifier invalidate callbacks. On KVM hosts trytomigrate ends up in...

CVE-2026-89754

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walkpmdrange If -pmdentry sets walk-action = ACTIONAGAIN, the pmdnone check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk-ops-installpte is not...

CVE-2026-89754

A stale state bug in the Linux kernel's mm/pagewalk subsystem, specifically in walk_pmd_range(), allows a local attacker to trigger an out-of-bounds write in __mincore_unmapped_range via the mincore syscall. When walk->action is set to ACTION_AGAIN and the corresponding PMD entry is cleared be...

CVE-2026-89753

CVE-2026-89753 affects the Linux kernel in the memory management subsystem (mm/vmscan ). The root cause is that the scan loop in shrink_lruvec() only calls cond_resched(), which is a no-op on PREEMPTION kernels . Since involuntary preemption does not count as a Tasks-RCU quiescent state , a recla...

CVE-2026-89753 mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks quiescent states in shrinklruvec I am seeing some rcutasks stalls in the Meta fleet during reclaim. INFO: rcutasks detected stalls on tasks: 0000000088620d09: .. nvcsw: 6735/6735 holdout: 1 idlecpu: -1...

CVE-2026-89717

This vulnerability affects the Linux kernel's zram module. In zram_destroy_comps(), all compressors are reset to NULL , including the primary compressor , leaving the device in an invalid state. This can lead to a NULL pointer dereference when comp_algorithm_show() calls strcmp() on the NULL prim...

EUVD-2026-76629

In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zramdestroycomps Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported 1 a couple of zram issues: a possible BUGON in zlib code due to missing winbits rang...

CVE-2026-89717 zram: set default primary compressor in zram_destroy_comps()

In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zramdestroycomps Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported 1 a couple of zram issues: a possible BUGON in zlib code due to missing winbits rang...

CVE-2026-89692 nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

CVE-2026-89692

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

EUVD-2026-76604

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

CVE-2026-89692

CVE-2026-89692 is a denial-of-service vulnerability in the Linux kernel's nfsd (NFS daemon). When a delegation recall queue attempt fails, the NFSD4_CALLBACK_RUNNING flag is left permanently set because the only code path that clears it (nfsd41_destroy_cb) is unreachable in that scenario. This ca...

CVE-2026-89684 nfsd: fix cpntf publish race in nfs4_init_cp_state

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

CVE-2026-89684

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

CVE-2026-89663 nfsd: revoke copy-notify stateids before dropping their reference

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

CVE-2026-89660

CVE-2026-89660 is a use-after-free in the Linux kernel's NFSD (Network File System Daemon) subsystem, rated CVSS 9.8 (Critical) . The flaw arises in nfsd4_revoke_states(), which drops client_lock while dereferencing a client to revoke a stateid. A concurrent teardown can free the nfs4_client befo...