UBUNTU-CVE-2026-89791

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

UBUNTU-CVE-2026-89789

In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronizenet in gtpnewlink error path to prevent use-after-free gtpnewlink's error path frees tidhash and addrhash without waiting for an RCU grace period after clearing skuserdata. A concurrent gtpencaprecv in softirq...

UBUNTU-CVE-2026-89774

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

EUVD-2026-80312

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

CVE-2026-89791

CVE-2026-89791 is a use-after-free race condition in the Linux kernel's perf subsystem . The root cause is that perf_mmap_close() drops rb->mmap_count without holding event->mmap_mutex, allowing a concurrent perf_mmap_rb() revival path to free a newly allocated ring buffer that another proc...

CVE-2026-89791

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

CVE-2026-89791 perf: Fix use-after-free when perf mmap() revival races with the last munmap()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

CVE-2026-89791 perf: Fix use-after-free when perf mmap() revival races with the last munmap()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

CVE-2026-89788

CVE-2026-89788 is a use-after-free vulnerability in the Linux kernel's ksmbd (SMB server) subsystem, specifically in smb2_tree_connect() (fs/smb/server/smb2pdu.c). A race condition exists where ksmbd_tree_conn_connect() publishes a new tree connection with a single reference, but a concurrent ses...

CVE-2026-89788 ksmbd: fix tree connection use-after-free in smb2_tree_connect()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...

EUVD-2026-80309

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...

CVE-2026-89788

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...

CVE-2026-89789

In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronizenet in gtpnewlink error path to prevent use-after-free gtpnewlink's error path frees tidhash and addrhash without waiting for an RCU grace period after clearing skuserdata. A concurrent gtpencaprecv in softirq...

CVE-2026-89788 ksmbd: fix tree connection use-after-free in smb2_tree_connect()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...

CVE-2026-89789

This use-after-free vulnerability affects the Linux kernel GTP (GPRS Tunneling Protocol) module . In gtp_newlink()'s error path, tid_hash and addr_hash are freed without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq context can still hold a ...

CVE-2026-89789 gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronizenet in gtpnewlink error path to prevent use-after-free gtpnewlink's error path frees tidhash and addrhash without waiting for an RCU grace period after clearing skuserdata. A concurrent gtpencaprecv in softirq...

EUVD-2026-80310

In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronizenet in gtpnewlink error path to prevent use-after-free gtpnewlink's error path frees tidhash and addrhash without waiting for an RCU grace period after clearing skuserdata. A concurrent gtpencaprecv in softirq...

CVE-2026-89789 gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronizenet in gtpnewlink error path to prevent use-after-free gtpnewlink's error path frees tidhash and addrhash without waiting for an RCU grace period after clearing skuserdata. A concurrent gtpencaprecv in softirq...

CVE-2026-89787

This vulnerability affects the Linux kernel's ext4 filesystem in ext4_search_dir() (fs/ext4/namei.c). For casefolded encrypted directories , ext4 stores an 8-byte hash trailer after the directory entry name. The pre-check in ext4_search_dir() only verifies that the name fits within the block boun...

CVE-2026-89787 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4searchdir For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name EXT4DIRENTHASHES, at an offset derived from de-namelen. On the...