CVE-2026-89969 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmettcptryrecvpdu reads a PDU header into the fixed 128-byte queue-pdu union, then computes the remaining payload length as queue-left = hdr-hlen - queue-offset ...

EUVD-2026-80569

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmettcptryrecvpdu reads a PDU header into the fixed 128-byte queue-pdu union, then computes the remaining payload length as queue-left = hdr-hlen - queue-offset ...

CVE-2026-89967 mm/migrate_device: avoid out-of-bounds writes for compound folios

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: avoid out-of-bounds writes for compound folios migratedevicerange and migratedevicepfns clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compoun...

EUVD-2026-80567

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: avoid out-of-bounds writes for compound folios migratedevicerange and migratedevicepfns clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compoun...

CVE-2026-89967 mm/migrate_device: avoid out-of-bounds writes for compound folios

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: avoid out-of-bounds writes for compound folios migratedevicerange and migratedevicepfns clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compoun...

CVE-2026-89967

CVE-2026-89967 is an out-of-bounds write in the Linux kernel 's mm/migrate_device subsystem. The functions migrate_device_range() and migrate_device_pfns() clear entries following a compound folio to maintain page-granular PFN arrays, but fail to limit writes to the number of slots remaining in t...

CVE-2026-89965

CVE-2026-89965 affects the Linux kernel nvdimm/btt subsystem. The BTT info block's nfree field (number of reserve free blocks) is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size per-lane freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by la...

CVE-2026-89965 nvdimm/btt: reject an arena whose nfree is below the lane count

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. bttfreelistinit and bttrttinit size the per-lane...

EUVD-2026-80565

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. bttfreelistinit and bttrttinit size the per-lane...

CVE-2026-89965 nvdimm/btt: reject an arena whose nfree is below the lane count

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. bttfreelistinit and bttrttinit size the per-lane...

CVE-2026-89907 LoongArch: KVM: Validate MSI data before routing it to EIOINTC

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pchmsisetirq passes e-msi.data straight into eiointcsetirq as the irq number. The MSI data comes from userspace, that either via a KVMIRQROUTINGMSI entry set with...

EUVD-2026-80507

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pchmsisetirq passes e-msi.data straight into eiointcsetirq as the irq number. The MSI data comes from userspace, that either via a KVMIRQROUTINGMSI entry set with...

CVE-2026-89894

CVE-2026-89894 is a heap out-of-bounds write in the Linux kernel cx231xx media driver. The vulnerability arises because vidioc_s_fmt_vid_cap() and vidioc_s_std() can change the device-wide geometry (dev->width/dev->norm) while only checking whether the video queue is busy, not the VBI queue...

CVE-2026-89894 media: cx231xx: reject geometry changes while the VBI queue is busy

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

CVE-2026-89894 media: cx231xx: reject geometry changes while the VBI queue is busy

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

EUVD-2026-80494

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

CVE-2026-89879

This Linux kernel vulnerability affects the s2255 media driver. In s2255_fillbuff(), a memcpy() copies vc->jpg_size bytes of a captured JPEG/MJPEG frame into a vb2 plane, but the size value is taken verbatim from the device's S2255_MARKER_FRAME header without being bounded against the destinat...

CVE-2026-89879 media: s2255: bound JPEG frame size before copying into the buffer

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

EUVD-2026-80479

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

CVE-2026-89879 media: s2255: bound JPEG frame size before copying into the buffer

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...