CVE-2026-89772

CVE-2026-89772 affects the btrfs filesystem in the Linux kernel . A patch (commit 095be159f3eb) replaced the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a plain folio_test_dirty() check, losing the write-protection of shared mmap PTEs during data writeback. Without this pro...

CVE-2026-89772 btrfs: write-protect folios during data writeback

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

CVE-2026-89772 btrfs: write-protect folios during data writeback

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

CVE-2026-89706

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CBOFFLOAD after the worker kthread completes. When the post-copy vfsfsyncrange or...

EUVD-2026-76616

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89704

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89704

CVE-2026-89704 affects the nfsd (NFS server) component of the Linux kernel . The root cause is that _nfsd_copy_file_range() samples the writeback error cursor (dst->f_wb_err) after the copy loop rather than before it. Because the nfsd_file cache reuses a single struct file across requests on t...

CVE-2026-89704 nfsd: sample writeback error cursor before async COPY loop

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89704 nfsd: sample writeback error cursor before async COPY loop

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89646

CVE-2026-89646 is a leaked inode reference bug in the Ceph filesystem component of the Linux kernel. When a writeback is aborted during unmount (because ceph_inc_osd_stopping_blocker() fails), the ihold() taken by ceph_dirty_folio() is never released via writepages_finish(), so i_wrbuffer_ref nev...

CVE-2026-89646 ceph: fix leaked inode reference on writeback abort at umount

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

CVE-2026-89646 ceph: fix leaked inode reference on writeback abort at umount

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

EUVD-2026-76558

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

CVE-2026-89646

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

EUVD-2026-76281

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-80958 dm-pcache: clamp the tail kset read to the segment data region

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

PT-2026-90420

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd copy file range function where the dst-f wb err value is sampled into the since variable after the copy loop. Because the nfsd file cache reuses a single file...

CVE-2026-89646: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

PT-2026-90088

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the dm-pcache module where the tail-kset read in the cache replay function, the writeback worker, and the GC worker bounds its length by the raw segment size PCACHE SEG SI...

CVE-2026-89706: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CBOFFLOAD after the worker kthread completes. When the post-copy vfsfsyncrange or...