CVE-2026-89751 x86/tdx: Fix off-by-one in port I/O handling

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89751 x86/tdx: Fix off-by-one in port I/O handling

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89581 bpf, x86: Fix per-CPU address resolution into an extended register

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89581 bpf, x86: Fix per-CPU address resolution into an extended register

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

EUVD-2026-76493

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89581

A BPF x86 JIT flaw in the Linux kernel causes incorrect per-CPU address resolution when the destination is an extended register (R5–R9). The root cause is an encoding error: the REX prefix is built with add_1mod() (setting REX.B) instead of add_2mod() (setting REX.R), so the high register bit is ...

CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

EUVD-2026-76491

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

CVE-2026-89579

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

CVE-2026-89443 platform/x86: ISST: Validate level in perf mask ioctls

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

CVE-2026-89439

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sstinst To be consistent with other places, add a NULL check for failed socket loading by checking isstcommon.sstinst...

CVE-2026-89438 platform/x86: ISST: Validate logical CPU id and clos id

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

EUVD-2026-76345

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sstinst To be consistent with other places, add a NULL check for failed socket loading by checking isstcommon.sstinst...

CVE-2026-89438

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-89439 platform/x86: ISST: Add a NULL check for sst_inst[]

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sstinst To be consistent with other places, add a NULL check for failed socket loading by checking isstcommon.sstinst...

CVE-2026-89438

This CVE affects the Linux kernel 's platform/x86: ISST (Intelligent Speed and Frequency Tuning Technology) driver. The root cause is a missing validation of the maximum CLOS ID and logical CPU ID for the core power feature. These values are used to calculate MMIO offsets , so an out-of-range val...

CVE-2026-81013 platform/x86: hp-bioscfg: fix heap OOB read on empty password write

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81013

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81018: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Free system certificate signatures Multi-certificate support also allows the system authentication object to store -signature and -savesignature, which leak when the driver is removed. Free the signatures...

PT-2026-96480

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst if get perf level mask and isst if get base freq mask use the user-provided level as an index into perf levels via read pp level info and read bf level info, but neither...