EUVD-2026-76684

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

CVE-2026-89772 btrfs: write-protect folios during data writeback

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

CVE-2026-89768 fs: fix user path of nested backing files

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backingfileopen derives the path to be stored in the new backing file from userfile-fpath. This is incorrect when userfile itself is a backing file, which is the case for nested stacking...

CVE-2026-89768

CVE-2026-89768 is a Linux kernel bug in the backing_file_open() function affecting nested stacking filesystems (overlayfs, FUSE passthrough, EROFS ishare). When a user file is itself a backing file (e.g., overlayfs stacked on overlayfs), the function incorrectly derives the stored path from user_...

EUVD-2026-76680

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backingfileopen derives the path to be stored in the new backing file from userfile-fpath. This is incorrect when userfile itself is a backing file, which is the case for nested stacking...

CVE-2026-89764 rust: devres: fix race between concurrent revokers

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

CVE-2026-89764

CVE-2026-89764 addresses a race condition in the Linux kernel's Rust devres (device resource management) subsystem. When two paths concurrently attempt to revoke a Devres—the driver core's devres_release_all() calling Revocable::revoke() and Devres::drop() calling revoke_nosync() on another CPU—o...

EUVD-2026-76676

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

CVE-2026-89760

A flaw in the Linux kernel 's mm, swap subsystem where swap_free_hibernation_slot() unconditionally calls __swap_cluster_free_entries() without first checking whether a folio resides on the slot in the swap cache. Cluster readahead can place a folio on a hibernation slot; freeing the slot then cl...

CVE-2026-89760 mm, swap: don't free a hibernation slot that is in the swap cache

In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in the swap cache A slot with a folio in the swap cache is freed when the folio leaves the cache, not when its count drops. swapputentriescluster follows that rule...

EUVD-2026-76672

In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in the swap cache A slot with a folio in the swap cache is freed when the folio leaves the cache, not when its count drops. swapputentriescluster follows that rule...

CVE-2026-89758

CVE-2026-89758 affects the Linux kernel mm/mempolicy subsystem. The root cause is in queue_folios_pmd(), which is called under pmd_trans_huge_lock(). Since pmd_is_huge() returns true for any non-present, non-none PMD (including device-private swap entries left by HMM-based GPU drivers ), a bogus ...

CVE-2026-89758 mm/mempolicy: skip non-present PMDs when queueing folios

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe "mm/hugememory: add device-private THP support to PMD operations" a PMD may...

EUVD-2026-76670

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe "mm/hugememory: add device-private THP support to PMD operations" a PMD may...

CVE-2026-89746 tracing: Fix use-after-free with same-name named triggers

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...

EUVD-2026-76658

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...

CVE-2026-89746

CVE-2026-89746 is a use-after-free in the Linux kernel's tracing subsystem , specifically in the hist trigger path. When two hist triggers on different events are registered with the same name=, the second reuses the first's named_data. Both entries are added to tr->hist_vars, but hist_registe...

CVE-2026-89738 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle: at91vbustimer schedules vbustimerwork, and at91vbustimerwork calls...

CVE-2026-89738

CVE-2026-89738 is a use-after-free vulnerability in the Linux kernel's at91_udc USB gadget driver. In polled-VBUS mode, a self-restarting timer and work-item cycle is armed during driver probe but never cancelled on teardown (driver unbind or probe failure). Because the udc struct is devm-allocat...

EUVD-2026-76650

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle: at91vbustimer schedules vbustimerwork, and at91vbustimerwork calls...