CVE-2026-89952 mtd: rawnand: validate ONFI extended parameter page sections

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

CVE-2026-89952 mtd: rawnand: validate ONFI extended parameter page sections

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

EUVD-2026-80552

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

CVE-2026-89951

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

CVE-2026-89951

CVE-2026-89951 affects the batman-adv module in the Linux kernel. During fragment reassembly, the skb from the highest-numbered buffered fragment is reused as the merged packet. If that fragment was received on a hard interface that is deleted before reassembly completes, the merged skb re-enters...

CVE-2026-89951 batman-adv: fix stale receive device on merged fragments

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

CVE-2026-89879 media: s2255: bound JPEG frame size before copying into the buffer

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

CVE-2026-89879

This Linux kernel vulnerability affects the s2255 media driver. In s2255_fillbuff(), a memcpy() copies vc->jpg_size bytes of a captured JPEG/MJPEG frame into a vb2 plane, but the size value is taken verbatim from the device's S2255_MARKER_FRAME header without being bounded against the destinat...

CVE-2026-89879

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

EUVD-2026-80479

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

CVE-2026-89879 media: s2255: bound JPEG frame size before copying into the buffer

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

CVE-2026-89834 f2fs: fix to migrate all curseg types during free_segment_range

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

CVE-2026-89834

CVE-2026-89834 affects the f2fs filesystem in the Linux kernel. In free_segment_range(), the curseg evacuation loop only iterated up to NR_CURSEG_PERSIST_TYPE (0–5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC . Although these types are n...

EUVD-2026-80434

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

CVE-2026-89834

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

CVE-2026-89834 f2fs: fix to migrate all curseg types during free_segment_range

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

EUVD-2026-80418

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...

CVE-2026-89818 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...

CVE-2026-89818

CVE-2026-89818 is an integer overflow in the Linux kernel's drm/amdgpu/vcn driver, specifically in the dec_msg buffer count check. If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2, causing the bounds check to pass and allowing the parser loop to re...

CVE-2026-89818

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...