CVE-2026-89455

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown pldapcieirqdomaindeinit removes pcie-eventdomain via irqdomainremove, but the per-event IRQs mapped from that domain are requested with devmrequestirq in...

CVE-2026-89452

In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msmiommuprobe adds its devm-managed IOMMU object to qcomiommudevices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommudevicesysfsadd fails,...

CVE-2026-81006

In the Linux kernel, the following vulnerability has been resolved: ipmi: Remove all sysfs files on registration failure ipmiaddsmi creates the nrusers and nrmsgs files before trying to create the maintenancemode file. If that last creation fails, the error path removes only nrusers before droppi...

CVE-2026-89739 usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

EUVD-2026-76580

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89658 NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40cleanadminrevoked takes a stateid reference under clp-cllock, drops nn-clientlock, and calls nfsd4droprevokedstid, which dereferences the stateid's...

CVE-2026-89658 NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40cleanadminrevoked takes a stateid reference under clp-cllock, drops nn-clientlock, and calls nfsd4droprevokedstid, which dereferences the stateid's...

EUVD-2026-76570

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40cleanadminrevoked takes a stateid reference under clp-cllock, drops nn-clientlock, and calls nfsd4droprevokedstid, which dereferences the stateid's...

CVE-2026-89658

CVE-2026-89658 is a use-after-free vulnerability in the Linux kernel's NFSD (Network File System Daemon) during NFSv4.0 revoked-state cleanup . The function nfs40_clean_admin_revoked() drops nn->client_lock and then calls nfsd4_drop_revoked_stid(), which dereferences the client via s->sc_cl...

CVE-2026-89645 btrfs: drop recovered reloc root refs on recovery failure

In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails,...

CVE-2026-89626

CVE-2026-89626 affects the Linux kernel's HID sensor custom driver (hid_sensor_custom). In hid_sensor_custom_add_attributes(), if sysfs_create_group() fails after some groups are already created, the function returns the error without removing previously created groups . The fix adds a local unwi...

CVE-2026-89626

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

EUVD-2026-76538

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

CVE-2026-89626 HID: sensor: custom: Fix field sysfs group cleanup on failure

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

CVE-2026-89626 HID: sensor: custom: Fix field sysfs group cleanup on failure

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

EUVD-2026-76503

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

CVE-2026-89591

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

CVE-2026-89591 accel/rocket: initialize job domain before cleanup paths

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

CVE-2026-89572 cpufreq: apple-soc: Fix OPP table cleanup

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup applesoccpufreqinit adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses devpmoppremovealldynamic, which is not the right cleanup helper for OPP...

CVE-2026-89572 cpufreq: apple-soc: Fix OPP table cleanup

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup applesoccpufreqinit adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses devpmoppremovealldynamic, which is not the right cleanup helper for OPP...