CVE-2026-89855

CVE-2026-89855 affects the qla2xxx SCSI driver in the Linux kernel. The "update cache versions without reset" sysfs reset operation (0x20261) calls get_flash_version() to read hardware flash registers without holding ha->optrom_mutex , allowing it to interleave with concurrent VPD or optrom fl...

CVE-2026-89844

CVE-2026-89844 is a locking race in the Linux kernel qla2xxx SCSI driver. In qla24xx_report_id_acquisition(), the format-1 path drops vport_slock after taking the vport reference and then calls qla_update_host_map() without holding the lock. That function mutates the ha->host_map btree via btr...

EUVD-2026-80444

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap without the lock. That...

CVE-2026-89844 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap without the lock. That...

CVE-2026-89844 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap without the lock. That...

CVE-2026-89836 f2fs: fix folio_nr_pages() race after put in large folio invalidate

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

CVE-2026-89836 f2fs: fix folio_nr_pages() race after put in large folio invalidate

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

EUVD-2026-80436

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

CVE-2026-89836

CVE-2026-89836 is a race condition in the Linux kernel's f2fs filesystem driver. The root cause is that f2fs_get_read_data_folio() calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio, dropping the reference and releasing the folio lock before the page count is read. A c...

CVE-2026-89833 f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fsfsyncnodepages There is potential deadloop in race condition: Thread A Thread B - fsync - f2fsdosyncfile - f2fsfsyncnodepages - lastfsyncdnode - foliogetlastfolio - f2fssetattr -...

EUVD-2026-80433

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fsfsyncnodepages There is potential deadloop in race condition: Thread A Thread B - fsync - f2fsdosyncfile - f2fsfsyncnodepages - lastfsyncdnode - foliogetlastfolio - f2fssetattr -...

CVE-2026-89833 f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fsfsyncnodepages There is potential deadloop in race condition: Thread A Thread B - fsync - f2fsdosyncfile - f2fsfsyncnodepages - lastfsyncdnode - foliogetlastfolio - f2fssetattr -...

CVE-2026-89833

CVE-2026-89833 affects the Linux kernel's f2fs filesystem driver. The vulnerability is a race condition in f2fs_fsync_node_pages(): when one thread performs an fsync while another concurrently executes a truncate via f2fs_setattr, the truncate can set folio->mapping = NULL. This causes is_node...

EUVD-2026-80431

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect criticaltaskpriority updates with sumount The sysfs store path already takes sumount for GC thread control entries, and ckptthreadioprio is covered as well. criticaltaskpriority also updates checkpoint or GC kthread...

CVE-2026-89831

CVE-2026-89831 affects the f2fs filesystem in the Linux kernel. The critical_task_priority sysfs attribute updates checkpoint or GC kthread scheduling state but was not serialized with the s_umount lock, unlike the similar GC thread control entries and ckpt_thread_ioprio . This omission allows a ...

CVE-2026-89831 f2fs: protect critical_task_priority updates with s_umount

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect criticaltaskpriority updates with sumount The sysfs store path already takes sumount for GC thread control entries, and ckptthreadioprio is covered as well. criticaltaskpriority also updates checkpoint or GC kthread...

CVE-2026-89831 f2fs: protect critical_task_priority updates with s_umount

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect criticaltaskpriority updates with sumount The sysfs store path already takes sumount for GC thread control entries, and ckptthreadioprio is covered as well. criticaltaskpriority also updates checkpoint or GC kthread...

CVE-2026-89823

CVE-2026-89823 is a race condition in the Linux kernel's DRM subsystem . When drm_dev_register() partially fails (e.g., the render minor registers but the primary minor fails), the unplugged flag is never set. This allows userspace to enter a drm_dev_enter() critical section on the already-regist...

CVE-2026-89823 drm: fix race between partial drm_dev_register() failure and ioctl

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...

CVE-2026-89823 drm: fix race between partial drm_dev_register() failure and ioctl

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...