CVE-2026-89684

A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOADCANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a denial of service DoS by causing the server to crash...

CVE-2026-89686

A flaw was found in the Linux kernel's Network File System Daemon nfsd for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service DoS. This occurs when the nfsd4alloclayoutstateid function accesses a file pointer without proper locking...

CVE-2026-89660

A flaw was found in the Linux kernel's Network File System Daemon NFSD. This vulnerability, a use-after-free, occurs during the revocation of client administrative states. A race condition can allow a client's memory to be freed prematurely while still being referenced, potentially leading to...

CVE-2026-89654

A flaw was found in the Ceph file system component of the Linux kernel. A race condition exists in the checknewmap function during session handling. This allows a local attacker to exploit a use-after-free vulnerability by freeing a session while another thread attempts to access it. This could...

CVE-2026-89553

A flaw was found in the Linux kernel's nouveau/gem component. A race condition exists where the graphics execution manager GEM close path can close a virtual memory area VMA while an information lookup is still trying to access it. This timing issue leads to a use-after-free vulnerability, which...

CVE-2026-80994

A flaw was found in the Open vSwitch component of the Linux kernel. A local attacker could exploit a use-after-free vulnerability during flow deletion. This occurs due to a race condition where the flow mask is freed prematurely, allowing subsequent operations to access deallocated memory...

CVE-2026-80952

A flaw was found in the Linux kernel's i3c master component. During device unregistration, a race condition can occur where the device descriptor is prematurely cleared. This can lead to an information leak, exposing kernel stack contents in the generated modalias. Additionally, this flaw could...

CVE-2026-89569

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. This vulnerability arises because the system does not properly manage memory when handling Bluetooth security confirmations. A race condition allows a part of the system to free memory that is still in use by another part, leading...

CVE-2026-89503

A flaw was found in the Linux kernel's ring-buffer component. A race condition exists in the ringbufferallocreadpage function when it interacts with ringbuffersubbuforderset. This can lead to an incorrect memory allocation where the buffer page's order bpage-order does not match the actual...

DEBIAN-CVE-2026-89771

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...

CVE-2026-89771

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...

DEBIAN-CVE-2026-89764

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

DEBIAN-CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89764

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

AZL-100536 CVE-2026-89752 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mm: memcg: stop reclaim when a limit update is superseded kernfs serializes file operations only per open file, so separate open files can update the same memory.high or memory.max file concurrently. Both handlers store the new...

CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

DEBIAN-CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

CVE-2026-89719

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in readblockstate readblockstate calculates nrpages before taking devlock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nrpages still describes the old...

UBUNTU-CVE-2026-89771

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...

UBUNTU-CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...