CVE-2026-89453 iommu/amd: Put PCI device after handling PPR faults

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

EUVD-2026-76334

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

CVE-2026-81011 platform/x86: hp-bioscfg: pass validated element count to package parsers

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

CVE-2026-81011

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

CVE-2026-81011 platform/x86: hp-bioscfg: pass validated element count to package parsers

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

CVE-2026-81011

CVE-2026-81011 affects the Linux kernel's hp-bioscfg platform driver (platform/x86). The per-type package parsers derive the element count from elements[0] (the ACPI NAME field, always a string) rather than the validated obj->package.count, causing them to bound against the name string length ...

PT-2026-90411

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd4 decode posixacl function where a u32 entry count is read from the wire and passed directly to posix acl alloc and sort pacl range. Because sort pacl range...

PT-2026-90309

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hugetlb component where the unmap hugepage range function can incorrectly adjust reservations. When a folio is mapped in both a parent and a child process, if the...

PT-2026-90423

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the nfsd cross mnt function when follow down returns a negative value. The function initializes a local path structure using mntget and dget, but fails to call...

PT-2026-96509

In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable folio handling sort folio has a shortcut for moving folios that are no longer evictable but are still sitting on a generation list. However, this shortcut is buggy. It does not follo...

CVE-2026-89471: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-89453: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

PT-2026-90141

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds heap read exists in the hp-bioscfg component of the x86 platform. The function hp init bios package attribute validates the obj-package.count but subsequently calls hp...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107276)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107276 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpudm initialize when stream nums greater than 6 Why Coverity reports...

PT-2026-90187

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab out-of-bounds write exists in the cros usbpd charger probe function. The issue occurs because the function uses num charger ports, a value reported by the Embedded Controller EC, ...

PT-2026-90186

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The cros usbpd-charger driver probe iterates based on the raw charger port count provided by the embedded controller. Because the driver only checks against the number of USB PD ports...

PT-2026-96445

In the Linux kernel, the following vulnerability has been resolved: mm/migrate device: clear stale mapping after freeing swapcache migrate device pages reads the folio mapping before calling folio free swap. When folio free swap succeeds, the folio is removed from the swap cache, but the saved...

CVE-2026-89755: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: clear stale mapping after freeing swapcache migratedevicepages reads the folio mapping before calling foliofreeswap. When foliofreeswap succeeds, the folio is removed from the swap cache, but the saved mapping...

CVE-2026-89755: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: clear stale mapping after freeing swapcache migratedevicepages reads the folio mapping before calling foliofreeswap. When foliofreeswap succeeds, the folio is removed from the swap cache, but the saved mapping...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.0. It arises because nvme-tcp fails to compare the number of bytes already received with the length of command requests when receiving data. As a result, the controller may respond to a read request of 4096 bytes by sending a response of 5...