UBUNTU-CVE-2026-81015

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails amdpmcprobe registers the LPS0 s2idle handler with acpiregisterlps0dev and creates the driver's debugfs directory before calling amdstbs2dinit, which is the las...

CVE-2026-89628

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

UBUNTU-CVE-2026-89668

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89745

In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmapprepare Commit 651fdda8406d "relay: update relay to use mmapprepare" changed the mmap file operation to mmapprepare for relayfs, but the lockdown check in debugfs was not updated accordingly...

CVE-2026-89745 debugfs: Fix lockdown check for mmap_prepare

In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmapprepare Commit 651fdda8406d "relay: update relay to use mmapprepare" changed the mmap file operation to mmapprepare for relayfs, but the lockdown check in debugfs was not updated accordingly...

CVE-2026-89745

This Linux kernel vulnerability affects the debugfs subsystem. A prior commit changed relayfs from using the mmap file operation to mmap_prepare, but the corresponding lockdown check in debugfs was not updated. As a result, when the kernel is in integrity mode , debugfs fails to lock down files t...

CVE-2026-89745 debugfs: Fix lockdown check for mmap_prepare

In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmapprepare Commit 651fdda8406d "relay: update relay to use mmapprepare" changed the mmap file operation to mmapprepare for relayfs, but the lockdown check in debugfs was not updated accordingly...

EUVD-2026-76657

In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmapprepare Commit 651fdda8406d "relay: update relay to use mmapprepare" changed the mmap file operation to mmapprepare for relayfs, but the lockdown check in debugfs was not updated accordingly...

EUVD-2026-76633

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range maxregister The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. maxregister names 0x10000, one register past the end of...

CVE-2026-89721 phy: rockchip-samsung-dcphy: fix out-of-range max_register

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range maxregister The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. maxregister names 0x10000, one register past the end of...

CVE-2026-89721 phy: rockchip-samsung-dcphy: fix out-of-range max_register

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range maxregister The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. maxregister names 0x10000, one register past the end of...

CVE-2026-89721

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range maxregister The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. maxregister names 0x10000, one register past the end of...

CVE-2026-89721

CVE-2026-89721 affects the Linux kernel driver rockchip-samsung-dcphy (a Rockchip Samsung Display Clock PHY). The max_register value was set to 0x10000 , one register past the end of the 64 KB register block (last valid offset is 0xfffc with a stride of 4). Triggering a register dump through the ...

CVE-2026-89668

CVE-2026-89668 affects the nfsd (NFS daemon) component of the Linux kernel . In init_nfsd(), nfsd_debugfs_init() is called before nfsd4_init_slabs(). If the slab allocation fails, the early return bypasses nfsd_debugfs_exit(), leaving orphaned debugfs files with stale fops pointers into freed mod...

CVE-2026-89668 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89668

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

EUVD-2026-76580

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89668 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89628

A slab-out-of-bounds read vulnerability exists in the Linux kernel's hid_picolcd driver. The function picolcd_debug_eeprom_read() trusts a length byte supplied by the device in its REPORT_EE_DATA reply, clamping it only to the caller's read count but never checking resp->raw_size—the actual nu...

EUVD-2026-76540

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...