CVE-2026-89698

CVE-2026-89698 is a Linux kernel vulnerability in the NFS daemon (nfsd) generic netlink interface. The rq_daddr and rq_saddr fields in struct nfsd_genl_rqstp are declared as struct sockaddr (16 bytes), but nfsd_genl_rpc_status_compose_msg() casts them to struct sockaddr_in6 * (28 bytes) when an I...

EUVD-2026-76603

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

EUVD-2026-76561

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89649 ceph: bound xattr value length in __build_xattrs()

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

EUVD-2026-76543

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631

CVE-2026-89631 affects the Linux kernel's SMB (CIFS) client . The flaw is in CIFSTCon(), where a server-supplied ByteCount of 0 or 1 causes an integer-to-size_t sign conversion that yields a huge bound. The subsequent __u16 subtraction wraps bytes_left, allowing cifs_strndup_from_utf16() to read ...

CVE-2026-89628 HID: picolcd: clamp eeprom debugfs read to bytes actually received

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

CVE-2026-89583 Bluetooth: eir: Fix OOB read in eir_get_service_data()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

CVE-2026-89524 wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...

EUVD-2026-76430

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...

CVE-2026-89524 wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...

CVE-2026-89483 nvme: zero the discard fallback page

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

CVE-2026-89483

CVE-2026-89483 is a Linux kernel vulnerability in the NVMe subsystem. When nvme_setup_discard() maps a 4096-byte DSM payload but a single-range discard fills only the first 16 bytes, the remaining 4080 bytes come from the fallback ctrl->discard_page, which is allocated via alloc_page(GFP_KERNE...

EUVD-2026-76387

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89481

CVE-2026-89481 affects the nvme-tcp driver in the Linux kernel . The function nvme_tcp_handle_r2t() fails to verify the direction of the NVMe request when processing a Ready to Transfer (R2T) message. A malicious NVMe controller can send an R2T referencing a READ command, causing the host to tran...

CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89444

CVE-2026-89444 affects the Linux kernel's platform/x86: dell-wmi-sysman driver. The set_attribute() function populates the security area of the BIOS attribute request buffer with the current admin password via populate_security_buffer(), then calls print_hex_dump_bytes() to dump the entire reques...

EUVD-2026-76350

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-89444 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...