CVE-2026-89575: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in buildconstructorstring Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf...

PT-2026-96592

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dm kvzallocpercpu alloc size, cpu to nodecpu" fails, the code jumps to the "out" label and calls dm stat free. dm stat free does "for each possible cpucpu dm...

CVE-2026-80963: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

PT-2026-96481

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array block check can only compare the header against itself, so a block with value size 4 and max entries 1018 is internally consistent and passes. dm-cache...

PT-2026-90293

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm-io interface where non-retryable error codes BLK STS NOTSUPP and BLK STS INVAL could incorrectly cause leg failure on dm-raid1. This leads to misbehavior when...

CVE-2026-80958: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-89576: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadatatakesnap bumps the live superblock refcount and then dmtmshadowblock allocates a new block for the metadata snapshot. If the subsequent dmsmincblock of...

PT-2026-90085

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF condition exists in the dm-pcache component within the kset replay function. The issue occurs when key-seg gen is stale, leading to a call to cache key putkey follow...

PT-2026-90086

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the dm-pcache component where the get cache segment function scans the segment map up to the physical device segment count, while cache segs init only initializes segments...

PT-2026-90087

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A flaw exists in the dm-pcache component where the cache replay function follows the on-media last-kset chain using the next cache seg id variable without implementing cond resched. A forged...

PT-2026-90088

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the dm-pcache module where the tail-kset read in the cache replay function, the writeback worker, and the GC worker bounds its length by the raw segment size PCACHE SEG SI...

PT-2026-90290

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm array component where array block headers are not properly validated during read operations. The array block check function only validates the block number and...

PT-2026-90291

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A buffer overflow exists in the dm raid1 component within the build constructor string function. The issue occurs because the system fails to reserve space for the NUL-terminator after the...

PT-2026-90294

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the do region function when handling DM IO BIO requests. The system previously built destination bios by iterating through the source bio's biovec and adding pages...

PT-2026-90289

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm array where the array block check function only compares a header against itself, allowing internally consistent blocks with mismatched value sizes to pass. In...

PT-2026-90292

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the dm-era component during a failed snapshot operation. The metadata take snap function increases the live superblock reference count, and dm tm shadow block...

PT-2026-90090

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the dm-pcache module where the seg num read from the crc32c-only superblock is not validated against the cache device size. Since a user with CAP SYS ADMIN privileges...

PT-2026-90089

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the dm-pcache module where the cache pos decode function fails to properly validate the persisted key tail and dirty tail segment offsets seg off retrieved from the cache...

PT-2026-90093

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A crash occurs in the dm-stats component when the allocation of per-cpu data via the dm kvzalloc function fails. In such cases, the system jumps to the out label and executes the dm stat...

PT-2026-90092

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm-pcache component where geometry fields from on-disk cache info are not properly validated. The cache segs init function iterates based on the n segs value to...