CVE-2026-90384: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iomap: release the folio batch on iomap callback failures A sashiko review of an unrelated patch points out that the folio batch mechanism used for iomap zero range fails to release the batch in a couple error scenarios. If eithe...

CVE-2026-89985

In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits t...

DEBIAN-CVE-2026-89985

In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits t...

DEBIAN-CVE-2026-89967

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: avoid out-of-bounds writes for compound folios migratedevicerange and migratedevicepfns clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compoun...

CVE-2026-89967

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: avoid out-of-bounds writes for compound folios migratedevicerange and migratedevicepfns clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compoun...

CVE-2026-89837

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in findinlevel findinlevel gets a dentry folio with f2fsfinddatafolio before calling findinblock. If findinblock returns an error, the function stores the error in resfolio and breaks out of the loop...

DEBIAN-CVE-2026-89837

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in findinlevel findinlevel gets a dentry folio with f2fsfinddatafolio before calling findinblock. If findinblock returns an error, the function stores the error in resfolio and breaks out of the loop...

DEBIAN-CVE-2026-89836

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

CVE-2026-89829

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to pass folio-index to f2fssanitychecknodefooter Otherwise in f2fssanitychecknodefooter, it will check the same nid incorrectly...

DEBIAN-CVE-2026-89832

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage...

CVE-2026-89832

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage...

CVE-2026-89805

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Fix folio allocation fallback and use-after-put drmpagemapmigratepopulaterampfn had two issues when populating RAM PFNs with higher-order folios: 1. The higher-order vmaallocfolio/folioalloc calls did not pass...

DEBIAN-CVE-2026-89805

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Fix folio allocation fallback and use-after-put drmpagemapmigratepopulaterampfn had two issues when populating RAM PFNs with higher-order folios: 1. The higher-order vmaallocfolio/folioalloc calls did not pass...

CVE-2026-89804

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migration maps migration buffers with pagesize and records that length in dmainfo-size. For a compound folio pagesize is PAGESIZE 0 folio this...

CVE-2026-89985 memcg: keep folio's objcg same as its node

In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits t...

CVE-2026-89985

CVE-2026-89985 is a vulnerability in the Linux kernel's memory cgroup (memcg) subsystem . The root cause is a broken invariant in memcg_reparent_objcgs(): when a folio migrates across NUMA nodes, it inherits the old node's objcg, which desynchronizes objcg reparenting from LRU list reparenting. T...

EUVD-2026-80593

In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits t...

CVE-2026-89985 memcg: keep folio's objcg same as its node

In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits t...

CVE-2026-89967

CVE-2026-89967 is an out-of-bounds write in the Linux kernel 's mm/migrate_device subsystem. The functions migrate_device_range() and migrate_device_pfns() clear entries following a compound folio to maintain page-granular PFN arrays, but fail to limit writes to the number of slots remaining in t...

EUVD-2026-80567

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: avoid out-of-bounds writes for compound folios migratedevicerange and migratedevicepfns clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compoun...