EUVD-2026-76677

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

EUVD-2026-76614

In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...

CVE-2026-89698 nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

CVE-2026-89698

CVE-2026-89698 is a Linux kernel vulnerability in the NFS daemon (nfsd) generic netlink interface. The rq_daddr and rq_saddr fields in struct nfsd_genl_rqstp are declared as struct sockaddr (16 bytes), but nfsd_genl_rpc_status_compose_msg() casts them to struct sockaddr_in6 * (28 bytes) when an I...

CVE-2026-89674 nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

EUVD-2026-76561

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89650 ceph: bound num_export_targets array for mds info v2/v3

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89616 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89616

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89600

CVE-2026-89600 is a use-after-free vulnerability in the Linux kernel's fanotify subsystem . The root cause: fsnotify_pre_content() builds a file_range on the triggering task's stack, and fanotify_alloc_perm_event() stores a pointer to range.pos in a heap-allocated permission event. If a signal in...

CVE-2026-89600

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotifyprecontent builds its filerange on the triggering task's stack. fanotifyallocpermevent saves a pointer to range.pos in the heap-allocated permission event so...

CVE-2026-89553 nouveau/gem: reserve the bo in the info ioctl around the vma lookup

In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted...

CVE-2026-89553

A use-after-free vulnerability exists in the Linux kernel's nouveau/gem driver. In the non-uvmm path, a race condition between the info ioctl's VMA lookup and the GEM close path can close the VMA before the lookup completes. This allows a local attacker with low privileges to potentially achieve ...

CVE-2026-89553 nouveau/gem: reserve the bo in the info ioctl around the vma lookup

In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted...

CVE-2026-89513 RISC-V: KVM: Fix PMU event info array size overflow

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-89513 RISC-V: KVM: Fix PMU event info array size overflow

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

EUVD-2026-76419

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-80973 ALSA: 6fire: bound the MIDI event length from the device

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

CVE-2026-80970 ALSA: FCP: do not copy out an uninitialised init response

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

CVE-2026-80970

CVE-2026-80970 affects the Linux kernel ALSA FCP USB audio driver. In fcp_ioctl_init(), the response buffer is allocated via kmalloc() without being zeroed. Because the step-0 USB control transfer does not set URB_SHORT_NOT_OK, a short or zero-length data stage is accepted as success, and snd_usb...