CVE-2026-89971

CVE-2026-89971 affects the Linux kernel NVMe subsystem . The root cause is an insufficient error check in nvme_update_ns_info_block(): it only handles negative errno returns from nvme_query_zone_info(), missing positive NVMe status codes. This causes setup to proceed with zero-initialized zone li...

CVE-2026-89921 KVM: s390: Zero initialize data structures for inject_pfault_token

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for injectpfaulttoken kvminjectpfaulttoken only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on...

CVE-2026-89921

CVE-2026-89921 affects the Linux kernel KVM s390 architecture. The function __kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq, but the full ext substructure is copied into the CPU local variable on injection, leaving ext_params and pad with sta...

EUVD-2026-80521

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for injectpfaulttoken kvminjectpfaulttoken only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on...

CVE-2026-89921 KVM: s390: Zero initialize data structures for inject_pfault_token

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for injectpfaulttoken kvminjectpfaulttoken only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on...

CVE-2026-89865

CVE-2026-89865 affects the Linux kernel's qla2xxx SCSI driver (QLogic). The FRU and I2C bsg handlers stage transfers in a 256-byte DMA bounce buffer allocated via dma_pool_alloc() , which does not zero the memory. Only a small leading prefix is initialized (e.g., 36 bytes for a FRU version, 1 byt...

EUVD-2026-80465

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMAPOOLSIZE 256-byte bounce buffer obtained from dmapoolalloc, which does not zero the allocation. They initialize...

CVE-2026-89859 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing and, on success, copies the full sizeofdd back to user space via...

CVE-2026-89859 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing and, on success, copies the full sizeofdd back to user space via...

EUVD-2026-80459

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing and, on success, copies the full sizeofdd back to user space via...

CVE-2026-89859

This Linux kernel vulnerability affects the scsi: qla2xxx (QLogic Fibre Channel HBA) driver. In qla2x00_do_dport_diagnostics(), the qla_dport_diag response buffer is allocated with kmalloc_obj() (non-zeroing), but only a subset of the buffer is populated by the user request. The options and unuse...

CVE-2026-89858

CVE-2026-89858 affects the Linux kernel's qla2xxx SCSI driver in the function qla2x00_update_fru_versions(). A user-supplied BSG request is copied into a fixed 256-byte stack buffer , and the loop iteration count (list->count) is taken directly from user input with no upper bound , while only ...

CVE-2026-89852

In the Linux kernel 's qla2xxx SCSI driver, the mbx_cmd_t struct is allocated on the stack but left uninitialized. When qla2x00_mailbox_command() hits an early-return path (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, or purge mbox), it returns withou...

CVE-2026-89852 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

CVE-2026-89846

CVE-2026-89846 is a critical out-of-bounds read in the Linux kernel's qla2xxx SCSI driver. In qla2x00_status_entry(), the FWI2 status path subtracts rsp_info_len (a 32-bit value from the target's FCP response) from par_sense_len (the IOCB data area size: 28 bytes for 24xx, 60 bytes for 29xx) with...

EUVD-2026-80443

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

CVE-2026-89843 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

CVE-2026-89843

CVE-2026-89843 affects the Linux kernel scsi: qla2xxx driver (QLogic). Several bsg handlers use an uninitialized 256-byte on-stack buffer (uint8_t bsg[DMA_POOL_SIZE]) that is filled via sg_copy_to_buffer(), which copies only the user-supplied request length. When the request is shorter than the s...

CVE-2026-89843 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

CVE-2026-89826 drm/panthor: harden firmware build-info bounds checks

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthorfwreadbuildinfo checks whether the metadata range fits in the firmware image with hdr.metastart + hdr.metasize. Both fields are u32, so the addition can wrap and let an...