CVE-2026-89714 NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegationhashtable leak when nfs4servercommonsetup fails nfs4servercommonsetup allocates server-delegationhashtable first, but server-destroy - the only path that frees the table via nfs4destroyserver - is not assigned...

CVE-2026-89714

This Linux kernel vulnerability affects the NFSv4 client subsystem. The root cause is a memory leak of server->delegation_hash_table (4 KiB per attempt with the default delegation watermark) when nfs4_server_common_setup() fails at an intermediate step (is_ds_only_client(), nfs4_init_session()...

EUVD-2026-76533

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89621

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89616 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

EUVD-2026-76528

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89592

CVE-2026-89592 affects the Linux kernel's accel/rocket driver , specifically the rocket_job_push() function. Two distinct bugs exist: (1) a missing NULL check after a kvmalloc_array() call, which can cause a kernel NULL pointer dereference if the allocation fails; and (2) an integer overflow wher...

CVE-2026-89583

CVE-2026-89583 is an out-of-bounds (OOB) read in the Linux kernel's Bluetooth EIR parser, specifically in eir_get_service_data(). The root cause is an incorrect length calculation: when walking Extended Inquiry Response advertising data, the eir_len variable is decremented by only the data length...

CVE-2026-89513 RISC-V: KVM: Fix PMU event info array size overflow

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-89489 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1katomic syscall sysor1katomic syscall 244 in the "or1k" ABI takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0r4 l.lwz...

CVE-2026-89489

In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1katomic syscall sysor1katomic syscall 244 in the "or1k" ABI takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0r4 l.lwz...

EUVD-2026-76395

In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1katomic syscall sysor1katomic syscall 244 in the "or1k" ABI takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0r4 l.lwz...

CVE-2026-89489 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1katomic syscall sysor1katomic syscall 244 in the "or1k" ABI takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0r4 l.lwz...

CVE-2026-80946 fuse: copy request headers via a stack buffer for io-uring

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

CVE-2026-15710

CVE-2026-15710 affects the Endpoint DLP kernel driver (epdlpdrv.sys) of Netskope Client for Windows prior to version R141 . Two root causes enable the information leak: (1) the internal communication channel between the user-space hook DLL, the kernel driver, and the daemon lacked token-based mes...

CVE-2026-15710 Netskope Client Endpoint DLP Kernel Driver Information Leakage

An information leakage vulnerability exists in the Endpoint DLP component epdlpdrv.sys of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message...

PT-2026-90332

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak exists in the ni read frame function within the NTFS3 file system. The issue occurs when the decompress lznt function stops processing a compressed stream before...

PT-2026-90205

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the openrisc architecture implementation where the sys or1k atomic function syscall 244 in the "or1k" ABI fails to validate user pointers v1 and v2 using access ok...