CVE-2026-89457

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device-private, either directly or through the DASDDEFINEATTR macro. Duri...

CVE-2026-89455

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown pldapcieirqdomaindeinit removes pcie-eventdomain via irqdomainremove, but the per-event IRQs mapped from that domain are requested with devmrequestirq in...

CVE-2026-89454

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix IRQ domain leaks in the error paths of pldainitinterrupts pldainitinterrupts initializes IRQ domains and creates IRQ mapping but does not unwind them when later step fails. If platformgetirq or either...

CVE-2026-89453

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

CVE-2026-89452

In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msmiommuprobe adds its devm-managed IOMMU object to qcomiommudevices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommudevicesysfsadd fails,...

CVE-2026-89450

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89451

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

CVE-2026-89449

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

CVE-2026-89448

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

CVE-2026-89447

In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...

CVE-2026-89446

In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xastore failure iommufdtakealliovarwsem takes an object reference and the iovarwsem write lock before storing the IOAS in the temporary ioaslist xarray. If xastore fails, the current IOAS has not...

CVE-2026-89445

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...

CVE-2026-89444

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-89443

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

CVE-2026-89441

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

CVE-2026-89442

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89440

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure requestirq registers the SD card-detect interrupt and the probe enables it before mmcaddhost runs. If mmcaddhost fails, the error path only unmaps the registers and...

CVE-2026-89438

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-89439

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sstinst To be consistent with other places, add a NULL check for failed socket loading by checking isstcommon.sstinst...

CVE-2026-89437

In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sarprobe The memory allocated for devicemodeinfo in parsepackage called by sargetdata is not freed in some of the error paths in sarprobe. Fix that by converting to use device...