CVE-2026-80958

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-80972

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time...

CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80948

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart In iwlopmodedvmstart, jumping to outfreeeeprom currently bypasses the outfreeeepromblob label. Consequently, error paths triggered after successfully parsing the EEPROM fre...

CVE-2026-80947

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rxurbwq on stop rtl8xxxu arms rxurbwq from the RX completion path: rtl8xxxurxcomplete hands the URB to rtl8xxxuqueuerxurb, which queues it on rxurbpendinglist and, once the list grows past...

CVE-2026-89679

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

CVE-2026-89621

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89676

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2scpstateids IDR entry for async COPY For an async COPY, nfsd4copy called nfs4initcopystate before dupcopyfields, so the s2scpstateids IDR was pointed at &u-copy-cpstateid -- memory in the per-rqstp COMPOUND buff...

CVE-2026-89716

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits value is outside of valid ranges...

CVE-2026-89709

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

CVE-2026-89599

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicmprobe registers the display before initializing ddata-lock. Once omapdssregisterdisplay publishes the display, another consumer can reach a dsicm callba...

CVE-2026-89529

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments checks 4-byte alignment for non-zero position values but does not...

CVE-2026-89643

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove auditdelrule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference;...

CVE-2026-89534

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sccmid when ADDRCHANGE replacement fails When svcrdmalistenhandler handles RDMACMEVENTADDRCHANGE, it creates a replacement listener cmid and returns 1, telling the CM core to destroy the old one. If the replacement...

CVE-2026-89485

In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlminspectfile lock-drop nlmtraversefiles pins the current file with fcount++ across a mutexunlock for nlminspectfile, but nothing pins the saved next pointer. A concurrent nlmreleasefile can kfree the...

CVE-2026-89530

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

CVE-2026-89542

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long, and its rotateleft helper pass...

CVE-2026-89474

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usbwork before freeing the charger The USB-PHY notifier queues usbwork, whose handler calls powersupplychangedbq-charger. The reset devm action only unregisters the notifier and was registered before...

CVE-2026-89548

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

CVE-2026-89498

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...