CVE-2026-89808

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

CVE-2026-89850

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Don't query firmware state while chip is down qla2x00fwstateshow initializes rval to QLAFUNCTIONFAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued...

CVE-2026-89848

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxxdeleteqpair deletes the request queue before the response queue. qla25xxdeletereqque frees the request queue memory kfreereq in qla25xxfreereqque, but the...

CVE-2026-89831

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect criticaltaskpriority updates with sumount The sysfs store path already takes sumount for GC thread control entries, and ckptthreadioprio is covered as well. criticaltaskpriority also updates checkpoint or GC kthread...

CVE-2026-89818

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...

CVE-2026-89834

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

CVE-2026-89830

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In allocatedatablock, when allocating a new data block dn-datablkaddr == NULLADDR, incvalidblockcount is called first to increment totalvalidblockcount and iblocks...

CVE-2026-89846

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...

CVE-2026-89814

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...

CVE-2026-89905

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arenavmstart is dynamically enabled, it shifts the relative...

CVE-2026-89871

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthreadvidcap on failure kthreadrun returns an ERRPTR on failure, not NULL. When startstreaming fails, data-kthreadvidcap is left holding this error pointer instead of being...

CVE-2026-89840

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVERANGE destination size F2FSIOCMOVERANGE checks the source range, but not the destination end before updating isize. A source hole can expose this: cloneblkaddrs skips NULLADDR entries and returns success, so th...

CVE-2026-89877

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164devsetup adds the device to the global saa7164devlist before requesting the PCI BAR memory regions. If getresources fails, saa7164devsetup decrements the device...

CVE-2026-89866

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Resume device before setting EOS flag Setting the EOS flag talks to the firmware via sendfirmwarecommand, which accesses VPU registers. Both the STREAMOFF path wave5vpudecjobabort and the V4L2DECCMDSTOP...

CVE-2026-89839

In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fsxattradviseset f2fsxattradviseset calls inodeownerorcapable with &nopmntidmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to t...

gstreamer-plugins-base: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow

A flaw was found in GStreamer. This vulnerability, a stack-based buffer overflow, occurs during the parsing of OGG files due to improper validation of user-supplied data length. A remote attacker could exploit this by tricking a user into visiting a malicious page or opening a malicious file,...

corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

gstreamer-plugins-base: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow

A flaw was found in GStreamer. This vulnerability, a stack-based buffer overflow, occurs during the parsing of OGG files due to improper validation of user-supplied data length. A remote attacker could exploit this by tricking a user into visiting a malicious page or opening a malicious file,...

coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values

A flaw was found in GNU coreutils, specifically in the unexpand utility. This vulnerability, a heap-based buffer overflow, occurs due to an integer overflow when unexpand processes unusually large tab stop values provided by a local attacker. This can lead to an undersized memory buffer, allowing...

coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input

A flaw was found in GNU coreutils uniq. When processing specially crafted multibyte input with the --check-chars option, an attacker can trigger an out-of-bounds read. This vulnerability can lead to a denial of service DoS due to an application crash and potentially expose sensitive information...