CVE-2026-80974

A flaw was found in the mfd: sm501 component of the Linux kernel. This vulnerability arises from a failure to properly free allocated memory for struct sm501devdata during the device removal process. A local attacker could potentially exploit this memory leak, which may lead to a denial of servic...

CVE-2026-89491

A flaw was found in the Linux kernel's ocfs2 cluster module. This vulnerability allows a local attacker to trigger a denial of service. The issue arises when a sleeping function is called while a spinlock is held within the o2hbregionpin function, which can lead to a system crash or deadlock. Thi...

CVE-2026-89443

A flaw was found in the Linux kernel's platform/x86 ISST module. The isstifgetperflevelmask and isstifgetbasefreqmask functions fail to validate a user-provided 'level' parameter. A local attacker could exploit this by providing an invalid 'level' value, leading to an out-of-bounds read from the...

CVE-2026-81017

A flaw was found in the Linux kernel's sensorhub component. A local attacker could provide a maliciously crafted sensor number in an EC FIFO event. This unchecked sensor number could lead to an out-of-bounds read and write in the batchstate array, potentially causing memory corruption or system...

CVE-2026-89615

A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker could exploit this by providing a specially crafted log record. This crafted record causes a buffer overflow in the pagelcns array, leading to memory corruption within an otherwise valid entry...

CVE-2026-89471

A flaw was found in the Linux kernel's crosusbpd-charger driver. A malicious or compromised embedded controller EC can report an excessive number of USB Power Delivery PD ports. This causes the driver to write beyond the allocated memory buffer when populating a fixed-size array for port data,...

CVE-2026-89616

A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the nireadframe function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used kernel memory pages to a local attacker who reads a specially...

CVE-2026-80928

A flaw was found in the Linux kernel's SMACK Simplified Mandatory Access Control Kernel security module. Incorrect handling of task credentials within the smackfilesendsigiotask function can lead to a Use-After-Free UAF vulnerability. A local attacker could exploit this flaw to potentially escala...

CVE-2026-89656

A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory workspace, leading to an out-of-bounds write. This memory...

CVE-2026-89472

A flaw was found in the Linux kernel's power supply charger-manager component. A race condition exists where the system frees charger regulators before their corresponding sysfs entries are unregistered. A local attacker can exploit this by performing a concurrent write to a charger's...

CVE-2026-89729

A flaw was found in the Linux kernel's Human Interface Device HID sensor-hub driver. A local attacker could exploit this vulnerability by providing a specially crafted HID descriptor. This malicious descriptor could cause the sensorhubgetfeature function to write data beyond the intended memory...

CVE-2026-89601

A flaw was found in the Linux kernel's ext2 filesystem. This vulnerability occurs in the ext2setsize and ext2xattrset2 functions, where inode updates for ISSYNC inodes may be lost. This happens because the syncinodemetadata function only processes inodes that are already marked as dirty, leading ...

CVE-2026-89600

A flaw was found in the Linux kernel's fanotify subsystem. This use-after-free vulnerability occurs when the system attempts to report file range information after the memory holding that information has been released. A local attacker could potentially exploit this to read stale stack memory,...

CVE-2026-81009

A flaw was found in the Linux kernel. The iouring/query interface, specifically within the iohandlequeryentry function, does not properly cap the user-provided size when zeroing memory. A local attacker can exploit this by sending a specially crafted query that requests an excessively large amoun...

CVE-2026-89571

A flaw was found in the Linux kernel's CXL Compute Express Link features. A local attacker could exploit an out-of-bounds read vulnerability in the fwctlcmdrpc and cxlctlsetfeature functions. This occurs when the system attempts to copy data with a small input buffer length but processes a larger...

CVE-2026-80966

A flaw was found in the ALSA portman2x4 driver of the Linux kernel. This vulnerability occurs because the driver does not properly validate the card index, specifically failing to check for negative ID values. A local attacker could exploit this by providing a negative ID value via sysfs, leading...

CVE-2026-80931

A flaw was found in the Linux kernel's w1: ds28e17 1-Wire to I2C bridge driver. A malicious I2C slave device can provide an oversized length during an I2C block read operation. This causes the driver to read beyond the allocated buffer, leading to an out-of-bounds read of up to 222 bytes. This...

CVE-2026-89454

A flaw was found in the Linux kernel's PCI PLDA driver. This vulnerability occurs in the pldainitinterrupts function, where Interrupt Request IRQ domains are not properly deinitialized if certain initialization steps fail. A local attacker could potentially exploit this resource leak, leading to...

CVE-2026-89584

A flaw was found in the Linux kernel's block layer. This vulnerability arises from insufficient validation of user-space data structures vectors against the device's Direct Memory Access DMA alignment requirements. A local attacker could exploit this by providing misaligned data, causing the syst...

CVE-2026-89456

A flaw was found in the Linux kernel. Specifically, within the s390/dasd component, an issue exists during error recovery for disk read operations. When a request is partially completed and then recovered, the system fails to correctly propagate the length of the processed data. This can lead to...