CVE-2026-89956 s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist, the matrixdev-guestslock mutex must be held. There are two function...

EUVD-2026-80556

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist, the matrixdev-guestslock mutex must be held. There are two function...

CVE-2026-89956 s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist, the matrixdev-guestslock mutex must be held. There are two function...

CVE-2026-89956

CVE-2026-89956 affects the s390/vfio-ap subsystem of the Linux kernel. The root cause is a missing matrix_dev->guests_lock mutex when traversing or modifying the mdev_list of ap_matrix_mdev objects. Two functions are affected: vfio_ap_mdev_probe , which added objects to the list using the wron...

CVE-2026-89940 iio: buffer: Tie IIO dma fence lock lifetime to the fence

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Tie IIO dma fence lock lifetime to the fence The iiodmafence implementation currently uses a lock embedded in the iiodmabufpriv. But the iiodmafence can outlive the iiodmabufpriv, which can cause a use-after-free. Ti...

CVE-2026-89922 KVM: s390: Take srcu when importing watchpoint data

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...

CVE-2026-89897 media: cec: Serialize exclusive follower delivery

In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cecreceivenotify reads the exclusive follower pointer without the adapter lock. Serialize the no-follower check and message delivery against mode changes and release...

CVE-2026-89897

CVE-2026-89897 affects the Linux kernel 's CEC (Consumer Electronics Control) media subsystem. The vulnerability resides in cec_receive_notify(), which reads the exclusive follower pointer without holding the adapter lock , creating a race condition. The fix serializes the no-follower check and m...

EUVD-2026-80457

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

EUVD-2026-80420

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dclock leak on GPU reset error paths On GPU reset, dmsuspend takes dclock and leaves it for dmresume to drop. If amdgpudmcommitzerostreams or dmdmubhwinit fails, the function returns with the lock still held...

CVE-2026-89820

CVE-2026-89820 affects the Linux kernel 's drm/amd/display subsystem. On GPU reset, dm_suspend() acquires the dc_lock and defers its release to dm_resume(). If amdgpu_dm_commit_zero_streams() or dm_dmub_hw_init() fails, the error path returns without releasing the lock , causing every subsequent ...

CVE-2026-89820 drm/amd/display: fix dc_lock leak on GPU reset error paths

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dclock leak on GPU reset error paths On GPU reset, dmsuspend takes dclock and leaves it for dmresume to drop. If amdgpudmcommitzerostreams or dmdmubhwinit fails, the function returns with the lock still held...

kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. A remote Bluetooth Low Energy BLE device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list,...

kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. A remote Bluetooth Low Energy BLE device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list,...

Huawei HarmonyOS Permission Control Vulnerability (CNVD-2026-37858)

Huawei HarmonyOS is a distributed operating system developed independently by Huawei, designed for various scenarios. Huawei HarmonyOS has a permission control vulnerability, which stems from issues with the permission control in the app lock module. Attackers can exploit this vulnerability to...

CVE-2026-90043: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: zram: fix slot lock bit position on big-endian 64-bit The slot lock is a bit operation on the whole lock word, which flags and actime alias as two u32s. On little-endian the lock bit lands in the position ZRAMENTRYLOCK reserves i...

CVE-2026-89980: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ sndharmonycreate registers the IRQ before initializing h-lock and h-mixerlock. A pending interrupt can invoke the handler while these locks are uninitialized. Initialize both...

CVE-2026-89990: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in cephmdscheckaccess MDS session OPEN handling replaces mdsc-scapauths under mdsc-mutex, freeing the previous array and its strings. cephmdscheckaccess traverses this array without holding the mutex. A concurren...

PT-2026-93627

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory policy management where a sleeping function is called from an invalid context. When rhashtable insert slow rehashes a table under rcu read lock, it invokes...

PT-2026-93569

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM x86 MMU where the kvm rmap lock function elides the rmap lock when an empty rmap is observed. The kvm rmap age gfn range function ignores the returned value an...