CVE-2026-89647

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

CVE-2026-89647 ceph: do not repeat ceph_trim_dentries() if no progress possible

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

CVE-2026-89647 ceph: do not repeat ceph_trim_dentries() if no progress possible

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

CVE-2026-89647

CVE-2026-89647 affects the Linux kernel's Ceph file system . The function ceph_cap_reclaim_work() enters a busy loop by re-queuing itself whenever ceph_trim_dentries() returns -EAGAIN, which occurs when a lease walk exhausts its scan budget with no cap pressure and all leases still valid. The dir...

EUVD-2026-76559

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

CVE-2026-89578

In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DMIOBIO requests, doregion built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...

CVE-2026-89578

CVE-2026-89578 affects the Linux kernel's dm-io component. In do_region(), DM_IO_BIO requests rebuilt each destination bio by walking the source bio's biovec and re-adding pages individually, using sector-based accounting . When a misaligned O_DIRECT buffer was split across pages, the vector leng...

EUVD-2026-76490

In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DMIOBIO requests, doregion built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...

CVE-2026-89578 dm-io: clone the source bio instead of copying its biovec

In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DMIOBIO requests, doregion built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...

CVE-2026-89490

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2dirforeachblkel, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-sblocksize - 1 | offset; ctx-pos is lofft signed 64-bit, while sb-sblocksize i...

EUVD-2026-76396

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2dirforeachblkel, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-sblocksize - 1 | offset; ctx-pos is lofft signed 64-bit, while sb-sblocksize i...

CVE-2026-89490 ocfs2: fix readdir position truncation on 32-bit kernels

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2dirforeachblkel, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-sblocksize - 1 | offset; ctx-pos is lofft signed 64-bit, while sb-sblocksize i...

CVE-2026-89490

CVE-2026-89490 affects the ocfs2 filesystem in the Linux kernel on 32-bit systems. In ocfs2_dir_foreach_blk_el(), the directory position mask derived from sb->s_blocksize (a 32-bit unsigned long) is zero-extended to 64 bits when ANDed with the loff_t-typed ctx->pos, silently clearing the hi...

CVE-2026-89479

CVE-2026-89479 is a use-after-free in the Linux kernel's SCTP implementation. In sctp_endpoint_bh_rcv(), the association is cached in chunk->asoc and chunk->transport without holding a reference. A remote peer can bundle COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK in a single packet: the COOKIE...

CVE-2026-89479 sctp: stop processing a packet once its association is deleted

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A packet...

CVE-2026-89479 sctp: stop processing a packet once its association is deleted

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A packet...

CVE-2026-89471 power: supply: cros_usbpd-charger: bound the EC-reported port count

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-80957 dm-pcache: detect a cycle in the last-kset chain during replay

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: detect a cycle in the last-kset chain during replay cachereplay follows the on-media last-kset chain by nextcachesegid with no condresched. A forged chain that points back into a segment it has already visited makes th...

CVE-2026-80957

CVE-2026-80957 affects the dm-pcache subsystem in the Linux kernel . The function cache_replay() traverses the on-media last-kset chain via next_cache_seg_id without calling cond_resched(). A forged chain that points back into an already-visited segment causes the replay loop to iterate indefinit...

CVE-2026-80957

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: detect a cycle in the last-kset chain during replay cachereplay follows the on-media last-kset chain by nextcachesegid with no condresched. A forged chain that points back into a segment it has already visited makes th...