EUVD-2026-76476

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

CVE-2026-89546 SUNRPC: close backchannel before destroying callback service

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

CVE-2026-89546

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

EUVD-2026-76450

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...

CVE-2026-89539 SUNRPC: reject duplicate CREDS_VALUE options

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...

CVE-2026-89539

Linux kernel SUNRPC subsystem: gssx_dec_option_array() processes wire-supplied GSS option entries and calls gssx_dec_linux_creds() for each CREDS_VALUE match. Because that helper unconditionally overwrites creds->cr_group_info without releasing the previous pointer, a reply containing two CRED...

CVE-2026-89524

CVE-2026-89524 is an integer underflow in the Linux kernel's ath6kl Wi-Fi driver . In ath6kl_cfg80211_connect_event(), fixed IE offsets are subtracted from assoc_req_len (−4) and assoc_resp_len (−6), both of type u8, with no lower-bound check. When an association request or response is shorter th...

EUVD-2026-76406

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...

CVE-2026-89500

CVE-2026-89500 is a flaw in the Linux kernel's ring-buffer component. When a cached reader page is discarded after a concurrent ring buffer resize, the kernel uses the new global subbuf_order for the free_pages() call rather than the order under which the page was originally allocated. This misma...

CVE-2026-89500 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...

CVE-2026-89500

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...

CVE-2026-89500 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...

EUVD-2026-76402

In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copyfilerange' within the same filesystem: unreferenced object 0xffff88812192c980 size 32: comm...

CVE-2026-89496

CVE-2026-89496 is a memory leak in the Linux kernel OCFS2 filesystem, discovered via local fuzzing of version 6.12.94 . The leak occurs when copy_file_range() is called within the same OCFS2 filesystem, triggering a copy-on-write path that fails to release deallocation caches (ocfs2_cache_block_d...

CVE-2026-89496 ocfs2: always run deallocs on copy-on-write completion

In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copyfilerange' within the same filesystem: unreferenced object 0xffff88812192c980 size 32: comm...

CVE-2026-89496 ocfs2: always run deallocs on copy-on-write completion

In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copyfilerange' within the same filesystem: unreferenced object 0xffff88812192c980 size 32: comm...

CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

EUVD-2026-76355

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

CVE-2026-89449

CVE-2026-89449 is a memory leak in the Linux kernel IOMMU subsystem, specifically in iommu_mock_device_add() (drivers/iommu/iommu.c). When iommu_fwspec_init() successfully allocates both dev->iommu and dev->iommu->fwspec, but the subsequent device_add() call fails, the error path only ca...

CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...