CVE-2026-89674

CVE-2026-89674 is a vulnerability in the Linux kernel 's NFS server daemon (nfsd), specifically in the nfsd4_ff_encode_layoutget() function. The XDR buffer size calculation contains multiple errors: the file handle length fails to account for XDR padding, the uid/gid lengths use an incorrect form...

CVE-2026-89667

CVE-2026-89667 is a race condition in the Linux kernel's nfsd (NFS server daemon) filecache subsystem. The shrinker, GC worker, and fsnotify/lease callbacks unhash an nfsd_file from the rhashtable and queue it to a per-net dispose list via nfsd_file_dispose_list_delayed(). If nfsd_file_cache_shut...

CVE-2026-89667 nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

EUVD-2026-76579

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

CVE-2026-89664

CVE-2026-89664 is a memory-leak vulnerability in the Linux kernel NFS daemon (nfsd) . When nfsd4_decode_createhow4() allocates refcounted posix_acl objects for an OPEN compound, they were never released on two code paths: (1) the short-circuit path taken when nfsd4_decode_open_claim4() returns a ...

CVE-2026-89627 HID: roccat: free buffered reports when destroying device

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccatreportevent duplicates each report with kmemdup and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The...

CVE-2026-89627

CVE-2026-89627 affects the Linux kernel 's HID roccat driver. The root cause is a memory leak : roccat_report_event() duplicates each report via kmemdup() into a circular buffer (cbuf[]), but the device destruction paths free struct roccat_device without releasing reports still stored in those sl...

EUVD-2026-76539

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccatreportevent duplicates each report with kmemdup and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The...

CVE-2026-89627 HID: roccat: free buffered reports when destroying device

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccatreportevent duplicates each report with kmemdup and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The...

CVE-2026-89621

CVE-2026-89621 is a Linux kernel vulnerability in the HID mcp2221 driver's mcp2221_raw_event() function. The function fails to validate the size of incoming HID reports in the MCP2221_I2C_GET_DATA path, trusting a device-supplied data[3] field as the copy length without verifying that 4 + data[3]...

EUVD-2026-76533

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89583

CVE-2026-89583 affects the Linux kernel Bluetooth EIR subsystem. The function eir_get_service_data() walks advertising data for a matching Service Data UUID but incorrectly decrements eir_len by only the field's data length, omitting the length and type bytes. This shortfall compounds across skip...

EUVD-2026-76488

In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadatatakesnap bumps the live superblock refcount and then dmtmshadowblock allocates a new block for the metadata snapshot. If the subsequent dmsmincblock of...

CVE-2026-89576 dm-era: fix shadowed superblock leak on take-snap failure

In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadatatakesnap bumps the live superblock refcount and then dmtmshadowblock allocates a new block for the metadata snapshot. If the subsequent dmsmincblock of...

CVE-2026-89565 ipip: fix skb leak in collect_md mode when metadata_dst allocation fails

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

CVE-2026-89565

In the Linux kernel , the ipip and mplsip tunnel drivers leak a socket buffer (skb) in collect_md mode when ip_tun_rx_dst() fails to allocate a metadata_dst struct via atomic allocation. The function ipip_tunnel_rcv() returns 0 without freeing the skb, and the callers (tunnel4_rcv() / tunnelmpls4...

EUVD-2026-76476

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

CVE-2026-89546 SUNRPC: close backchannel before destroying callback service

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

EUVD-2026-76450

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...