CVE-2026-89958 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...

EUVD-2026-80533

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: dps310: fix NULL pointer dereference on ACPI probe When the device is enumerated through its ACPI HID IFX3100, i2cclientgetdeviceid returns NULL: the ACPI-derived client name does not match the driver's i2cdeviceid...

CVE-2026-89933

CVE-2026-89933 is a NULL pointer dereference in the Linux kernel's IIO pressure driver for the DPS310 (Infineon IFX3100). When the device is enumerated via its ACPI HID (IFX3100) , i2c_client_get_device_id() returns NULL because the ACPI-derived client name does not match the driver's i2c_device_...

CVE-2026-89933 iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: dps310: fix NULL pointer dereference on ACPI probe When the device is enumerated through its ACPI HID IFX3100, i2cclientgetdeviceid returns NULL: the ACPI-derived client name does not match the driver's i2cdeviceid...

CVE-2026-89933 iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: dps310: fix NULL pointer dereference on ACPI probe When the device is enumerated through its ACPI HID IFX3100, i2cclientgetdeviceid returns NULL: the ACPI-derived client name does not match the driver's i2cdeviceid...

CVE-2026-89912 KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89874 media: v4l2-async: avoid deleting unlinked ASC entry on link error

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2asyncmatchnotify creates ancillary media links before adding asc-ascsubdeventry to sd-asclist. If ancillary link creation fails, the function jumps to...

CVE-2026-89874

CVE-2026-89874 affects the Linux kernel media subsystem (v4l2-async). The vulnerability is a NULL pointer dereference in v4l2_async_match_notify(): when ancillary media link creation fails, the function jumps to err_call_unbind before asc_subdev_entry is inserted into sd->asc_list. Because asy...

CVE-2026-89863 scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending obtains the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the firmwar...

CVE-2026-89863

CVE-2026-89863 is a NULL pointer dereference in the Linux kernel's qla2xxx SCSI driver, specifically in the EDIF (Extended Data Integrity Field) subsystem. The function qla_chk_edif_rx_sa_delete_pending() obtains a SCSI command pointer via GET_CMD_SP(sp) and immediately dereferences cmd->sc_da...

CVE-2026-89863 scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending obtains the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the firmwar...

EUVD-2026-80463

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending obtains the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the firmwar...

CVE-2026-89851

A bug in the Linux kernel scsi: qla2xxx driver (QLogic SCSI) affected the FCE trace enable write handler in debugfs (qla2x00_dfs_fce_write()). The function called kstrtoul() with a NULL result pointer , so a successful parse would dereference NULL and trigger a kernel oops . Additionally, the int...

CVE-2026-89835

CVE-2026-89835 is a NULL pointer dereference in the Linux kernel's f2fs filesystem . When checkpoint_merge is enabled but no checkpoint thread is running (e.g., on a read-only mount), writing to ckpt_thread_ioprio via sysfs calls set_task_ioprio() on a NULL task pointer (cprc->f2fs_issue_ckpt)...

EUVD-2026-80435

In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpointmerge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fsissueckpt there, but ckptthreadioprio is...

CVE-2026-89835 f2fs: avoid NULL checkpoint thread access in sysfs

In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpointmerge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fsissueckpt there, but ckptthreadioprio is...

EUVD-2026-80428

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...

CVE-2026-89828 drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...

CVE-2026-89828

This CVE affects the Linux kernel's amdgpu DRM driver . The root cause is an initialization ordering bug in amdgpu_vram_mgr_init(): the function drmm_cgroup_register_region() is called before the list heads and buddy allocator are initialized. If it fails, the early return skips those initializat...

EUVD-2026-80422

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driverdata in i915pciprobe pcimatchdevice can return the dummy pcideviceidany entry when a device is force-bound via sysfs driveroverride, in which case -driverdata is unset NULL. i915pciprobe casts i...