EUVD-2026-80566

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as a fallback to allocate from all nodes. If order is gigantic,...

CVE-2026-89966 mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as a fallback to allocate from all nodes. If order is gigantic,...

CVE-2026-89966

CVE-2026-89966 affects the Linux kernel in the mm/hugetlb_cma subsystem. The root cause is a NULL nodemask dereference in hugetlb_cma_alloc_frozen_folio(): when alloc_buddy_hugetlb_folio_with_mpol() passes a NULL nodemask as a fallback for gigantic (e.g., 1 GB) hugepage allocations, the function ...

CVE-2026-89966 mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as a fallback to allocate from all nodes. If order is gigantic,...

CVE-2026-89963

CVE-2026-89963 affects the Linux kernel in the powerpc/kexec_file subsystem. A potential NULL pointer dereference exists in the function kexec_extra_fdt_size_ppc64() : on platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving the pointer 'rmem' unal...

EUVD-2026-80563

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89963 powerpc/kexec_file: Fix null-ptr-def in extra size calculation

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89963 powerpc/kexec_file: Fix null-ptr-def in extra size calculation

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89958

This vulnerability affects the Linux kernel 's s390/vfio-ap driver. The root cause is a NULL pointer dereference : the vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete callback functions acquire the matrix_mdev->kvm->lock mutex without first checking whether matrix_mdev->kvm is NULL. ...

CVE-2026-89958 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...

EUVD-2026-80558

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...

CVE-2026-89958 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...

CVE-2026-89933

CVE-2026-89933 is a NULL pointer dereference in the Linux kernel's IIO pressure driver for the DPS310 (Infineon IFX3100). When the device is enumerated via its ACPI HID (IFX3100) , i2c_client_get_device_id() returns NULL because the ACPI-derived client name does not match the driver's i2c_device_...

CVE-2026-89933 iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: dps310: fix NULL pointer dereference on ACPI probe When the device is enumerated through its ACPI HID IFX3100, i2cclientgetdeviceid returns NULL: the ACPI-derived client name does not match the driver's i2cdeviceid...

EUVD-2026-80533

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: dps310: fix NULL pointer dereference on ACPI probe When the device is enumerated through its ACPI HID IFX3100, i2cclientgetdeviceid returns NULL: the ACPI-derived client name does not match the driver's i2cdeviceid...

CVE-2026-89933 iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: dps310: fix NULL pointer dereference on ACPI probe When the device is enumerated through its ACPI HID IFX3100, i2cclientgetdeviceid returns NULL: the ACPI-derived client name does not match the driver's i2cdeviceid...

CVE-2026-89912 KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89874 media: v4l2-async: avoid deleting unlinked ASC entry on link error

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2asyncmatchnotify creates ancillary media links before adding asc-ascsubdeventry to sd-asclist. If ancillary link creation fails, the function jumps to...

CVE-2026-89874 media: v4l2-async: avoid deleting unlinked ASC entry on link error

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2asyncmatchnotify creates ancillary media links before adding asc-ascsubdeventry to sd-asclist. If ancillary link creation fails, the function jumps to...

CVE-2026-89874

CVE-2026-89874 affects the Linux kernel media subsystem (v4l2-async). The vulnerability is a NULL pointer dereference in v4l2_async_match_notify(): when ancillary media link creation fails, the function jumps to err_call_unbind before asc_subdev_entry is inserted into sd->asc_list. Because asy...