CVE-2026-89751

CVE-2026-89751 is an off-by-one error in the Linux kernel's x86 TDX (Trusted Domain Extensions) port I/O handling. The functions handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c compute a bitmask using GENMASK(BITS_PER_BYTE * size, 0). Since GENMASK(h, l) includes bit h , this produces a m...

EUVD-2026-76663

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89751 x86/tdx: Fix off-by-one in port I/O handling

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89751 x86/tdx: Fix off-by-one in port I/O handling

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89726

CVE-2026-89726 is an off-by-one out-of-bounds read in the Linux kernel's lib/ucs2_string.c, specifically in the ucs2_strnlen() function. The root cause is that ucs2_strnlen() checks the current character before verifying whether the caller-provided maximum length has been reached. If the input is...

EUVD-2026-76638

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

CVE-2026-89726 lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

CVE-2026-89726 lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

EUVD-2026-76633

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range maxregister The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. maxregister names 0x10000, one register past the end of...

CVE-2026-89679 nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

CVE-2026-89679

CVE-2026-89679 is a null pointer dereference in the Linux kernel's nfsd component. When an NFSv4 client sends a SETATTR request containing the special "one stateid" (all-0xFF bytes) along with delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY), nfsd...

CVE-2026-89596 forcedeth: fix off-by-one when saving/restoring non-PCI config space

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

CVE-2026-89596

CVE-2026-89596 affects the Linux kernel's forcedeth driver (NVIDIA). An off-by-one error in nv_suspend() and nv_resume() causes an out-of-bounds write one element past the saved_config_space array during system suspend and resume (S3). The bug is triggered by a loop using <= instead of <. W...

CVE-2026-89596 forcedeth: fix off-by-one when saving/restoring non-PCI config space

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

EUVD-2026-76508

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

CVE-2026-89442

CVE-2026-89442 affects the Linux kernel 's platform/x86 ISST (Intelligent Speed and Frequency Tuning) module. The isst_if_clos_assoc() ioctl function improperly validates the user-supplied socket_id: it uses > instead of >= against topology_max_packages(), allowing an out-of-bounds array ac...

EUVD-2026-76348

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89442 platform/x86: ISST: Validate socket ID in clos_assoc ioctl

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89442

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...