CVE-2026-89844

CVE-2026-89844 is a locking race in the Linux kernel qla2xxx SCSI driver. In qla24xx_report_id_acquisition(), the format-1 path drops vport_slock after taking the vport reference and then calls qla_update_host_map() without holding the lock. That function mutates the ha->host_map btree via btr...

EUVD-2026-80444

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap without the lock. That...

CVE-2026-89844 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap without the lock. That...

CVE-2026-89836

CVE-2026-89836 is a race condition in the Linux kernel's f2fs filesystem driver. The root cause is that f2fs_get_read_data_folio() calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio, dropping the reference and releasing the folio lock before the page count is read. A c...

EUVD-2026-80436

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

CVE-2026-89836 f2fs: fix folio_nr_pages() race after put in large folio invalidate

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

CVE-2026-89836 f2fs: fix folio_nr_pages() race after put in large folio invalidate

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

EUVD-2026-80433

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fsfsyncnodepages There is potential deadloop in race condition: Thread A Thread B - fsync - f2fsdosyncfile - f2fsfsyncnodepages - lastfsyncdnode - foliogetlastfolio - f2fssetattr -...

CVE-2026-89833 f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fsfsyncnodepages There is potential deadloop in race condition: Thread A Thread B - fsync - f2fsdosyncfile - f2fsfsyncnodepages - lastfsyncdnode - foliogetlastfolio - f2fssetattr -...

CVE-2026-89833

CVE-2026-89833 affects the Linux kernel's f2fs filesystem driver. The vulnerability is a race condition in f2fs_fsync_node_pages(): when one thread performs an fsync while another concurrently executes a truncate via f2fs_setattr, the truncate can set folio->mapping = NULL. This causes is_node...

CVE-2026-89831

CVE-2026-89831 affects the f2fs filesystem in the Linux kernel. The critical_task_priority sysfs attribute updates checkpoint or GC kthread scheduling state but was not serialized with the s_umount lock, unlike the similar GC thread control entries and ckpt_thread_ioprio . This omission allows a ...

CVE-2026-89831 f2fs: protect critical_task_priority updates with s_umount

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect criticaltaskpriority updates with sumount The sysfs store path already takes sumount for GC thread control entries, and ckptthreadioprio is covered as well. criticaltaskpriority also updates checkpoint or GC kthread...

EUVD-2026-80431

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect criticaltaskpriority updates with sumount The sysfs store path already takes sumount for GC thread control entries, and ckptthreadioprio is covered as well. criticaltaskpriority also updates checkpoint or GC kthread...

CVE-2026-89823

CVE-2026-89823 is a race condition in the Linux kernel's DRM subsystem . When drm_dev_register() partially fails (e.g., the render minor registers but the primary minor fails), the unplugged flag is never set. This allows userspace to enter a drm_dev_enter() critical section on the already-regist...

CVE-2026-89823 drm: fix race between partial drm_dev_register() failure and ioctl

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...

CVE-2026-89823 drm: fix race between partial drm_dev_register() failure and ioctl

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...

EUVD-2026-80423

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...

CVE-2026-89811

CVE-2026-89811 affects the Linux kernel in the drm/amdkfd subsystem (AMD KFD driver). The MES (Micro Engine Scheduler) fails to perform a heavy-weight TLB invalidation after unmapping GPU queues—unlike HWS, which does so automatically. This creates a race condition where in-flight DMA descriptors...

EUVD-2026-80411

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

CVE-2026-89811 drm/amdkfd: Add TLB flush after MES queue eviction/suspension

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...