CVE-2026-89535

CVE-2026-89535 is a use-after-free vulnerability in the Linux kernel's svcrdma (RDMA-based NFS server) subsystem. In svc_rdma_free(), the call to rdma_destroy_id(sc_cm_id) frees the CM ID while the transport's sc_rn notification entry remains installed in the device's rd_xa xarray until the subse...

CVE-2026-89521

CVE-2026-89521 affects the Linux kernel scheduler (sched/core ). The vulnerability is in core scheduling's pick_next_task() : when a ->pick_task() implementation can release the rq lock, the selection state derived on entry becomes invalid. This can cause the single-CPU fast path to commit an ...

CVE-2026-89520

CVE-2026-89520 affects the Linux kernel's core scheduling subsystem (sched/core). The root cause is a lock-ordering bug in pick_next_task(): when a ->pick_task() call releases the rq lock mid-selection, every sibling __lock becomes momentarily free, allowing __sched_core_flip(false) to complet...

CVE-2026-89507

CVE-2026-89507 is a race condition in the Linux kernel's RDMA/ucma subsystem, specifically in ucma_write_cm_event(). The function re-reads ctx->file for each of its four dereferences, and ucma_migrate_id() can swap that pointer mid-sequence while the writer sleeps inside mutex_lock(). This cau...

CVE-2026-89503

CVE-2026-89503 affects the Linux kernel ring-buffer subsystem. A race condition exists between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set: if subbuf_order changes during the execution of ring_buffer_alloc_read_page(), the resulting bpage->order may not match the actual allo...

CVE-2026-89503 ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ringbufferallocreadpage ringbufferallocreadpage is racy with ringbuffersubbuforderset, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still...

CVE-2026-89501

CVE-2026-89501 affects the Linux kernel ring-buffer subsystem. The vulnerability is a race condition introduced because ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page without holding cpu_buffer->lock, racing with ring_buffer_alloc_read_page() and ring_buffer_free_read_page()...

CVE-2026-89468

This use-after-free vulnerability affects the lp8788-charger driver in the Linux kernel. During device removal, lp8788_charger_remove() flushed charger_work before unregistering IRQs, allowing an IRQ thread to queue work after the flush completed. That work could then run after devres freed the p...

CVE-2026-89461

CVE-2026-89461 affects the Linux kernel's max17040 fuel gauge power supply driver. The root cause is a race condition during system suspend: max17040_work() requeues itself after every poll, and cancel_delayed_work() only cancels a pending instance without waiting for a callback that is already e...

CVE-2026-89451

CVE-2026-89451 is a race condition in the Linux kernel 's iommu/sva subsystem. iommu_attach_device_pasid() installs the SVA attach handle into the group PASID lookup before iommu_sva_bind_device() returns, allowing a concurrent bind to find and reuse the handle after iommu_sva_lock is dropped. Ho...

CVE-2026-80997

CVE-2026-80997 affects the Linux kernel's net: ipa (IP Access) driver. The root cause is a race in ipa_start_xmit(): the TX queue is stopped before calling pm_runtime_get(), and the scheduled wake work (ipa_modem_wake_queue_work()) can execute while the device is still in the RPM_RESUMING state. ...

CVE-2026-80994

This use-after-free affects the Open vSwitch (OVS) subsystem of the Linux kernel . When a flow is deleted via CMD_DEL , the flow->mask pointer is freed via RCU after removal from the flow table, but ovs_flow_cmd_fill_info() still dereferences it before the RCU grace period expires—resulting in...

CVE-2026-80991

CVE-2026-80991 affects the Linux kernel 's ravb network driver. A race condition exists between ravb_ptp_interrupt() and ravb_ptp_stop(): the interrupt handler can pass the PTP clock to ptp_clock_event() while ptp_clock_unregister() is concurrently freeing it, resulting in a use-after-free . The ...

CVE-2026-80980

CVE-2026-80980 affects the Linux kernel 's net/smc (Shared Memory Communications) subsystem. Three connection-state flags—killed, freed, and out_of_sync—are declared as single-bit bitfields sharing one byte in struct smc_connection. Because they are written from different contexts without a commo...

CVE-2026-80967

CVE-2026-80967 affects the Linux kernel 's ALSA pcxhr (O2 Micro) audio driver. The root cause is an initialization-order bug in pcxhr_probe(): the driver calls request_threaded_irq() before initializing mgr->lock, meaning an early interrupt during probe could trigger the threaded handler again...

CVE-2026-80947

A use-after-free in the Linux kernel's rtl8xxxu USB WiFi driver occurs when the rx_urb_wq workqueue worker runs after rtl8xxxu_disconnect() frees the private driver data (priv) via ieee80211_free_hw(). The root cause is that rtl8xxxu_stop() cancels sibling work items but never cancels rx_urb_wq, ...

CVE-2026-80928

CVE-2026-80928 is a Use-After-Free (UAF) vulnerability in the Linux kernel's SMACK security module, specifically in the function smack_file_send_sigiotask() . The root cause is inconsistent credential access: the function first read the subjective credential pointer (tsk->cred) and then the ob...

CVE-2026-80927

CVE-2026-80927 affects the Linux kernel timekeeping subsystem. In __do_adjtimex(), a race condition allows the auxiliary clock to be disabled during tk_get_aux_ts64() and re-enabled before the tks->clock_valid check, causing uninitialized stack data to be used in calculations and indirectly le...

CVE-2026-17106

CVE-2026-17106 — CopyEscape:docker cp container-to-host arbitrary file write HackSpeak distribution mirror. This repository is a distribution mirror of the CopyEscape PoC CVE-2026-17106 published by the Imperva Red Team Ron Masas , with the code identical to upstream; upstream does not include a...

CVE-2026-89099

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this...