CVE-2026-89493

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...

UBUNTU-CVE-2026-80983

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-89544

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

UBUNTU-CVE-2026-89544

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

UBUNTU-CVE-2026-89453

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

CVE-2026-89453

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

UBUNTU-CVE-2026-89688

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

UBUNTU-CVE-2026-89493

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...

CVE-2026-80995

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

CVE-2026-89735

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown fmidi2allocinst creates default configfs child groups for the default endpoint and default block using configfsadddefaultgroup, setting their internal refcount to 1...

EUVD-2026-76647

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown fmidi2allocinst creates default configfs child groups for the default endpoint and default block using configfsadddefaultgroup, setting their internal refcount to 1...

CVE-2026-89735 usb: gadget: midi2: remove default configfs groups on teardown

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown fmidi2allocinst creates default configfs child groups for the default endpoint and default block using configfsadddefaultgroup, setting their internal refcount to 1...

CVE-2026-89735

CVE-2026-89735 is a memory leak in the Linux kernel 's USB gadget MIDI 2.0 driver. During function teardown in f_midi2_free_inst() or endpoint cleanup in f_midi2_ep_opts_release(), the function configfs_remove_default_groups() was never called, so the internal refcounts of the default configfs ch...

CVE-2026-89688

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89688

CVE-2026-89688 affects the Linux kernel's nfsd (NFS server) component. In nfs4_preprocess_seqid_op(), when nfsd4_cstate_assign_replay() returns -EAGAIN (replay owner being torn down), the error path incorrectly drops a stateowner reference it never acquired while leaking the stid reference it did...

CVE-2026-89688 nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89688 nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89544 SUNRPC: fix gssx_dec_option_array error path bugs

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

CVE-2026-89544

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

CVE-2026-89544 SUNRPC: fix gssx_dec_option_array error path bugs

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...