CVE-2026-89550

CVE-2026-89550 is a division-by-zero vulnerability in the Linux kernel's SUNRPC svcauth_gss module. The function svcauth_gss_unwrap_priv() enforces only an upper-bound check on the wire-supplied token length, allowing tokens of 16 bytes or less (the RFC 4121 header size) to reach gss_krb5_unwrap_...

CVE-2026-89549

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svcpoolforcpu svcsetnumthreads spreads the requested threads evenly across the service's pools base = nrservs / svnrpools. When a service runs fewer threads than it has pools -- e.g. an nfsd...

CVE-2026-89549

CVE-2026-89549 is a Denial of Service vulnerability in the Linux kernel's sunrpc subsystem (used by nfsd). When a service runs fewer threads than available pools—for example, nfsd configured with fewer threads than the host's NUMA nodes in pernode or percpu mode—svc_xprt_enqueue() can route a tra...

CVE-2026-89549 sunrpc: route to a populated pool in svc_pool_for_cpu()

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svcpoolforcpu svcsetnumthreads spreads the requested threads evenly across the service's pools base = nrservs / svnrpools. When a service runs fewer threads than it has pools -- e.g. an nfsd...

CVE-2026-89531 svcrdma: Reject connection when transport allocation fails

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject connection when transport allocation fails handleconnectreq returns without action when svcrdmacreatexprt fails to allocate the new transport. The CM core returns 0 for CONNECTREQUEST events, so it does not destro...

CVE-2026-89531 svcrdma: Reject connection when transport allocation fails

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject connection when transport allocation fails handleconnectreq returns without action when svcrdmacreatexprt fails to allocate the new transport. The CM core returns 0 for CONNECTREQUEST events, so it does not destro...

CVE-2026-89506

CVE-2026-89506 affects the Linux kernel RDMA/uverbs subsystem. The root cause is a missing UVERBS_ATTR_UHW attribute in the UVERBS_METHOD_REG_MR ioctl definition. Three drivers—mthca , irdma , and siw —associate UHW data with reg_mr but assume the udata pointer is non-NULL. Because the attribute ...

CVE-2026-89477

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctpprocessstrresetoutreq, sctpprocessstrresetaddstrmout and sctpprocessstrresetresp complete a pending stream reconfiguration request by stopping the reconf timer on the...

CVE-2026-89457 s390/dasd: Guard sysfs discipline callbacks against unallocated private data

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device-private, either directly or through the DASDDEFINEATTR macro. Duri...

EUVD-2026-76332

In the Linux kernel, the following vulnerability has been resolved: iouring/query: cap user size passed to copystructtouser iohandlequeryentry clamps hdr.size for the inbound copyfromuser but keeps the original user value as usize. copystructtouser uses that usize and, when it is larger than the...

CVE-2026-81009 io_uring/query: cap user size passed to copy_struct_to_user

In the Linux kernel, the following vulnerability has been resolved: iouring/query: cap user size passed to copystructtouser iohandlequeryentry clamps hdr.size for the inbound copyfromuser but keeps the original user value as usize. copystructtouser uses that usize and, when it is larger than the...

CVE-2026-81009

In the Linux kernel, the following vulnerability has been resolved: iouring/query: cap user size passed to copystructtouser iohandlequeryentry clamps hdr.size for the inbound copyfromuser but keeps the original user value as usize. copystructtouser uses that usize and, when it is larger than the...

CVE-2026-80998

In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr-kickpending = 1. The normal TX path handles this, but the SW USO...

CVE-2026-80997

A race condition in the Linux kernel's IP Accelerator (IPA) network driver can cause a permanent transmit (TX) queue stall after a runtime resume. The function ipa_start_xmit() stops the TX queue and relies on a work item (ipa_modem_wake_queue_work()) to restart it, but that work is queued before...

CVE-2026-80997 net: ipa: fix stalled modem TX queue after runtime resume

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipastartxmit unconditionally stops the TX queue before calling pmruntimeget, relying on the wake scheduled by runtime resume ipamodemwakequeuework to restart it once power...

CVE-2026-80998 net: bnxt: ring the doorbell when SW USO exits early

In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr-kickpending = 1. The normal TX path handles this, but the SW USO...

EUVD-2026-76320

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipastartxmit unconditionally stops the TX queue before calling pmruntimeget, relying on the wake scheduled by runtime resume ipamodemwakequeuework to restart it once power...

CVE-2026-80989

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the connection down when bringing it up fails Every failure path in tbnetconnectedwork undoes its own work and returns without clearing loginsent, so the connection still looks established. The next...

CVE-2026-80957

CVE-2026-80957 affects the dm-pcache subsystem in the Linux kernel . The function cache_replay() traverses the on-media last-kset chain via next_cache_seg_id without calling cond_resched(). A forged chain that points back into an already-visited segment causes the replay loop to iterate indefinit...

CVE-2026-80957 dm-pcache: detect a cycle in the last-kset chain during replay

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: detect a cycle in the last-kset chain during replay cachereplay follows the on-media last-kset chain by nextcachesegid with no condresched. A forged chain that points back into a segment it has already visited makes th...