CVE-2026-89653

A flaw was found in the Linux kernel's Ceph filesystem. This vulnerability occurs when a malicious or malformed MDSMap exporttargets entry, controlled by a monitor, contains a rank value that exceeds the maximum allowed CEPHMAXMDS during the decoding process. This can lead to an out-of-bounds...

CVE-2026-80956

A flaw was found in the Linux kernel's dm-pcache component. A crafted image can cause the getcachesegment function to return an uninitialized cache segment. This uninitialized segment, containing a null data pointer, is then used by cacheksetclose without a proper null check. This can lead to a...

CVE-2026-80963

A flaw was found in the Linux kernel's dm-stats module. This vulnerability occurs when the allocation of per-CPU data fails, which can lead to a null pointer dereference during the subsequent cleanup operation. This issue can cause the system to crash, resulting in a Denial of Service DoS...

CVE-2026-89741

A flaw was found in the Linux kernel's media subsystem, specifically within the v4l2-dev component. This vulnerability arises from incorrect error handling in the videoregisterdevice function. If a device registration fails, the system attempts to free the same memory region twice, leading to a...

CVE-2026-89674

A flaw was found in the nfsd component of the Linux kernel. Incorrect calculations in the XDR External Data Representation buffer size within the nfsd4ffencodelayoutget function can lead to two critical issues. An attacker could potentially exploit this to write data beyond the intended memory...

CVE-2026-89718

A flaw was found in the zram component of the Linux kernel. This vulnerability occurs because the writebackstore function calculates table scan bounds before acquiring a necessary lock. If the zram device is reinitialized with a smaller disk size during this window, the function may attempt to...

CVE-2026-89437

A flaw was found in the Linux kernel. The sarprobe function, specifically in its error handling paths, fails to free memory allocated for devicemodeinfo by the parsepackage function, which is called by sargetdata. This oversight leads to a memory leak. Repeated occurrences of this flaw could...

CVE-2026-89730

A flaw was found in the altera-cvp FPGA driver within the Linux kernel. The alteracvpsendblock function can perform an out-of-bounds read when processing the trailing bytes of an input buffer. This occurs if the buffer ends at a page or scatterlist boundary, causing the function to read past vali...

CVE-2026-89523

A flaw was found in the Linux kernel's MediaTek mt7925 Wi-Fi driver. When the device is reset, suspended, or unregistered, a pending work item mlopmwork can continue to execute. This can lead to the work item accessing memory that has already been freed a use-after-free vulnerability or sending...

CVE-2026-89474

A flaw was found in the Linux kernel's power supply subsystem, specifically within the bq256xx driver. This vulnerability occurs when a USB work item attempts to access a charger object after it has been freed. This timing issue can lead to a use-after-free condition, potentially causing system...

CVE-2026-89463

A flaw was found in the Linux kernel's ucs1002 power supply driver. The driver does not properly cancel a delayed work item during device removal, leading to a use-after-free vulnerability. This issue allows the system to attempt to access memory that has already been freed, which can result in...

CVE-2026-80940

A flaw was found in the Linux kernel's rtw88 PCI driver. During the probe process, if the NAPI Networked Attached Peripheral Interface setup fails, allocated PCI resources are not properly released. This resource leak could potentially lead to a Denial of Service DoS due to resource exhaustion,...

CVE-2026-89656

A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory workspace, leading to an out-of-bounds write. This memory...

CVE-2026-80982

A flaw was found in the Linux kernel's Shared Memory Communications SMC network protocol. A race condition occurs when a network connection is closed while the system is still processing its receive buffer pages. This can lead to a use-after-free vulnerability, where the system attempts to access...

CVE-2026-89747

A flaw was found in the Linux kernel's tracing component. A local attacker could exploit a use-after-free vulnerability, a type of memory corruption, by manipulating the tracepipe functionality. This occurs when the system attempts to read from memory that has already been released, leading to...

CVE-2026-89604

A flaw was found in the Linux kernel's efivarfs component. An unprivileged local user can exploit this by repeatedly calling the statfs handler on the efivarfs mount point. This action triggers a flood of calls to the QueryVariableInfo runtime service, which is particularly costly on x86 systems...

CVE-2026-89498

A flaw was found in OrangeFS within the Linux kernel. A local client, by sending a specially crafted readdir downcall with a declared trailersize exceeding the actual supplied bytes, can trigger a double-free vulnerability. This memory corruption issue can lead to a system crash, resulting in a...

CVE-2026-89468

A flaw was found in the Linux kernel's lp8788-charger component. During the removal of the lp8788-charger, a race condition can occur where work can be queued and executed after the associated memory has been freed. This use-after-free vulnerability could lead to system instability or a denial of...

CVE-2026-89460

A flaw was found in the Linux kernel. A local user can trigger a kernel panic by running the perf stat command while CPUs are being hotplugged. This occurs because the system fails to properly allocate CPU event structures for newly online CPUs, leading to a null pointer dereference. Successful...

CVE-2026-89442

A flaw was found in the Linux kernel. The isstifclosassoc ioctl function in the platform/x86: ISST module contains an improper validation of the socketid. This allows a local attacker to cause an out-of-bounds access or a NULL pointer dereference. This could lead to a system crash, resulting in a...