CVE-2026-89691

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

UBUNTU-CVE-2026-89691

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

AZL-100587 CVE-2026-89524 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...

CVE-2026-89714 NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegationhashtable leak when nfs4servercommonsetup fails nfs4servercommonsetup allocates server-delegationhashtable first, but server-destroy - the only path that frees the table via nfs4destroyserver - is not assigned...

CVE-2026-89691

CVE-2026-89691 is an out-of-bounds read vulnerability in the Linux kernel's nfsd (Network File System Daemon) component. The nfsd4_release_compoundargs() function resets the args->ops pointer to the inline iops[8] array when the dynamically allocated buffer is freed, but fails to zero args-&gt...

CVE-2026-89691 nfsd: clear opcnt on compound arg release to prevent OOB read

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

CVE-2026-89524

CVE-2026-89524 is an integer underflow in the Linux kernel's ath6kl Wi-Fi driver . In ath6kl_cfg80211_connect_event(), fixed IE offsets are subtracted from assoc_req_len (−4) and assoc_resp_len (−6), both of type u8, with no lower-bound check. When an association request or response is shorter th...

PT-2026-90407

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4 release compoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value...

kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. The rmif3amapgpios function incorrectly allocates memory for the gpiokeymap, making it smaller than required. This allows a device reporting a specific gpiocount value to trigger an out-of-bounds read, leading to information...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100527)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100527 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO...

CVE-2026-64339

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...