397891 matches found
CVE-2026-89998 dm: fix race when loading and unloading a table
In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dmsetupmdqueue walks &md-tabledevices without...
CVE-2026-89997 dm: fix resume-vs-remove race
In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in dmdestroy. The result is that the table is destroyed...
CVE-2026-89996 dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...
CVE-2026-89994 dmaengine: fsl-edma: tracing: no ptr dereference during log output
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsledmaengine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no...
CVE-2026-89995 dma-direct: return struct page from dma_direct_alloc_from_pool()
In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dmadirectallocfrompool Commit 5b138c534fda "dma-direct: factor out a dmadirectallocfrompool helper" changed dmadirectallocfrompool to return the CPU address from dmaallocfrompool. That fits...
CVE-2026-89993 dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...
CVE-2026-89992 cpuidle: dt_idle_genpd: kfree() the original name allocation
In the Linux kernel, the following vulnerability has been resolved: cpuidle: dtidlegenpd: kfree the original name allocation dtidlepdalloc kasprintfs the full node path, then points pd-name at kbasename of that string. dtidlepdfree kfrees pd-name, which is no longer the start of the allocation...
CVE-2026-89991 bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...
CVE-2026-89990 ceph: lock mutex in ceph_mds_check_access()
In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in cephmdscheckaccess MDS session OPEN handling replaces mdsc-scapauths under mdsc-mutex, freeing the previous array and its strings. cephmdscheckaccess traverses this array without holding the mutex. A concurren...
CVE-2026-89989 ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
In the Linux kernel, the following vulnerability has been resolved: ima: Check for ERRPTR from dentrypath in validatehashalgo dentrypath returns ERRPTR-ENAMETOOLONG when the path exceeds the buffer. validatehashalgo passes the result straight to integrityauditmsg without checking. ERRPTR is not...
CVE-2026-89988 kprobes: Protect kprobe_blacklist with RCU
In the Linux kernel, the following vulnerability has been resolved: kprobes: Protect kprobeblacklist with RCU withinkprobeblacklist traverses kprobeblacklist without holding kprobemutex. When a module is unloaded, kproberemoveareablacklist removes blacklist entries and immediately frees them with...
CVE-2026-89987 mm/huge_memory: transfer the pmd dirty bit to the folio on zap
In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: transfer the pmd dirty bit to the folio on zap zaphugepmdfolio propagates the pmd young bit to the folio for the file case, but not the dirty bit. The pte path does propagate it, in zappresentfolioptes and so does...
CVE-2026-89986 mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix sleeping allocation in allocpagesbulkweightedinterleave syzbot reported a sleeping function called from invalid context splat in buckettablealloc. When rhashtableinsertslow rehashes the table under rcureadlock, ...
CVE-2026-89984 perf/x86/intel: Fix kernel address leakages in LBR stack
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...
CVE-2026-89985 memcg: keep folio's objcg same as its node
In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits t...
CVE-2026-89983 i2c: core: fix debugfs UAF on adapter removal
In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix debugfs UAF on adapter removal i2cdeladapter frees the adapter's debugfs directory before it unregisters the adapter device, but the newdevice sysfs attribute stays writable until devicedel. A write racing with...
CVE-2026-89982 i2c: mux: Fix channel node leak on adapter add failure
In the Linux kernel, the following vulnerability has been resolved: i2c: mux: Fix channel node leak on adapter add failure i2cmuxaddadapter takes a reference to the Device Tree channel node before registering the new adapter. If adapter registration fails, the error path frees the private data...
CVE-2026-89981 arm64: Don't read GMID_EL1 when MTE is disabled
In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMIDEL1 when MTE is disabled cpuinfostorecpu gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel has disabled MTE CONFIGARM64MTE=n or arm64.nomte. KVM sets HCREL2.TID5 ...
CVE-2026-89980 ALSA: harmony: initialize locks before requesting IRQ
In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ sndharmonycreate registers the IRQ before initializing h-lock and h-mixerlock. A pending interrupt can invoke the handler while these locks are uninitialized. Initialize both...
CVE-2026-89979 ALSA: pcm: Fix race between non-atomic ops and trigger-start
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the concurrent state transitions between atomic PCM ops, but the checks between the non-atomic ops hwparams, hwfree and prepare and the atomic o...
CVE-2026-89977 accel/ethosu: check MMIO mapping errors in probe
In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: check MMIO mapping errors in probe devmplatformioremapresource returns an error pointer when the register resource cannot be mapped. ethosuprobe stores it and continues until initialization dereferences it through...
CVE-2026-89978 accel/amdxdna: return early from a zero-length flush
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: return early from a zero-length flush SYNCBO does not constrain its size, so a request for zero bytes reaches drmclflushvirtrange, which ends with an unconditional clflushoptend - 1. For an empty range that is the...
CVE-2026-89976 accel/ethosu: fix job completion fence cleanup
In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix job completion fence cleanup ethosuioctlsubmitjob allocates donefence before validating buffer handles. Errors after allocation call ethosujoberrcleanup, which frees the job but leaks the uninitialized fence. A...
CVE-2026-89974 nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvmeaddctrl fails nvmfcreatectrl owns the fabrics options and frees them whenever -createctrl returns an error, so a transport must not free them on its own error paths. nvme-fc...
CVE-2026-89975 nvme-fabrics: fix DHCHAP secret leak on parse failure
In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix DHCHAP secret leak on parse failure nvmfparseoptions duplicates dhchapsecret and dhchapctrlsecret with matchstrdup before validating the DHHC-1: representation. If validation fails, the parser returns -EINVAL...
CVE-2026-89973 nvme-tcp: check the data direction of a C2HData PDU
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answer...
CVE-2026-89972 nvme: add missing SRCU grace period in error path
In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvmeallocns error path at outunlinkns removes ns from the namespace head siblings list with listdelrcu&ns-siblings but does not wait for SRCU readers before freeing the namespace...
CVE-2026-89971 nvme: skip the zoned limits update if the zone info query failed
In the Linux kernel, the following vulnerability has been resolved: nvme: skip the zoned limits update if the zone info query failed nvmequeryzoneinfo returns either a negative errno or a positive NVMe status code, but nvmeupdatensinfoblock only tests for the negative case: ret =...
CVE-2026-89970 nvmet-auth: Synchronize timeout work during SQ teardown
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...
CVE-2026-89969 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmettcptryrecvpdu reads a PDU header into the fixed 128-byte queue-pdu union, then computes the remaining payload length as queue-left = hdr-hlen - queue-offset ...
CVE-2026-89967 mm/migrate_device: avoid out-of-bounds writes for compound folios
In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: avoid out-of-bounds writes for compound folios migratedevicerange and migratedevicepfns clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compoun...
CVE-2026-89968 nvmet-tcp: reject unsolicited H2CData PDUs
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that t...
CVE-2026-89966 mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as a fallback to allocate from all nodes. If order is gigantic,...
CVE-2026-89965 nvdimm/btt: reject an arena whose nfree is below the lane count
In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. bttfreelistinit and bttrttinit size the per-lane...
CVE-2026-89964 parisc: eisa: Fix infinite loop when parsing invalid IRQ value
In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invalid IRQ value When an invalid value is passed via the "eisairqedge=" kernel command line parameter e.g. "eisairqedge=16,5", eisairqsetup prints an error message and continues witho...
CVE-2026-89963 powerpc/kexec_file: Fix null-ptr-def in extra size calculation
In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...
CVE-2026-89962 powerpc/kexec_file: Prevent kexec range truncation
In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Prevent kexec range truncation Sashiko AI review pointed out the following issue. The mergememoryranges function incorrectly handles overlapping memory ranges when merging them. Although sortmemoryranges sorts...
CVE-2026-89961 powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addrpfn tracking in compound vmemmap population vmemmappopulatecompoundpages uses addrpfn to determine the PFN offset within a compound page and to decide whether the current vmemmap slot should be populated...
CVE-2026-89960 s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix stale pqaphook pointer on error in vfioapmdevsetkvm In vfioapmdevsetkvm, kvm-arch.crypto.pqaphook is set to &matrixmdev-pqaphook before the update locks are acquired and the mdev list is checked for a conflictin...
CVE-2026-89959 s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix control domain removal in vfioapmdevcfgremove The vfioapconfigremove function uses the bitmapandnot function to clear bits from the matrixmdev-matrix.adm bitmap specifies the control domains assigned to the mdev...
CVE-2026-89958 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...
CVE-2026-89957 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...
CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...
CVE-2026-89956 s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist, the matrixdev-guestslock mutex must be held. There are two function...
CVE-2026-89954 mtd: afs: validate v2 image info bounds
In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...
CVE-2026-89953 mtd: mtdoops: free page bitmap when the backing MTD is removed
In the Linux kernel, the following vulnerability has been resolved: mtd: mtdoops: free page bitmap when the backing MTD is removed mtdoopsnotifyadd allocates oopspageused when the configured MTD device is registered. mtdoopsnotifyremove detaches from that device but leaves the bitmap allocated. I...
CVE-2026-89951 batman-adv: fix stale receive device on merged fragments
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...
CVE-2026-89952 mtd: rawnand: validate ONFI extended parameter page sections
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...
CVE-2026-89950 batman-adv: mcast: linearize skbuff for packet generation
In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: linearize skbuff for packet generation batadvmcastforwpacket and batadvmcastforwscrape is not only called indirectly by the unsharing+linearizing batadvrecvmcastpacket handler. When it is called indirectly by...
CVE-2026-89948 batman-adv: bla: fix freeing of claims on meshif deletion
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix freeing of claims on meshif deletion When the mesh interface is getting deleted, then batadvbladelbackboneclaims via batadvblapurgebackbonegw could make sure that all claims gets removed. But this function is...