CVE-2026-89957

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...

CVE-2026-89956

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist, the matrixdev-guestslock mutex must be held. There are two function...

CVE-2026-89955

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-89954

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...

CVE-2026-89953

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdoops: free page bitmap when the backing MTD is removed mtdoopsnotifyadd allocates oopspageused when the configured MTD device is registered. mtdoopsnotifyremove detaches from that device but leaves the bitmap allocated. I...

CVE-2026-89952

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

CVE-2026-89951

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

CVE-2026-89950

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: linearize skbuff for packet generation batadvmcastforwpacket and batadvmcastforwscrape is not only called indirectly by the unsharing+linearizing batadvrecvmcastpacket handler. When it is called indirectly by...

CVE-2026-89948

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix freeing of claims on meshif deletion When the mesh interface is getting deleted, then batadvbladelbackboneclaims via batadvblapurgebackbonegw could make sure that all claims gets removed. But this function is...

CVE-2026-89949

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: avoid unaligned fault in IP extraction Independent of the alignment of the ARP packet in the SKB, either the batadvarpipsrc or the batadvarpipdst will have an unaligned access on HW without native unaligned read...

CVE-2026-89947

In the Linux kernel, the following vulnerability has been resolved: clk: meson: align gxbb32kclksel number of parents with actual count The following out-of-bounds read has been observed by Christian on a GXBB WeTek Hub: ================================================================== BUG: KASA...

CVE-2026-89946

In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l33: drain threaded IRQ before runtime suspend cs35l33runtimesuspend currently switches the codec into regcachecacheonlytrue and powers it down without first quiescing the threaded IRQ registered by...

CVE-2026-89944

In the Linux kernel, the following vulnerability has been resolved: ASoC: hdachda: Fix hlink refcount leak on component registration failure hdachdadevprobe gets the HDA link with sndhdacextbuslinkget before registering the ASoC component. If component registration fails, the function returns...

CVE-2026-89945

In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l34: drain threaded IRQ before runtime suspend cs35l34runtimesuspend currently switches the codec into regcachecacheonlytrue, asserts reset low, and powers the device off without first quiescing the threaded IRQ...

CVE-2026-89943

In the Linux kernel, the following vulnerability has been resolved: ASoC: loongson: Fix error handling in ACPI property parsing In loongsoncardparseacpi, the return value of devicepropertyreadstring for the codec-dai-name property was ignored. If the property is missing or invalid, an uninitializ...

CVE-2026-89942

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix potential use-after-free in anonymous buffer release An anonymous buffer handle holds a reference to the underlying IIO device. The reference is dropped in the buffer handle's release function. If the device has...

CVE-2026-89941

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Make IIO DMA fence release RCU-safe The dmafence documentation states that if a custom release implementation is provided, the dmafence object must be freed in an RCU-safe way. The current iiodmafence implementation...

CVE-2026-89940

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Tie IIO dma fence lock lifetime to the fence The iiodmafence implementation currently uses a lock embedded in the iiodmabufpriv. But the iiodmafence can outlive the iiodmabufpriv, which can cause a use-after-free. Ti...

CVE-2026-89938

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: use iiotriggerpollnested to fix remove UAF The atlas driver requests its hardware data-ready IRQ with devmrequestthreadedirq; its threaded handler queues an irqwork, atlasworkhandler, that calls...

CVE-2026-89939

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable atlasbufferpostenable acquires a runtime PM reference with pmruntimeresumeandget but returns the result of atlassetinterrupt directly. If atlassetinterrupt...

CVE-2026-89937

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: sgp30: Handle IAQ thread creation failure kthreadrun can fail and return an error pointer, but sgpprobe stores it and returns success, so the device is registered without its IAQ thread and sgpremove later passes t...

CVE-2026-89936

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because t...

CVE-2026-89934

In the Linux kernel, the following vulnerability has been resolved: iio: light: ltrf216a: fix runtime PM reference leak in error path ltrf216agetlux acquires a runtime PM reference by calling ltrf216asetpowerstatedata, true. However, if ltrf216areaddata fails, the function returns immediately...

CVE-2026-89935

In the Linux kernel, the following vulnerability has been resolved: iio: light: apds9306: fix PM reference leak in apds9306readdata apds9306readdata calls pmruntimeresumeandget but several error paths return directly without calling pmruntimeputautosuspend, leaking the runtime PM reference and...

CVE-2026-89933

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: dps310: fix NULL pointer dereference on ACPI probe When the device is enumerated through its ACPI HID IFX3100, i2cclientgetdeviceid returns NULL: the ACPI-derived client name does not match the driver's i2cdeviceid...

CVE-2026-89931

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Ensure KVMREQGETNESTEDSTATEPAGES is cleared on VM-Exit Always check and clear KVMREQGETNESTEDSTATEPAGES when emulating a nested VM-Exit to ensure the request is cleared, even when KVM was built with CONFIGKVMHYPERV=n, ...

CVE-2026-89932

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting lastvpid=0 when allocating vpid02. nestedvmxtransitiontlbflush will always detect a VPID change on first VM-Enter after VMXON,...

CVE-2026-89930

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter KVM services local TLB flushes on "full" nested VM-Exits through nestedvmxvmexit, but not if a nested VM-Enter fails e.g. due to failed VMCS checks in...

CVE-2026-89929

In the Linux kernel, the following vulnerability has been resolved: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1 assigned VPID, after doing some validations on the operands. However...

CVE-2026-89928

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89927

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Fix an issue where userspace or the guest can program an Hyper-V synthetic timer to have a deadline in the past via integer overflow, preventing the CPU from making...

CVE-2026-89925

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory leak in guest debug handling bpdata is freed only for the error case by kfreebpdata. Every successful KVMSETGUESTDEBUG will leak bpdata...

CVE-2026-89926

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

CVE-2026-89924

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix olddata leak in guest debug error path importwpinfo allocates a per-watchpoint olddata buffer to back up the original guest memory contents. If a later watchpoint of the same KVMSETGUESTDEBUG request fails to impor...

CVE-2026-89923

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Free guest debug data on vcpu destroy kvms390clearbpdata is only called from kvmarchvcpuioctlsetguestdebug, i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are...

CVE-2026-89922

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...

CVE-2026-89921

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for injectpfaulttoken kvminjectpfaulttoken only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on...

CVE-2026-89919

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmulock to read gmap-asce Every other dat consumer in this file kvms390getskeys, setskeys, getcmmabits, setcmmabits, MEMCLRCMMA, kvms390fixupprefix, kvmtestagegfn, kvmagegfn reads kvm-arch.gmap-asce inside t...

CVE-2026-89920

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

CVE-2026-89918

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-89917

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

CVE-2026-89916

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...

CVE-2026-89915

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

CVE-2026-89914

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decoderangetlbi helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not...

CVE-2026-89912

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89913

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables iterates dist-lpixa using xaforeach and dereferences the returned struct vgicirq in the loop body without holding a reference on the LP...

CVE-2026-89911

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means i...

CVE-2026-89909

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Free init resources if kvminit fails kvmloongarchinit calls kvmloongarchenvinit to allocate the per-CPU kvmcontext vmcs and kvmloongarchops and to register the perf callbacks, and then calls kvminit. If kvminit...

CVE-2026-89910

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Variable vector is declared on stack in function dmsintcinjectirq and sometimes it is used without initialized. Here fix this issue...

CVE-2026-89908

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVMMRFLAGSONLY kvmarchpreparememoryregion computes new-arch.flags, i.e. whether a memslot is KVMMEMHUGEPAGECAPABLE or KVMMEMHUGEPAGEINCAPABLE, only for KVMMRCREATE and KVMMRMOVE, and...