CVE-2026-89858

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

CVE-2026-89857

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

CVE-2026-89856

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha-msixcount is u16, but ha-maxreqqueues, ha-maxrspqueues and ha-maxqpairs are u8. Deriving the queue count as "ha-maxreqqueues = ha-msixcount - 1" therefore...

CVE-2026-89855

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize flash version read in reset handler The "update cache versions without reset" sysfs reset operation 0x20261 calls getflashversion, which reads hardware flash registers, without holding ha-optrommutex. The...

CVE-2026-89853

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace freed and cleared ha-fce while holding only fcemutex. The firmware-dump consumers qla27xxfwdtentryt264 and qla25xxcopyfce read ha-fce NULL check...

CVE-2026-89854

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xxputchip drops the last reference to ha-cs84xx and frees it via qla84xxchiprelease without clearing ha-cs84xx. During teardown it ran before scsiremovehost, which is...

CVE-2026-89852

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

CVE-2026-89851

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace enable parsing in debugfs qla2x00dfsfcewrite called kstrtoul with a NULL result pointer, so a successful parse would dereference NULL and oops. Worse, the int return value 0 on success, negative errno...

CVE-2026-89850

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Don't query firmware state while chip is down qla2x00fwstateshow initializes rval to QLAFUNCTIONFAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued...

CVE-2026-89849

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

CVE-2026-89848

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxxdeleteqpair deletes the request queue before the response queue. qla25xxdeletereqque frees the request queue memory kfreereq in qla25xxfreereqque, but the...

CVE-2026-89847

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid double completion in async IOCB timeout qla2x00asynciocbtimeout tries to abort a timed-out async IOCB. When qla24xxasyncabortcmd fails, both the SRBLOGINCMD path and the SRBCTRLVP/default path scan...

CVE-2026-89846

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...

CVE-2026-89845

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid reqqmap double-read in qla2x00errorentry qla2x00errorentry reads ha-reqqmapque twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xxfreereqque ha-reqqmapqueid =...

CVE-2026-89844

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap without the lock. That...

CVE-2026-89843

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

CVE-2026-89842

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started qlanvmexmtlsrsp bails out to the out: label when firmware is not started !ha-flags.fwstarted, but the out: path unconditionally calls qlanvmelsrejectiocb, which ends in...

CVE-2026-89841

In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...

CVE-2026-89840

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVERANGE destination size F2FSIOCMOVERANGE checks the source range, but not the destination end before updating isize. A source hole can expose this: cloneblkaddrs skips NULLADDR entries and returns success, so th...

CVE-2026-89839

In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fsxattradviseset f2fsxattradviseset calls inodeownerorcapable with &nopmntidmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to t...

CVE-2026-89838

In the Linux kernel, the following vulnerability has been resolved: f2fs: limit recovery filename logging to stored length F2FS stores recovery filenames as a length plus a fixed-size iname buffer. The buffer is not NUL-terminated, but recoverinode and recoverdentry print it with %s. For a 255-by...

CVE-2026-89837

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in findinlevel findinlevel gets a dentry folio with f2fsfinddatafolio before calling findinblock. If findinblock returns an error, the function stores the error in resfolio and breaks out of the loop...

CVE-2026-89836

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

CVE-2026-89835

In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpointmerge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fsissueckpt there, but ckptthreadioprio is...

CVE-2026-89834

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

CVE-2026-89833

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fsfsyncnodepages There is potential deadloop in race condition: Thread A Thread B - fsync - f2fsdosyncfile - f2fsfsyncnodepages - lastfsyncdnode - foliogetlastfolio - f2fssetattr -...

CVE-2026-89832

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage...

CVE-2026-89831

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect criticaltaskpriority updates with sumount The sysfs store path already takes sumount for GC thread control entries, and ckptthreadioprio is covered as well. criticaltaskpriority also updates checkpoint or GC kthread...

CVE-2026-89830

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In allocatedatablock, when allocating a new data block dn-datablkaddr == NULLADDR, incvalidblockcount is called first to increment totalvalidblockcount and iblocks...

CVE-2026-89829

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to pass folio-index to f2fssanitychecknodefooter Otherwise in f2fssanitychecknodefooter, it will check the same nid incorrectly...

CVE-2026-89828

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...

CVE-2026-89827

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid force-completing uninitialized UVD rings uvdv70swinit does not initialize the UVD decode ring for an SR-IOV VF. However, amdgpuuvdresume unconditionally force-completes the decode ring when restoring its fence...

CVE-2026-89826

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthorfwreadbuildinfo checks whether the metadata range fits in the firmware image with hdr.metastart + hdr.metasize. Both fields are u32, so the addition can wrap and let an...

CVE-2026-89825

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthorinitcsiface and panthorinitcsgiface validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are...

CVE-2026-89824

In the Linux kernel, the following vulnerability has been resolved: drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter reference on probe failure e.g. probe deferral and on driver unbind also if a devicetree redundantly uses the 'ddc-i2c-bus' property to point ...

CVE-2026-89823

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...

CVE-2026-89822

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driverdata in i915pciprobe pcimatchdevice can return the dummy pcideviceidany entry when a device is force-bound via sysfs driveroverride, in which case -driverdata is unset NULL. i915pciprobe casts i...

CVE-2026-89821

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid divide-by-zero in islutlinear islutlinear computes the expected value of each entry with expected = i MAXDRMLUTVALUE / size - 1; If it is ever called with a single-entry LUT, size - 1 is zero and the kernel...

CVE-2026-89820

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dclock leak on GPU reset error paths On GPU reset, dmsuspend takes dclock and leaves it for dmresume to drop. If amdgpudmcommitzerostreams or dmdmubhwinit fails, the function returns with the lock still held...

CVE-2026-89819

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC degamma path, which is guarded by amdgpudmverifylutsizes, the per-plane degamma LUT size was never validated before use. setdmplanedegamma...

CVE-2026-89818

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...

CVE-2026-89817

In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...

CVE-2026-89816

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmcrtccommit leak if signaled when PAGEFLIPEVENT is used Commit 1c6ceeee6ebb "drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits" fixed a very similar issue when the event was allocated by...

CVE-2026-89815

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt-restore after successful restore ttmpoolrestoreandalloc can successfully complete the restore process via ttmpoolrestorecommit, but tt-restore is not dropped afterward. As a result, subsequent backup/restore flow...

CVE-2026-89814

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...

CVE-2026-89813

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. Its hw...

CVE-2026-89812

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-89811

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

CVE-2026-89810

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix error path at svmmigratecopytoram If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn,...

CVE-2026-89809

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...