CVE-2026-89807

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

CVE-2026-89806

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fbsize calculation The framebuffer size calculation fbsize = linebytes height can overflow when both values are large e.g., 46341 46341 INTMAX. Since linebytes and height are both int...

CVE-2026-89805

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Fix folio allocation fallback and use-after-put drmpagemapmigratepopulaterampfn had two issues when populating RAM PFNs with higher-order folios: 1. The higher-order vmaallocfolio/folioalloc calls did not pass...

CVE-2026-89804

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migration maps migration buffers with pagesize and records that length in dmainfo-size. For a compound folio pagesize is PAGESIZE 0 folio this...

CVE-2026-89803

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event before the fence context nouveauchanneldel tears the fence context down first and only drops the channel-kill subscription later, in the middle of the nvif object teardown: if...

CVE-2026-89802

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...

CVE-2026-89801

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OPUNMAPSPARSE In nouveauuvmmbindjobsubmit's OPUNMAPSPARSE arm, op-reg is set from nouveauuvmaregionfind, which only looks the region up and takes no reference; a region's sole...

CVE-2026-89800

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty and defers the teardown to nouveauuvmmbindjobcleanup; it does not remove the...

CVE-2026-89799

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstackid The getperfcallchain call needs disabled preemption plus we need it disabled as long as we access its returned trace entries buffer. Note the bpfgetstackidpe function is executed already...

CVE-2026-89798

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...

CVE-2026-89797

In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500fg: fix use-after-free on remove ab8500fgremove destroys the driver workqueue while the threaded interrupt handlers are still armed; they are devm-managed and freed only after -remove returns, so a handler th...

CVE-2026-89796

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamondmergeregions internal loop Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races", v1.1. Sashiko found a few issues in DAMON that could cause infinite loop, NULL...

CVE-2026-89795

In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, which use a machine level hypervisor, PCI devices are always accessed through a form of PCI pass-through which fundamentally operates on a per PCI...

CVE-2026-89794

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero pipe read compound padding Compound response handling extends the last response iov to an eight-byte boundary. smb2readpipe allocates only the payload size, so the alignment padding can expose up to seven bytes of...

CVE-2026-76151

Out-of-bounds read buffer over-read in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service application crash via an excessively large Cache-Control header value...

CVE-2026-89793

In the Linux kernel, the following vulnerability has been resolved: ublk: clear VMMAYWRITE on read-only ublk char device mmap ublkchmmap rejects mmap requests with VMWRITE set, but never clears VMMAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue...

CVE-2026-84501

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

CVE-2026-79993

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

CVE-2026-59969

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

CVE-2026-59739

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-89792

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate IPC share configuration payload sizes before consuming variable-length fields. Bound veto list parsing and account for the separator byte when deriving the pat...

CVE-2026-89791

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

CVE-2026-89790

In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid divide by zero in rt6multipathrebalance rt6multipathrebalance calculates the total eligible nexthop weight in one pass and programs upper bounds in a second pass. Since RTMNEWROUTE is RTNL-free, a concurrent...

CVE-2026-89788

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...

CVE-2026-89789

In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronizenet in gtpnewlink error path to prevent use-after-free gtpnewlink's error path frees tidhash and addrhash without waiting for an RCU grace period after clearing skuserdata. A concurrent gtpencaprecv in softirq...

CVE-2026-89787

In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4searchdir For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name EXT4DIRENTHASHES, at an offset derived from de-namelen. On the...

CVE-2026-89786

In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4readinlinedir ext4readinlinedir can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64: BUG: KASAN: slab-out-of-bounds in...

CVE-2026-89785

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEXROOT in reparse/objid init ntfsreparseinit and ntfsobjidinit parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles the INDEXROOT attributes named $R and $O. They read i...

CVE-2026-89784

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2026-89783

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...

CVE-2026-89782

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16MAX entries During $LogFile replay, logreplay indexes the transaction table by the transactid taken from the log record header. checklogrec only verifies that transactid is non-zero...

CVE-2026-89781

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...

CVE-2026-89779

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

CVE-2026-89780

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub-frame with allocskb and leaves skb-dev NULL. rmnetmapingresshandler assigns skb-dev = ep-egressdev only on the data path, but a M...

CVE-2026-89778

In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofsuncompressblock's empty-block fast path returns pcount 17, so a crafted "ZF" Rock Ridge record can set it below PAGESHIFT; the bug is reached by an ordinary...

CVE-2026-89777

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

CVE-2026-89776

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla accepts a payload shorter th...

CVE-2026-89775

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

CVE-2026-85501

Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is...

CVE-2026-82720

NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths i.e., RPZ drop query, jostle due to heavy traffic, a dropped DoH stream brings down the whole DoH session and does n...

CVE-2026-82717

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to...

CVE-2026-81642

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remot...

CVE-2026-81634

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a...

CVE-2026-80225

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolize...

CVE-2026-78227

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffe...

CVE-2026-77955

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones zonemd-check: yes which are located below but not at a trust anchor allow for an attack window where tampered with zone contents are served or stored to disk prior to the ZONEMD integrity check. Th...

CVE-2026-77860

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

CVE-2026-89774

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

CVE-2026-92091

A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large keyops array to an application that...