CVE-2026-89847

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid double completion in async IOCB timeout qla2x00asynciocbtimeout tries to abort a timed-out async IOCB. When qla24xxasyncabortcmd fails, both the SRBLOGINCMD path and the SRBCTRLVP/default path scan...

CVE-2026-89844

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap without the lock. That...

CVE-2026-89845

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid reqqmap double-read in qla2x00errorentry qla2x00errorentry reads ha-reqqmapque twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xxfreereqque ha-reqqmapqueid =...

CVE-2026-89843

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

CVE-2026-89842

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started qlanvmexmtlsrsp bails out to the out: label when firmware is not started !ha-flags.fwstarted, but the out: path unconditionally calls qlanvmelsrejectiocb, which ends in...

CVE-2026-89841

In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...

CVE-2026-89833

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fsfsyncnodepages There is potential deadloop in race condition: Thread A Thread B - fsync - f2fsdosyncfile - f2fsfsyncnodepages - lastfsyncdnode - foliogetlastfolio - f2fssetattr -...

CVE-2026-89837

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in findinlevel findinlevel gets a dentry folio with f2fsfinddatafolio before calling findinblock. If findinblock returns an error, the function stores the error in resfolio and breaks out of the loop...

CVE-2026-89834

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

CVE-2026-89839

In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fsxattradviseset f2fsxattradviseset calls inodeownerorcapable with &nopmntidmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to t...

CVE-2026-89838

In the Linux kernel, the following vulnerability has been resolved: f2fs: limit recovery filename logging to stored length F2FS stores recovery filenames as a length plus a fixed-size iname buffer. The buffer is not NUL-terminated, but recoverinode and recoverdentry print it with %s. For a 255-by...

CVE-2026-89840

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVERANGE destination size F2FSIOCMOVERANGE checks the source range, but not the destination end before updating isize. A source hole can expose this: cloneblkaddrs skips NULLADDR entries and returns success, so th...

CVE-2026-89835

In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpointmerge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fsissueckpt there, but ckptthreadioprio is...

CVE-2026-89836

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

CVE-2026-89829

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to pass folio-index to f2fssanitychecknodefooter Otherwise in f2fssanitychecknodefooter, it will check the same nid incorrectly...

CVE-2026-89831

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect criticaltaskpriority updates with sumount The sysfs store path already takes sumount for GC thread control entries, and ckptthreadioprio is covered as well. criticaltaskpriority also updates checkpoint or GC kthread...

CVE-2026-89832

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage...

CVE-2026-89830

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In allocatedatablock, when allocating a new data block dn-datablkaddr == NULLADDR, incvalidblockcount is called first to increment totalvalidblockcount and iblocks...

CVE-2026-89825

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthorinitcsiface and panthorinitcsgiface validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are...

CVE-2026-89828

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...

CVE-2026-89827

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid force-completing uninitialized UVD rings uvdv70swinit does not initialize the UVD decode ring for an SR-IOV VF. However, amdgpuuvdresume unconditionally force-completes the decode ring when restoring its fence...

CVE-2026-89826

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthorfwreadbuildinfo checks whether the metadata range fits in the firmware image with hdr.metastart + hdr.metasize. Both fields are u32, so the addition can wrap and let an...

CVE-2026-89823

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...

CVE-2026-89824

In the Linux kernel, the following vulnerability has been resolved: drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter reference on probe failure e.g. probe deferral and on driver unbind also if a devicetree redundantly uses the 'ddc-i2c-bus' property to point ...

CVE-2026-89822

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driverdata in i915pciprobe pcimatchdevice can return the dummy pcideviceidany entry when a device is force-bound via sysfs driveroverride, in which case -driverdata is unset NULL. i915pciprobe casts i...

CVE-2026-89820

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dclock leak on GPU reset error paths On GPU reset, dmsuspend takes dclock and leaves it for dmresume to drop. If amdgpudmcommitzerostreams or dmdmubhwinit fails, the function returns with the lock still held...

CVE-2026-89818

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...

CVE-2026-89819

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC degamma path, which is guarded by amdgpudmverifylutsizes, the per-plane degamma LUT size was never validated before use. setdmplanedegamma...

CVE-2026-89821

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid divide-by-zero in islutlinear islutlinear computes the expected value of each entry with expected = i MAXDRMLUTVALUE / size - 1; If it is ever called with a single-entry LUT, size - 1 is zero and the kernel...

CVE-2026-89810

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix error path at svmmigratecopytoram If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn,...

CVE-2026-89811

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

CVE-2026-89812

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-89814

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...

CVE-2026-89815

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt-restore after successful restore ttmpoolrestoreandalloc can successfully complete the restore process via ttmpoolrestorecommit, but tt-restore is not dropped afterward. As a result, subsequent backup/restore flow...

CVE-2026-89817

In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...

CVE-2026-89809

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89813

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. Its hw...

CVE-2026-89816

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmcrtccommit leak if signaled when PAGEFLIPEVENT is used Commit 1c6ceeee6ebb "drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits" fixed a very similar issue when the event was allocated by...

CVE-2026-89805

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Fix folio allocation fallback and use-after-put drmpagemapmigratepopulaterampfn had two issues when populating RAM PFNs with higher-order folios: 1. The higher-order vmaallocfolio/folioalloc calls did not pass...

CVE-2026-89808

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

CVE-2026-89806

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fbsize calculation The framebuffer size calculation fbsize = linebytes height can overflow when both values are large e.g., 46341 46341 INTMAX. Since linebytes and height are both int...

CVE-2026-89804

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migration maps migration buffers with pagesize and records that length in dmainfo-size. For a compound folio pagesize is PAGESIZE 0 folio this...

CVE-2026-89802

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...

CVE-2026-89807

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

CVE-2026-89803

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event before the fence context nouveauchanneldel tears the fence context down first and only drops the channel-kill subscription later, in the middle of the nvif object teardown: if...

CVE-2026-86585

The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker who controls the delivery of an update to install unauthorised firmware...

CVE-2026-89801

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OPUNMAPSPARSE In nouveauuvmmbindjobsubmit's OPUNMAPSPARSE arm, op-reg is set from nouveauuvmaregionfind, which only looks the region up and takes no reference; a region's sole...

CVE-2026-89800

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty and defers the teardown to nouveauuvmmbindjobcleanup; it does not remove the...

CVE-2026-89794

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero pipe read compound padding Compound response handling extends the last response iov to an eight-byte boundary. smb2readpipe allocates only the payload size, so the alignment padding can expose up to seven bytes of...

CVE-2026-89797

In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500fg: fix use-after-free on remove ab8500fgremove destroys the driver workqueue while the threaded interrupt handlers are still armed; they are devm-managed and freed only after -remove returns, so a handler th...