246045 matches found
CVE-2026-89915 KVM: arm64: Remove VM-wide VNCR mapping counter
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...
CVE-2026-89914 KVM: arm64: Sign-extend VA for range-based TLBI invalidation
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decoderangetlbi helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not...
CVE-2026-89913 KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables iterates dist-lpixa using xaforeach and dereferences the returned struct vgicirq in the loop body without holding a reference on the LP...
CVE-2026-89912 KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...
CVE-2026-89911 KVM: arm64: Correctly cap TLBI Range to the architural limit
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means i...
CVE-2026-89909 LoongArch: KVM: Free init resources if kvm_init() fails
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Free init resources if kvminit fails kvmloongarchinit calls kvmloongarchenvinit to allocate the per-CPU kvmcontext vmcs and kvmloongarchops and to register the perf callbacks, and then calls kvminit. If kvminit...
CVE-2026-89910 LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Variable vector is declared on stack in function dmsintcinjectirq and sometimes it is used without initialized. Here fix this issue...
CVE-2026-89908 LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVMMRFLAGSONLY kvmarchpreparememoryregion computes new-arch.flags, i.e. whether a memslot is KVMMEMHUGEPAGECAPABLE or KVMMEMHUGEPAGEINCAPABLE, only for KVMMRCREATE and KVMMRMOVE, and...
CVE-2026-89907 LoongArch: KVM: Validate MSI data before routing it to EIOINTC
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pchmsisetirq passes e-msi.data straight into eiointcsetirq as the irq number. The MSI data comes from userspace, that either via a KVMIRQROUTINGMSI entry set with...
CVE-2026-89906 LoongArch: BPF: Refactor jump offset calculation in tail call
In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...
CVE-2026-89905 LoongArch: BPF: Move arena register slot below TCC context
In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arenavmstart is dynamically enabled, it shifts the relative...
CVE-2026-89903 LoongArch: Do not save/restore percpu base register in rethook trampoline
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...
CVE-2026-89904 LoongArch: Fix acpi_package_ids[] array overflow
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix acpipackageids array overflow With LoongArch virt machine, a typical setting is one core per socket, there will max 256 sockets packages on one VM. With PPTT acpi table, array acpipackageids will be overflowed. Her...
CVE-2026-89902 LoongArch: Avoid preempt count underflow without probe
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...
CVE-2026-89901 media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2videounregisterdevice on disconnect to fix NULL deref airspydisconnect clears s-udev under v4l2lock, but airspystopstreaming unconditionally calls airspyctrlmsg and airspyfreestreambufs afterwards. If a...
CVE-2026-89900 media: cec: core: Fix kmemleak due to missed rc_free_device() call
In the Linux kernel, the following vulnerability has been resolved: media: cec: core: Fix kmemleak due to missed rcfreedevice call The commit dccc0c3ddf8f "media: rc: fix race between unregister and urb/irq callbacks" removed the implicit call to rcfreedevice from rcunregisterdevice. However, the...
CVE-2026-89899 media: cec: disable delayed work before freeing an interrupted transmit
In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in waitforcompletionkillable. If that wait is interrupted by a signal, canceldelayedworksync...
CVE-2026-89898 media: cec: extron-da-hd-4k-plus: add sanity check
In the Linux kernel, the following vulnerability has been resolved: media: cec: extron-da-hd-4k-plus: add sanity check Add check to prevent overflowing msg.msg in case the incoming data is malformed...
CVE-2026-89897 media: cec: Serialize exclusive follower delivery
In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cecreceivenotify reads the exclusive follower pointer without the adapter lock. Serialize the no-follower check and message delivery against mode changes and release...
CVE-2026-89896 media: cedrus: fix memory leak in cedrus_init_ctrls()
In the Linux kernel, the following vulnerability has been resolved: media: cedrus: fix memory leak in cedrusinitctrls In cedrusinitctrls, the V4L2 control handler is initialized before allocating memory for ctx-ctrls. If this allocation fails, the function returns -ENOMEM without freeing the...
CVE-2026-89894 media: cx231xx: reject geometry changes while the VBI queue is busy
In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...
CVE-2026-89895 media: cobalt: Avoid freeing ALSA private data twice
In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice sndcobaltcardcreate stores cobsc in sc-privatedata and installs sndcobaltcardprivatefree as sc-privatefree. From that point, sndcardfreesc releases cobsc through the ALSA card...
CVE-2026-89893 media: cx23885: cancel NetUP CI work before teardown
In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netupciexit frees a netupcistate while its work item, netupreadcistatus, may still be pending or running on the system workqueue. The worker obtains the state with containerof...
CVE-2026-89892 media: em28xx: defer audio-only extension registration
In the Linux kernel, the following vulnerability has been resolved: media: em28xx: defer audio-only extension registration The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before devnext is created. The duplicate device inherits...
CVE-2026-89890 media: go7007: defer the ALSA v4l2 put until card release
In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007sndinit already takes a v4l2device reference for the ALSA side, but go7007sndremove drops it immediately after calling sndcardfreewhenclosed. That is too early when ...
CVE-2026-89891 media: em28xx: fix use-after-free of dev_next->devlist on disconnect
In the Linux kernel, the following vulnerability has been resolved: media: em28xx: fix use-after-free of devnext-devlist on disconnect When a device with hasdualts=1 is probed and the isaudioonly path is taken, both dev and dev-devnext are added to the global em28xxdevlist via em28xxinitextension...
CVE-2026-89889 media: i2c: imx415: Release runtime PM reference on VBLANK error
In the Linux kernel, the following vulnerability has been resolved: media: i2c: imx415: Release runtime PM reference on VBLANK error The VBLANK path returned immediately when programming VMAX failed after pmruntimegetifinuse had taken a runtime PM reference. Break out of the switch instead so the...
CVE-2026-89887 media: i2c: ov7740: fix use-after-destroy in remove
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740remove function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a...
CVE-2026-89888 media: i2c: ov02a10: fix endpoint parsing use-after-free
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov02a10: fix endpoint parsing use-after-free The ov02a10checkhwcfg function calls fwnodehandleputep immediately after allocating and parsing the endpoint. However, it subsequently calls fwnodepropertyreadu32 using the...
CVE-2026-89886 media: intel/ipu6: fix async notifier cleanup leak on parse error
In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix async notifier cleanup leak on parse error isysnotifierinit calls v4l2asyncnfinit and then adds fwnode remote subdevs in a loop with v4l2asyncnfaddfwnoderemote. If an endpoint parse or add fails partway...
CVE-2026-89884 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Add the missing sanity check after looking up the SCP to avoid dereferencing a NULL-pointer in case its driver has not yet been bound...
CVE-2026-89885 media: platform: mtk-mdp3: Fix SCP device refcounting
In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: Fix SCP device refcounting mdpprobe first tries to get the SCP handle with scpget. When that fails, it falls back to looking up the SCP platform device with getpdevbyid and then reads its driver data. T...
CVE-2026-89883 media: rc: sunxi-cir: Unregister rc device on probe failure
In the Linux kernel, the following vulnerability has been resolved: media: rc: sunxi-cir: Unregister rc device on probe failure After rcregisterdevice succeeds, later probe failures must undo the registration with rcunregisterdevice. The current error path jumps to the allocation cleanup label an...
CVE-2026-89882 media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow
In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTERREFPICSETPRED index underflow strefpicsetprediction computes the reference RPS index as strpsidx - deltaidxminus1 + 1 per HEVC spec equation 7-59. Both operands are u8, so when deltaidxminus1 + 1...
CVE-2026-89880 media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: release URBs and stream buffers on startstreaming failure rtl2832sdrstartstreaming calls rtl2832sdrallocstreambufs, rtl2832sdrallocurbs and rtl2832sdrsubmiturbs in sequence and shares a single err: label that...
CVE-2026-89881 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...
CVE-2026-89879 media: s2255: bound JPEG frame size before copying into the buffer
In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...
CVE-2026-89877 media: saa7164: fix cleanup on resource allocation failure
In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164devsetup adds the device to the global saa7164devlist before requesting the PCI BAR memory regions. If getresources fails, saa7164devsetup decrements the device...
CVE-2026-89878 media: s2255: check firmware size before reading trailing marker
In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob fw-datafwsize - 8 and fwsize - 4. If the firmware file is shorter than 8...
CVE-2026-89876 media: tda18250: fix possible integer overflow
In the Linux kernel, the following vulnerability has been resolved: media: tda18250: fix possible integer overflow Integer overflow may occur, when variable exp equals to zero. Result of shift 1 exp - 1 may then leads to undefined behavior...
CVE-2026-89875 media: ti: vpe: quiesce overflow recovery before freeing streams
In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: quiesce overflow recovery before freeing streams The VIP overflow recovery worker is armed from the hardirq handler when a FIFO overflow is detected, and the list-complete path looks the stream up through the VPDM...
CVE-2026-89874 media: v4l2-async: avoid deleting unlinked ASC entry on link error
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2asyncmatchnotify creates ancillary media links before adding asc-ascsubdeventry to sd-asclist. If ancillary link creation fails, the function jumps to...
CVE-2026-89873 media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC EXT SPS RPS counts The HEVC SPS control carries the short-term and long-term RPS counts that decoder drivers use to walk the matching EXT SPS dynamic arrays. Reject SPS values that exceed the HEVC...
CVE-2026-89872 media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix fwnode leak in v4l2fwnodeparselink In v4l2fwnodeparselink, the remote endpoint fwnode reference is acquired using fwnodegraphgetremoteendpoint. This reference is properly released in the error paths, but i...
CVE-2026-89870 media: zoran: Avoid freeing a registered video_device twice
In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered videodevice twice zoraninitvideodevice installs zoranvdevrelease as the videodevice release callback through zorantemplate. After videoregisterdevice succeeds, videounregisterdevice drops...
CVE-2026-89871 media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthreadvidcap on failure kthreadrun returns an ERRPTR on failure, not NULL. When startstreaming fails, data-kthreadvidcap is left holding this error pointer instead of being...
CVE-2026-89869 media: qcom: iris: use disable_irq() during power-off
In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...
CVE-2026-89868 media: chips-media: wave5: Add timeout while stop_streaming
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add timeout while stopstreaming When stopstreaming is called, an infinite loop may occur in some cases. Add a bounded poll of the queue status: loop until the queues drain, sleeping briefly between poll...
CVE-2026-89867 media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Defer jobfinish only when a DECPIC was queued Decoder instances sharing a VPU also share one v4l2m2m job slot, released when the running context calls v4l2m2mjobfinish. While draining, devicerun defers...
CVE-2026-89866 media: chips-media: wave5: Resume device before setting EOS flag
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Resume device before setting EOS flag Setting the EOS flag talks to the firmware via sendfirmwarecommand, which accesses VPU registers. Both the STREAMOFF path wave5vpudecjobabort and the V4L2DECCMDSTOP...