CVE-2026-89468

A flaw was found in the Linux kernel's lp8788-charger component. During the removal of the lp8788-charger, a race condition can occur where work can be queued and executed after the associated memory has been freed. This use-after-free vulnerability could lead to system instability or a denial of...

CVE-2026-89472

A flaw was found in the Linux kernel's power supply charger-manager component. A race condition exists where the system frees charger regulators before their corresponding sysfs entries are unregistered. A local attacker can exploit this by performing a concurrent write to a charger's...

CVE-2026-89460

A flaw was found in the Linux kernel. A local user can trigger a kernel panic by running the perf stat command while CPUs are being hotplugged. This occurs because the system fails to properly allocate CPU event structures for newly online CPUs, leading to a null pointer dereference. Successful...

CVE-2026-89706

A flaw was found in the Linux kernel's nfsd component. When an asynchronous async copy writeback operation fails, the server's write verifier is not properly reset. This can lead to a client incorrectly assuming that data has been made durable, resulting in the silent loss of data that was intend...

CVE-2026-89442

A flaw was found in the Linux kernel. The isstifclosassoc ioctl function in the platform/x86: ISST module contains an improper validation of the socketid. This allows a local attacker to cause an out-of-bounds access or a NULL pointer dereference. This could lead to a system crash, resulting in a...

CVE-2026-80959

A flaw was found in the Linux kernel's device-mapper persistent cache dm-pcache component. A local attacker with administrative privileges CAPSYSADMIN could provide a specially crafted cache device, leading to an out-of-bounds read. This vulnerability allows reading past the intended segment data...

CVE-2026-81013

A flaw was found in the hp-bioscfg component of the Linux kernel. A local user could trigger a heap out-of-bounds read by writing an empty string to the currentpassword or newpassword fields. This occurs because the validatepasswordinput function attempts to access memory before the allocated...

CVE-2026-89661

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A local administrator with CAPSYSADMIN capabilities can trigger a use-after-free vulnerability by writing to /proc/fs/nfsd/unlockfilesystem after the NFSD server has shut down. This can lead to memory corruption, potentially...

CVE-2026-89773

A flaw was found in the drm/amd/display component of the Linux kernel. This vulnerability occurs because the High-bandwidth Digital Content Protection HDCP configuration routine is skipped during a transition state when an invalid dmstreamctx is present. This can lead to the HDCP routine not bein...

CVE-2026-89729

A flaw was found in the Linux kernel's Human Interface Device HID sensor-hub driver. A local attacker could exploit this vulnerability by providing a specially crafted HID descriptor. This malicious descriptor could cause the sensorhubgetfeature function to write data beyond the intended memory...

CVE-2026-89601

A flaw was found in the Linux kernel's ext2 filesystem. This vulnerability occurs in the ext2setsize and ext2xattrset2 functions, where inode updates for ISSYNC inodes may be lost. This happens because the syncinodemetadata function only processes inodes that are already marked as dirty, leading ...

CVE-2026-89688

A flaw was found in the Linux kernel's nfsd component. During a seqidop replay retry, the system incorrectly handles reference counts for stateowners, leading to a reference count underflow and a use-after-free vulnerability. This issue could allow an attacker to potentially cause a denial of...

CVE-2026-89502

A flaw was found in the Linux kernel's ring-buffer component. When sub-buffers are configured with a specific memory allocation order greater than zero, the system attempts to free a memory page using an incorrect size. This memory management error can lead to memory corruption, potentially...

CVE-2026-89519

A flaw was found in the Linux kernel's schedext component. Due to a logical error where a stale flag SCXRQBALKEEP could be consumed, the scheduler might incorrectly keep a task running even after it has been dequeued. This could lead to unexpected task management behavior within the kernel...

CVE-2026-89595

A flaw was found in the Linux kernel's fsnotify subsystem, affecting fanotify and inotify. A race condition can occur during concurrent updates to event marks, where the object mask becomes stale. This can lead to a denial of service or information disclosure, as events such as file modifications...

CVE-2026-89673

A flaw was found in the Linux kernel's NFS daemon nfsd. A remote attacker could exploit an error in the XDR External Data Representation padding calculation within the ffencodegetdeviceinfo function. This mismatch between reserved and actual data size leads to the leakage of stale reply-page...

CVE-2026-80964

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture virmidi driver. This vulnerability allows a local user to trigger an out-of-bounds access by manually binding a device via the sysfs interface with an invalid card index. This can lead to system instability or potential...

CVE-2026-80962

A flaw was found in the Linux kernel's dm-pcache component. A local attacker with administrative privileges CAPSYSADMIN could manipulate on-disk cache metadata to provide invalid geometry fields. This manipulation could lead to an out-of-bounds read and write, potentially causing memory corruptio...

CVE-2026-89694

A flaw was found in the Linux kernel's NFSv4.2 server nfsd. An authenticated NFSv4.2 client could exploit a vulnerability in the managecpntfstate function by guessing a state identifier. This improper ownership check allows the client to cancel and free another client's copy-notify stateid, leadi...

CVE-2026-89564

A flaw was found in the Linux kernel's IP multicast forwarding. When a prefetched socket is destroyed, a subsequent operation to free a network packet skb can attempt to access the already freed socket memory. This use-after-free vulnerability can be triggered by a remote attacker sending special...

CVE-2026-80933

A flaw was found in the Linux kernel's mt76: mt7996 Wi-Fi driver. This vulnerability occurs because the driver does not properly validate the size of the default EEPROM Electrically Erasable Programmable Read-Only Memory firmware. A specially crafted, truncated EEPROM firmware file can cause the...

CVE-2026-80927

A flaw was found in the Linux kernel. A race condition in the timekeeping subsystem, specifically within the doadjtimex function, can occur when the auxiliary clock is handled. This allows uninitialized stack data to be used in calculations and subsequently leaked to userspace, leading to...

CVE-2026-89744

A flaw was found in the Linux kernel's device property handling. When the kernel iterates over child nodes of a firmware node fwnode that also has a secondary fwnode, the fwnodegetnextchildnode function can enter an endless loop. This occurs if the secondary fwnode has multiple children, causing...

CVE-2026-89683

A flaw was found in the Linux kernel's nfsd NFS daemon. A remote attacker could exploit this vulnerability by sending a specially crafted NFSv3 filehandle targeting a V4ROOT export's file system identifier fsid. This action triggers a dentry reference leak, which can lead to resource exhaustion a...

CVE-2026-89614

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more clusters than the volume actually has, can lead to an out-of-boun...

CVE-2026-89490

A flaw was found in ocfs2, the Oracle Cluster File System, within the Linux kernel. On 32-bit kernels, an error in how directory cookie positions are calculated can lead to truncation when a directory exceeds 4 Gigabytes GiB in size. This truncation causes the system to repeatedly re-enumerate...

CVE-2026-89736

A flaw was found in the Linux kernel's USB audio gadget driver uaudio. This vulnerability occurs during sound card disconnection when Asynchronous Linux Sound Architecture ALSA control elements kctls remain open in userspace. A local attacker can exploit this timing issue by interacting with thes...

CVE-2026-89524

A flaw was found in the ath6kl Wi-Fi driver of the Linux kernel. An integer underflow vulnerability occurs when processing Wi-Fi association requests or responses that are shorter than expected. This can cause the system to read beyond the intended buffer, leading to the disclosure of adjacent...

CVE-2026-89507

A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the ucmawritecmevent function where it re-reads a critical file pointer multiple times without proper locking. This allows another function, ucmamigrateid, to change the file pointer mid-operation. An...

CVE-2026-80993

A flaw was found in the Linux kernel's net: phylink component. The phylinkinbandcaps function does not correctly validate the return value from macselectpcs, which can return an error pointer instead of a valid Physical Coding Sublayer PCS object. This oversight can lead to dereferencing an inval...

CVE-2026-80947

A flaw was found in the Linux kernel's rtl8xxxu Wi-Fi driver. A race condition exists during the driver's stop process, specifically when handling receive RX Universal Serial Bus USB Request Blocks URBs. This allows a worker to access memory that has already been freed, leading to a use-after-fre...

CVE-2026-89618

A flaw was found in the Linux kernel's eventfs component. When the eventfscreatedir function fails due to memory pressure, an uninitialized internal data structure can cause the system to issue a misleading warning during the cleanup process. This incorrect error reporting could lead to confusion...

CVE-2026-89572

A flaw was found in the cpufreq apple-soc driver of the Linux kernel. The applesoccpufreqinit function, responsible for adding Operating Performance Point OPP tables from firmware, does not properly remove these tables in certain failure scenarios. This improper cleanup can lead to resource...

CVE-2026-89657

A flaw was found in libceph in the Linux kernel. A malicious or compromised authenticated Ceph Object Storage Device OSD peer could send a specially crafted sparse-read reply that lacks proper validation of extent maps. This could cause the client to advance its message-data cursor beyond the...

CVE-2026-89680

A flaw was found in the Linux kernel's nfsd component. This vulnerability occurs when an inter-server COPY operation fails during its setup phase, leading to improper resource cleanup. Consequently, each failed operation results in a memory leak, consuming system resources. A remote attacker coul...

CVE-2026-89563

A flaw was found in the ip6tunnel module of the Linux kernel. Incorrect handling of socket buffers skb during headroom reallocation in the ip6tnlxmit function can lead to a double-free vulnerability. This occurs when an error path is taken after the original skb has been consumed, but the caller...

CVE-2026-89526

A flaw was found in the svcrdma component of the Linux kernel. A remote attacker can exploit this vulnerability by supplying a crafted RPC/RDMA Read chunk position field that is not properly validated against the received inline body length. This can lead to an underflow, exposing adjacent slab...

CVE-2026-80970

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA FireWire Control Protocol FCP subsystem. This vulnerability allows a local attacker to trigger the copying of uninitialized kernel memory to userspace. By sending a specially crafted short or zero-length data stage duri...

CVE-2026-89508

A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the ucmasetibpath function when handling events concurrently with ucmamigrateid. This can allow a local attacker with access to an RDMA device to trigger a use-after-free vulnerability, potentially leading to...

CVE-2026-89766

A flaw was found in the Linux kernel. A local attacker could exploit a race condition in the pidfd subsystem, specifically within the PIDFDGETNAMESPACE ioctls. This vulnerability occurs because the system does not properly hold a lock execupdatelock during credential checks. This allows an attack...

CVE-2026-89765

A flaw was found in the Linux kernel's timers/itimer component. On native sparc64 systems, the struct kerneloldtimeval contains uninitialized padding bytes. When putitimerval copies this structure to userspace, these padding bytes can be exposed, leading to information disclosure. This...

CVE-2026-89732

A flaw was found in the Linux kernel's USB FunctionFS ffs module. A local attacker could exploit a deadlock vulnerability in the ffsep0read function. This occurs when a userspace daemon polls ep0 and the USB gadget is simultaneously torn down, causing the kernel to enter an unresponsive state. Th...

CVE-2026-89721

A flaw was found in the Linux kernel's phy: rockchip-samsung-dcphy component. A local attacker with access to the regmap debugfs interface could trigger an out-of-bounds read by attempting to dump registers. This occurs because the maxregister value is incorrectly set, causing the system to read...

CVE-2026-89714

A flaw was found in the Linux kernel's Network File System NFS component. When an NFSv4 mount attempt fails, the nfs4servercommonsetup function does not properly free a memory allocation for the delegation hash table. A client that persistently retries a failed mount can exploit this to cause an...

CVE-2026-89600

A flaw was found in the Linux kernel's fanotify subsystem. This use-after-free vulnerability occurs when the system attempts to report file range information after the memory holding that information has been released. A local attacker could potentially exploit this to read stale stack memory,...

CVE-2026-89580

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local attacker could exploit a timing issue in the bpfgetstack function. This occurs when a preemptible BPF program is scheduled out, allowing another task to overwrite a per-CPU buffer. This leads to an out-of-bounds...

CVE-2026-89576

A flaw was found in the Linux kernel's device-mapper era dm-era component. When a snapshot operation fails, a block of metadata is allocated but not properly freed. This leads to a permanent leak of system resources with each failed attempt. Over time, this resource exhaustion can result in a...

CVE-2026-89568

A flaw was found in the Linux kernel. The khopreservedmemoryreserve function, responsible for reserving memory, incorrectly calculates the size of these reservations. This issue arises because it uses a 32-bit integer for bit shifting, which limits the maximum reservation size to 2 Gigabytes GiB...

CVE-2026-89704

A flaw was found in the Linux kernel's nfsd component. The nfsdcopyfilerange function incorrectly samples the writeback error cursor after the copy loop. This allows a concurrent write operation to advance the error cursor prematurely. As a result, the system may report that data has been...

CVE-2026-89636

A flaw was found in the Linux kernel's Server Message Block SMB client. When the freetgts function frees data structures, a pointer ce-tgthint is not properly reset, leaving it pointing to a memory location that has already been deallocated. If this pointer is subsequently used, it can lead to a...