CVE-2026-89545

A flaw was found in the Linux kernel. This vulnerability exists within the sunrpc component, where memory associated with rqargp and rqresp is freed prematurely. Specifically, the svcrqstfree function frees these structures synchronously, while the main request structure rqstp is freed later via...

CVE-2026-81000

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

CVE-2026-80944

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. When a synchronous command's wait operation is interrupted, the driver can attempt to write data to a memory location that has already been released. This memory corruption can lead to a system crash kernel panic, resulting in a Denial ...

CVE-2026-80934

A flaw was found in the Linux kernel's mt76: mt7996 Wi-Fi driver. The driver incorrectly manages Direct Memory Access DMA mappings when processing AddBA request frames, causing a continuous leak of these mappings. Over time, this resource exhaustion can lead to a Denial of Service DoS for the Wi-...

CVE-2026-89772

A flaw was found in the Btrfs filesystem of the Linux kernel. This vulnerability allows a local attacker with write access to a memory-mapped file to modify data while it is being written to disk. This can lead to data corruption, where the integrity of the stored information is compromised, or...

CVE-2026-89758

A flaw was found in the Linux kernel's memory management subsystem. When an HMM-based Graphics Processing Unit GPU driver migrates a Transparent Huge Page THP to device memory, it can leave a device-private Page Middle Directory PMD entry. If a user-space application then attempts to manage this...

CVE-2026-89756

A flaw was found in the Linux kernel. When performing memory migration on KVM Kernel-based Virtual Machine hosts, the migratepagesbatch function fails to report RCU Read-Copy Update tasks quiescent states during large batch unmapping operations. This oversight causes the migrating task to become ...

CVE-2026-89751

A flaw was found in the Linux kernel's x86/tdx component. An off-by-one error in the handlein and handleout functions, specifically in the GENMASK calculation for port I/O operations, causes the mask to be one bit too wide. This incorrect handling of I/O sizes could potentially lead to unintended...

CVE-2026-89742

A flaw was found in the Linux kernel. A local user could exploit a use-after-free vulnerability in the dmareqfree function within the RapidIO mport character device interface. This flaw occurs when the dmareqfree function attempts to dereference a freed object after dropping the last reference to...

CVE-2026-89701

A flaw was found in the Linux kernel's Network File System Daemon nfsd. The TIMEDELEGACCESS and TIMEDELEGMODIFY decode paths do not properly validate the nanosecond nseconds value in timestamps. This allows a remote attacker to provide a malformed timestamp, which can then be written to disk,...

CVE-2026-89771

A flaw was found in the Linux kernel. A race condition exists in the ring buffer resizing mechanism, where tracebuffer subbufsize can be read without proper locking while it is being simultaneously resized. This could allow a local attacker to trigger unpredictable behavior or a denial of service...

CVE-2026-89760

A flaw was found in the Linux kernel's memory management mm and swap subsystem. This vulnerability occurs when the swapfreehibernationslot function incorrectly frees a hibernation slot while a memory page folio is still present in the swap cache. This can lead to silent memory corruption, process...

CVE-2026-89757

A flaw was found in the Linux kernel's memory management unit MMU, specifically within the multi-generational Least Recently Used mglru mechanism. A bug in how the kernel handles unevictable memory pages can lead to these pages remaining locked in memory even after they should be released. This c...

CVE-2026-89753

A flaw was found in the Linux kernel's memory management subsystem. The shrinklruvec function, responsible for memory reclaim, fails to properly report Read-Copy-Update RCU task quiescent states on systems with preemption enabled. This can lead to RCU task stalls, causing system unresponsiveness ...

CVE-2026-89720

A flaw was found in the Linux kernel's Unsorted Block Image File System UBIFS. An incorrect bounds check in the ubifssbverifysignature function allows a crafted signed UBIFS image to declare a signature length larger than its actual size. This can lead to an out-of-bounds read when processing the...

CVE-2026-89722

A flaw was found in the Linux kernel's PCI/sysfs component. A local user with root privileges could trigger an out-of-bounds read in the pciwritelegacyio function by writing to the legacyio sysfs file with a size less than four bytes. This improper handling of the write buffer can lead to memory...

CVE-2026-89710

A flaw was found in the Linux kernel's NFSv4.1 implementation. When a server returns a new layout state identifier while an existing one is still active, the pnfslayoutprocess function fails to properly release memory associated with layout segments. This oversight leads to a memory leak, which...

CVE-2026-80930

A flaw was found in the Linux kernel's TPM I2C Nuvoton driver. The i2cnuvotonwaitforstat function enables an interrupt IRQ but fails to disable it if the wait operation times out or is interrupted. This oversight can lead to an unbalanced IRQ state, potentially causing system instability or...

CVE-2026-89655

A flaw was found in the Linux kernel's Ceph file system component. A race condition exists in the kickflushingcaps function during the handling of capability messages. This allows a separate process to free a data structure cf entry while kickflushingcaps is still iterating over it. This...

CVE-2026-89638

A flaw was found in the Linux kernel's Server Message Block SMB client. When a file with the setuid or setgid bit is written to on certain Common Internet File System CIFS mounts specifically those using 'cifsacl', 'modefromsid' options, or SMB3.1.1 POSIX extensions, the kernel fails to properly...

CVE-2026-89623

A flaw was found in the Linux kernel's HID Human Interface Device mcp2221 driver. This vulnerability occurs when the device's input/output IO operations are not properly stopped before hardware teardown during device removal or probe failure. This timing issue can lead to a use-after-free...

CVE-2026-89612

A flaw was found in the Linux kernel's NTFS filesystem driver. A local attacker could provide a specially crafted NTFS boot sector containing an invalid Master File Table MFT Logical Cluster Number LCN. Due to an integer overflow during parsing, this could lead to an out-of-bounds memory access...

CVE-2026-89574

A flaw was found in the Linux kernel's device mapper dm array component. Insufficient validation of array block headers during read operations allows a local attacker to craft a malicious on-disk nrentries value. This can lead to an out-of-bounds read from the dm-bufio buffer, potentially resulti...

CVE-2026-89567

A flaw was found in the Linux kernel's jbd2 shrinker. This component, which manages journal buffers, does not correctly account for busy checkpoint buffers. This oversight can cause the shrinker to hold a critical system lock for an extended period when processing many busy buffers. The prolonged...

CVE-2026-89559

A flaw was found in the Linux kernel's libnvdimm/labels component. An integer overflow vulnerability exists in the ndlabelvalidate function, where a 32-bit calculation of a namespace index field nslot can wrap around. This allows a local attacker, or an attacker with control over the storage...

CVE-2026-89557

A flaw was found in the Linux kernel's Multiple Device md driver. A local attacker with control over a malicious disk image could provide a specially crafted on-disk superblock with an invalid 'bblogshift' value. This invalid value can lead to an integer overflow when processing bad block...

CVE-2026-89540

A flaw was found in the Linux kernel's sunrpc component. A race condition exists where the gssplock mutex is not initialized before its associated /proc/net/rpc/use-gss-proxy entry is published. This allows a local attacker to trigger a scenario where multiple writers can concurrently access the...

CVE-2026-89484

A flaw was found in the Linux kernel's lockd component. This vulnerability occurs when the Network Lock Manager NLM client attempts to initialize file lock operations without successfully allocating a lockowner. This can lead to a NULL pointer dereference during the release of the file lock,...

CVE-2026-89445

A flaw was found in the Linux kernel's iommufd selftest component. This Use-After-Free UAF vulnerability occurs when the TRIGGERIOPF function borrows an attach handle without proper synchronization during a PASID detach operation. A concurrent device fault report can then access memory that has...

CVE-2026-89440

A flaw was found in the Linux kernel's mmc: via-sdmmc component. During the probe process, if the mmcaddhost function fails, the SD card-detect interrupt handler continues to operate on memory that has already been released. This can lead to memory corruption, potentially allowing a local attacke...

CVE-2026-81012

A flaw was found in the Linux kernel's hp-bioscfg component. The hpgetstringfrombuffer function contains an off-by-one write vulnerability. This occurs because the NUL terminator can be written one byte beyond the allocated buffer, leading to a buffer overflow. An attacker could potentially explo...

CVE-2026-80998

A flaw was found in the Linux kernel's bnxt network driver. When processing a burst of packets, the driver may fail to notify the network device ring the doorbell if the Software UDP Segmentation Offload SW USO path exits prematurely. This oversight can lead to a transmit TX queue stall, renderin...

CVE-2026-80980

A flaw was found in the Linux kernel's SMC Server Message Block over Remote Direct Memory Access protocol implementation. A concurrency issue exists where three connection state flags killed, freed, and outofsync share a single byte in the smcconnection structure without proper locking mechanisms...

CVE-2026-80953

A flaw was found in the Linux kernel's i3c master driver. A race condition exists where the adii3cmasterprobe function requests an interrupt and unmasks a register before a critical lock xferqueue.lock is properly initialized. This allows a pending interrupt to attempt to acquire an uninitialized...

CVE-2026-80946

A flaw was found in the Linux kernel's FUSE Filesystem in Userspace component. The io-uring transport attempts to copy request headers directly to or from user space without proper memory validation. A local attacker could exploit this vulnerability, leading to a kernel panic and a denial of...

CVE-2026-89725

A flaw was found in the Linux kernel's media: cec: stm32 driver. A remote attacker can exploit an out-of-bounds write vulnerability by sending an overlong Consumer Electronics Control CEC message without an end-of-message signal. This causes the driver to write beyond an allocated buffer,...

CVE-2026-89697

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When setting file attributes using nfsdprocsetattr, a specific code path BOTHTIMESET branch prematurely verifies file handles. This bypasses a critical write verification step fhwantwrite, allowing file attribute changes to...

CVE-2026-81002

A flaw was found in the Linux kernel's XDP eXpress Data Path component. Incorrect handling of zero-copy frame layout in the xdpconvertzctoxdpframe function can allow an AFXDP zero-copy packet, when redirected through cpumap, to cause a memory corruption. This can lead to a slab-out-of-bounds erro...

CVE-2026-89658

A flaw was found in the Linux kernel's Network File System Daemon NFSD. During NFSv4.0 revoked-state cleanup, a race condition can occur where a client's state identifier stateid reference does not properly prevent the client from being prematurely freed while still in use. This use-after-free...

CVE-2026-89669

A flaw was found in the nfsd component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted OFFLOADCANCEL operation, leading to a race condition that...

CVE-2026-89659

A flaw was found in the Linux kernel's Network File System Daemon NFSD. This use-after-free vulnerability occurs during the delegation revoke process. When an expired delegation is unhashed, a timing window exists where the client can be prematurely freed before the revocation is complete. This c...

CVE-2026-89550

A flaw was found in the Linux kernel's SUNRPC svcauthgss module. A remote attacker could send a specially crafted Kerberos krb5 token with an insufficient length. This could lead to a division-by-zero error within the gsskrb5unwrapv2 function, resulting in a Denial of Service DoS for the affected...

CVE-2026-89538

A flaw was found in the Linux kernel's Server Unix Remote Procedure Call SUNRPC component. A remote attacker, with a valid Generic Security Service GSS context, could send a specially crafted Kerberos v2 wrap token with an oversized "extra count" ec field. This improper handling of malformed toke...

CVE-2026-89482

A flaw was found in the nvme-tcp module of the Linux kernel. This vulnerability arises from improper handling of C2HData for REQOPWRITEZEROES commands, where the system fails to adequately validate the data length. A remote attacker could exploit this by sending specially crafted C2HData, leading...

CVE-2026-89687

A flaw was found in the Linux kernel's Network File System Daemon nfsd. The nfsdfiledoacquire function might attempt to use a file that has not been fully opened, as the -atomicopen operation could return success prematurely. While this scenario is considered highly improbable, it could lead to...

CVE-2026-89684

A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOADCANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a denial of service DoS by causing the server to crash. Mitigati...

CVE-2026-89650

A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph monitor, or an on-path attacker, can send a specially crafted Metadata Server MDS map. This map, with an oversized numexporttargets field and a per-MDS info version of 2 or 3, can trigger an out-of-bounds read in...

CVE-2026-89631

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

CVE-2026-89560

A flaw was found in the Linux kernel's Landlock security module. This vulnerability allowed for the creation of 'whiteout' objects without proper permission checks. Whiteout objects are special files used in OverlayFS to hide underlying files, and their unauthorized creation could lead to...

CVE-2026-89537

A flaw was found in the Linux kernel's SUNRPC implementation, specifically within the gsskrb5verifymicv2 function. A remote malicious Network File System NFS server could provide a specially crafted, short Kerberos Message Integrity Code MIC token. This could lead to the kernel reading past an...