CVE-2026-89676

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. When performing an asynchronous async copy operation, a programming error causes a stale identifier IDR entry to point to memory that has already been reused. This can lead to memory corruption, where the system...

CVE-2026-89558

A flaw was found in the Linux kernel's md/raid10 RAID10 driver. This vulnerability occurs when a RAID10 array is in a degraded state and a device is being recovered while another mirror is still missing. Due to an inverted boolean value, the system incorrectly clears necessary bitmap bits, causin...

CVE-2026-89439

A flaw was found in the Linux kernel's Intel Speed Select Technology ISST driver. A missing NULL check for isstcommon.sstinst during failed socket loading could allow a local attacker to trigger a NULL pointer dereference. This vulnerability could lead to a system crash, resulting in a Denial of...

CVE-2026-81015

A flaw was found in the Linux kernel's AMD PMC Power Management Controller driver. When the amdstbs2dinit function fails during the driver's initialization process, it can lead to unreleased resources, specifically the LPS0 s2idle handler and debugfs directory. This resource leak can corrupt...

CVE-2026-80968

A flaw was found in the ALSA mts64 driver within the Linux kernel. This driver does not properly validate the card index, specifically failing to check for negative ID values when bound via sysfs. A local attacker could exploit this vulnerability to cause an out-of-bounds access, potentially...

CVE-2026-80987

A flaw was found in the Linux kernel's Non-Transparent Bridge NTB transport module. When processing oversized transmit TX buffers, the system fails to properly free the allocated memory, leading to a memory leak. This continuous leakage of memory could eventually exhaust system resources, resulti...

CVE-2026-80945

A flaw was found in the Linux kernel's cryptography module, specifically within the Intel Analytics Accelerator IAA driver. When a hardware error occurs during data decompression, the system attempts to use a software-based fallback. However, due to improper handling of memory buffers during this...

CVE-2026-89675

A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free UAF vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory...

CVE-2026-80990

A flaw was found in the Linux kernel's Thunderbolt networking driver. An issue in the tbnetconnectedwork function can lead to a resource leak. When an unexpected HopID is allocated during an XDomain connection, the ID is not properly released, causing it to remain active without a reference. This...

CVE-2026-89746

A flaw was found in the Linux kernel's tracing component. A local user can exploit a use-after-free vulnerability by registering multiple histogram triggers with the same name. This action causes the kernel to attempt to access freed memory, leading to a system crash and a Denial of Service DoS...

CVE-2026-89743

A flaw was found in the Linux kernel's Network Shared Memory NSM component. A malicious or buggy backend can report a response length larger than the allocated buffer. This can lead to an out-of-bounds read, disclosing adjacent kernel memory to user space. This vulnerability results in informatio...

CVE-2026-89733

A flaw was found in the Linux kernel's USB Video Class UVC gadget driver. This vulnerability occurs in the uvcfunctionbind and uvcfunctionunbind functions, where pointers to freed memory are not properly cleared. This can lead to a use-after-free UAF condition, potentially allowing an attacker to...

CVE-2026-89685

A flaw was found in the Linux kernel's Network File System NFS daemon nfsd. A clock domain mismatch in the clientsstillreclaiming function allows a remote attacker to indefinitely hold the server in a grace period. By sending specific CLAIMPREVIOUS OPEN requests, an attacker can block all...

CVE-2026-89642

A flaw was found in the Linux kernel's Common Internet File System CIFS implementation. When a client extends a file, the cifssetsize function fails to properly zero out the newly extended portion of the page cache. This oversight can lead to stale data from the client's memory being written back...

CVE-2026-89591

A flaw was found in the Linux kernel's accel/rocket module. During error handling in the rocketioctlsubmitjob function, a cleanup routine may attempt to free a job-domain pointer that has not yet been initialized, leading to a NULL pointer dereference. A local attacker could exploit this...

CVE-2026-89587

A flaw was found in the Linux kernel's ACPI Platform Firmware Runtime Update pfrupdate component. The querycapability function, responsible for handling ACPI buffer objects from firmware, performs an unchecked memory copy operation. If the firmware provides an oversized buffer, a stack buffer...

CVE-2026-89578

A flaw was found in the Linux kernel's device mapper I/O dm-io component. When handling DMIOBIO requests, incorrect sector-based accounting for misaligned direct I/O buffers could lead to an infinite loop. This issue can cause I/O operations to hang indefinitely, resulting in a denial of service...

CVE-2026-89573

A flaw was found in the Linux kernel's device mapper dm array component. A local attacker could exploit this vulnerability by providing specially crafted metadata. This crafted metadata causes the system to misinterpret the size of data blocks, leading to an out-of-bounds read. This memory...

CVE-2026-89517

A flaw was found in the Linux kernel's schedext component, which handles core scheduling. When multiple selections on the same core interleave due to a dropped lock, they can corrupt the scheduling state. This corruption can lead to a NULL dereference, tasks remaining active after being dequeued,...

CVE-2026-89444

A flaw was found in the Linux kernel. The dell-wmi-sysman driver, responsible for managing Dell WMI Windows Management Instrumentation system attributes, incorrectly logs sensitive information. Specifically, when setting a BIOS attribute, the driver populates a security buffer with the current...

CVE-2026-80986

A flaw was found in the Linux kernel's SMC-Rv2 network component. A remote attacker could exploit this vulnerability by sending a specially crafted message during an SMC-Rv2 link addition. This can lead to a slab-out-of-bounds write, potentially causing a system crash and resulting in a denial of...

CVE-2026-80983

A flaw was found in the Linux kernel's implementation of the Server Message Block SMB over Remote Direct Memory Access RDMA protocol, specifically within the net/smc component. An error path in the smcswitchconns function, triggered during link failover events, can lead to a socket reference coun...

CVE-2026-80967

A flaw was found in the ALSA pcxhr driver within the Linux kernel. The pcxhrprobe function requests a threaded interrupt before properly initializing a critical mutex mgr-lock. This oversight could allow an early interrupt to operate on an uninitialized mutex, potentially leading to system...

CVE-2026-89712

A flaw was found in the Linux kernel's Network File System Daemon NFSD component. A race condition exists where, during the processing of unmounted source-server mounts, a thread may temporarily release a lock. During this window, another NFS Remote Procedure Call RPC thread can free memory that...

CVE-2026-89542

A flaw was found in the Linux kernel's SUNRPC Sun Remote Procedure Call implementation. This vulnerability, located in the gsskrb5unwrapv2 function, arises when the system processes specially crafted short tokens or tokens with an invalid length. An attacker could exploit this by providing such a...

CVE-2026-80943

A flaw was found in the Linux kernel's rtlwifi driver. This vulnerability occurs when the rtl92dutxfilldesc function uses a Quality of Service QoS Traffic Identifier TID value greater than 8 as an index into an array that only has 9 allocated entries. A remote attacker could potentially exploit...

CVE-2026-89505

A flaw was found in the Linux kernel's RDMA/uverbs component. Malformed input from a provider in the legacy write path can cause the uverbsgethandlerfn function to dereference an uninitialized pointer. This can lead to a system crash, resulting in a denial of service...

CVE-2026-81001

A flaw was found in the Linux kernel's Serial Line Internet Protocol SLIP driver. A race condition in the slsync function allows for a use-after-free vulnerability, where the driver attempts to access a network device pointer after it has been freed. A local attacker could exploit this to cause a...

CVE-2026-89761

A flaw was found in the Linux kernel's AppArmor security module. An out-of-bounds write vulnerability exists when null terminating a label vector due to improper memory allocation. An unprivileged local attacker can exploit this by writing to specific system files, potentially leading to a denial...

CVE-2026-89477

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. This vulnerability occurs when the kernel attempts to complete a stream reconfiguration request that has not been fully transmitted, leading to a null pointer dereference. An unprivileged loc...

CVE-2026-89698

A flaw was found in the Linux kernel's nfsd component. When an IPv6 NFS client is connected, the nfsdgenlrpcstatuscomposemsg function incorrectly handles address fields, leading to an out-of-bounds read. A local unprivileged attacker can exploit this vulnerability to disclose sensitive kernel...

CVE-2026-89663

A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading t...

CVE-2026-89633

A flaw was found in the Linux kernel's Server Message Block SMB client. The coalescet2 function processes server-supplied DataOffset fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-boun...

CVE-2026-89541

A flaw was found in the Linux kernel. Specifically, an integer overflow vulnerability exists in the gssunwrapresppriv function within the SUNRPC component. This flaw occurs when validating the length of RPCSECGSS opaque data. A malicious krb5p Network File System NFS server can send a specially...

CVE-2026-89617

A flaw was found in the Linux kernel's NTFS3 filesystem driver. An attacker with local access could craft a malicious NTFS log file. During log replay, insufficient validation of the lcnsfollow field in a DIRPAGEENTRY could lead to an out-of-bounds write. This memory corruption could result in a...

CVE-2026-89530

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

CVE-2026-89509

A flaw was found in the Linux kernel's RDMA/ionic driver. This vulnerability arises from the driver's incorrect handling of rdmacounter allocations, specifically by not embedding counter driver data as required. This oversight can lead to a NULL pointer dereference when the allocandbind function ...

CVE-2026-89709

A flaw was found in the Linux kernel's lockd and nfsd components. An unguarded dereference of nlmsvcops after the nfsd module is removed can lead to a NULL pointer dereference or a use-after-free condition. This vulnerability could allow a local attacker to cause a denial of service. Mitigation...

CVE-2026-80977

A flaw was found in the Linux kernel's networking subsystem. The skbtxerror function improperly handles shared zerocopy state in socket buffers skbs. When a cloned skb is processed, it can prematurely signal that its pages are free and drop shared fragment flags while the original skb is still in...

CVE-2026-89723

A flaw was found in the nilfs2 file system component of the Linux kernel. When a file is truncated, an intermediate node block is not properly deleted and remains in the B-tree node cache. This can lead to the log writer incorrectly processing the block, resulting in a slab-out-of-bounds memory...

CVE-2026-89628

A flaw was found in the Human Interface Device HID picolcd driver in the Linux kernel. A local attacker with root privileges, by using a specially crafted or spoofed picoLCD device, could exploit an out-of-bounds read vulnerability in the picolcddebugeepromread function. This flaw occurs because...

CVE-2026-89609

A flaw was found in the eCryptfs component of the Linux kernel. A race condition occurs during the cleanup of the daemon message queue because a required lock is not held. This can lead to unpredictable system behavior or instability due to concurrent access to shared message context lists...

CVE-2026-89605

A flaw was found in the ecryptfs component of the Linux kernel. When the ecryptfssendmiscdev function fails to send a message to the userspace daemon, the associated message context is not properly released. This oversight leaves the context on an allocated list, preventing its reuse. Repeated...

CVE-2026-89581

A flaw was found in the Linux kernel's handling of Berkeley Packet Filter BPF programs on x86 architecture. An issue with how per-CPU addresses are resolved into extended registers can lead to incorrect memory access. A local attacker could exploit this by running a specially crafted BPF program...

CVE-2026-89565

A flaw was found in the Linux kernel's IP over IP ipip tunnel driver. When operating in collectmd mode, the ipiptunnelrcv function fails to free a network packet buffer skb if the metadatadst allocation fails. This oversight leads to a memory leak. A local attacker could potentially exploit this...

CVE-2026-89485

A flaw was found in the lockd component of the Linux kernel. This use-after-free vulnerability occurs in the nlmtraversefiles function when a file's memory is prematurely released while an iterator still holds a pointer to it. A remote attacker could potentially exploit this to cause system...

CVE-2026-89481

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

CVE-2026-89461

A flaw was found in the Linux kernel's max17040 power supply driver. A timing issue, known as a race condition, can occur during system suspend. This allows a background process polling callback to continue accessing the fuel gauge and restart itself even after the system suspend has finished. Th...

CVE-2026-89447

A flaw was found in the Linux kernel's iommufd subsystem. A local attacker could exploit a vulnerability where an object reference is leaked during the unmapping of internal accesses. This occurs because the iommufdaccessnotifyunmap function incorrectly locks an object before checking if the acce...

CVE-2026-89436

A flaw was found in the Linux kernel's panasonic-laptop driver. This vulnerability involves an out-of-bounds write when processing ACPI SINF packages, where a small amount of data is written beyond the intended memory buffer. This can lead to a heap overflow, which might cause system instability ...