CVE-2026-80980

A flaw was found in the Linux kernel's SMC Server Message Block over Remote Direct Memory Access protocol implementation. A concurrency issue exists where three connection state flags killed, freed, and outofsync share a single byte in the smcconnection structure without proper locking mechanisms...

CVE-2026-80953

A flaw was found in the Linux kernel's i3c master driver. A race condition exists where the adii3cmasterprobe function requests an interrupt and unmasks a register before a critical lock xferqueue.lock is properly initialized. This allows a pending interrupt to attempt to acquire an uninitialized...

CVE-2026-80946

A flaw was found in the Linux kernel's FUSE Filesystem in Userspace component. The io-uring transport attempts to copy request headers directly to or from user space without proper memory validation. A local attacker could exploit this vulnerability, leading to a kernel panic and a denial of...

CVE-2026-89725

A flaw was found in the Linux kernel's media: cec: stm32 driver. A remote attacker can exploit an out-of-bounds write vulnerability by sending an overlong Consumer Electronics Control CEC message without an end-of-message signal. This causes the driver to write beyond an allocated buffer,...

CVE-2026-89697

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When setting file attributes using nfsdprocsetattr, a specific code path BOTHTIMESET branch prematurely verifies file handles. This bypasses a critical write verification step fhwantwrite, allowing file attribute changes to...

CVE-2026-81002

A flaw was found in the Linux kernel's XDP eXpress Data Path component. Incorrect handling of zero-copy frame layout in the xdpconvertzctoxdpframe function can allow an AFXDP zero-copy packet, when redirected through cpumap, to cause a memory corruption. This can lead to a slab-out-of-bounds erro...

CVE-2026-89658

A flaw was found in the Linux kernel's Network File System Daemon NFSD. During NFSv4.0 revoked-state cleanup, a race condition can occur where a client's state identifier stateid reference does not properly prevent the client from being prematurely freed while still in use. This use-after-free...

CVE-2026-89669

A flaw was found in the nfsd component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted OFFLOADCANCEL operation, leading to a race condition that...

CVE-2026-89659

A flaw was found in the Linux kernel's Network File System Daemon NFSD. This use-after-free vulnerability occurs during the delegation revoke process. When an expired delegation is unhashed, a timing window exists where the client can be prematurely freed before the revocation is complete. This c...

CVE-2026-89538

A flaw was found in the Linux kernel's Server Unix Remote Procedure Call SUNRPC component. A remote attacker, with a valid Generic Security Service GSS context, could send a specially crafted Kerberos v2 wrap token with an oversized "extra count" ec field. This improper handling of malformed toke...

CVE-2026-89550

A flaw was found in the Linux kernel's SUNRPC svcauthgss module. A remote attacker could send a specially crafted Kerberos krb5 token with an insufficient length. This could lead to a division-by-zero error within the gsskrb5unwrapv2 function, resulting in a Denial of Service DoS for the affected...

CVE-2026-89482

A flaw was found in the nvme-tcp module of the Linux kernel. This vulnerability arises from improper handling of C2HData for REQOPWRITEZEROES commands, where the system fails to adequately validate the data length. A remote attacker could exploit this by sending specially crafted C2HData, leading...

CVE-2026-89687

A flaw was found in the Linux kernel's Network File System Daemon nfsd. The nfsdfiledoacquire function might attempt to use a file that has not been fully opened, as the -atomicopen operation could return success prematurely. While this scenario is considered highly improbable, it could lead to...

CVE-2026-89684

A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOADCANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a denial of service DoS by causing the server to crash. Mitigati...

CVE-2026-89650

A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph monitor, or an on-path attacker, can send a specially crafted Metadata Server MDS map. This map, with an oversized numexporttargets field and a per-MDS info version of 2 or 3, can trigger an out-of-bounds read in...

CVE-2026-89631

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

CVE-2026-89560

A flaw was found in the Linux kernel's Landlock security module. This vulnerability allowed for the creation of 'whiteout' objects without proper permission checks. Whiteout objects are special files used in OverlayFS to hide underlying files, and their unauthorized creation could lead to...

CVE-2026-89537

A flaw was found in the Linux kernel's SUNRPC implementation, specifically within the gsskrb5verifymicv2 function. A remote malicious Network File System NFS server could provide a specially crafted, short Kerberos Message Integrity Code MIC token. This could lead to the kernel reading past an...

CVE-2026-89516

A flaw was found in the Linux kernel's schedext component. When a Deferred Scheduling Queue DSQ is destroyed, a pending deferred re-enqueue DRU operation might still attempt to access the destroyed DSQ. This can lead to a BUGON condition, causing a kernel panic and resulting in a Denial of Servic...

CVE-2026-89504

A flaw was found in the Linux kernel's regulator subsystem. This vulnerability arises from a programming error where a device tree node pointer is released too early, creating a "dangling pointer"—a reference to memory that is no longer valid. This can lead to system instability, potentially...

CVE-2026-89480

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

CVE-2026-89475

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the bq24257 power supply driver. This issue occurs when the STAT-pin interrupt handler attempts to reschedule work and access memory that has already been freed during the device removal process. This can lead to syste...

CVE-2026-89464

A flaw was found in the Linux kernel's twl4030charger driver. When the driver's remove function is called, it fails to properly cancel pending worker tasks. This oversight allows a worker to attempt to access memory that has already been deallocated, leading to a use-after-free vulnerability. A...

CVE-2026-89467

A flaw was found in the Linux kernel's qcombattmgr component. This flaw is a use-after-free vulnerability that occurs because the qcombattmgrpdrnotify function can queue enablework even after the associated battmgr object has been deallocated. A local attacker could exploit this by triggering the...

CVE-2026-89446

A flaw was found in the Linux kernel's iommufd component. When the system attempts to store an Input/Output Address Space IOAS object and the storage operation fails, the IOAS object's associated resources, such as its write lock and object reference, are not properly released. This oversight can...

CVE-2026-81010

A flaw was found in the Linux kernel's iouring/waitid component. The iowaitidcb function, when running from a kernel worker, fails to properly acknowledge task work cancellation. This oversight causes the dowait function to execute within an incorrect task context, which is critical as waitid...

CVE-2026-80981

A flaw was found in the Linux kernel's net/smc component. A local attacker could exploit a use-after-free vulnerability in the smcllcsrvaddlink function, where a freed memory region is improperly accessed. This can lead to memory corruption and potentially result in a denial of service DoS...

CVE-2026-80971

A flaw was found in the ALSA bcd2000 driver of the Linux kernel. When a USB device using this driver is disconnected while a rawmidi substream is still active, the driver fails to clear the Universal Serial Bus Request Block URB pointers. This oversight allows a local attacker to trigger a...

CVE-2026-80958

A flaw was found in the dm-pcache component of the Linux kernel. The tail-kset read operations, used by cachereplay, the writeback worker, and the garbage collection GC worker, incorrectly calculate the length of the data region. This error causes the system to read beyond the intended segment da...

CVE-2026-89690

A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...

CVE-2026-89686

A flaw was found in the Linux kernel's Network File System Daemon nfsd for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service DoS. This occurs when the nfsd4alloclayoutstateid function accesses a file pointer without proper locking...

CVE-2026-89679

A flaw was found in the Linux kernel's nfsd component. A remote attacker can exploit this by sending a specially crafted SETATTR request that includes specific delegation timestamp attributes and a special NFSv4 state ID. This triggers a null dereference, leading to a kernel crash and a Denial of...

CVE-2026-89660

A flaw was found in the Linux kernel's Network File System Daemon NFSD. This vulnerability, a use-after-free, occurs during the revocation of client administrative states. A race condition can allow a client's memory to be freed prematurely while still being referenced, potentially leading to...

CVE-2026-89652

A flaw was found in the Linux kernel's Ceph file system. A malicious or compromised Ceph Metadata Server MDS can send a specially crafted LOOKUPNAME reply that causes a buffer overflow when copying dentry names during an NFS export operation. This out-of-bounds write can lead to memory corruption...

CVE-2026-89596

A flaw was found in the Linux kernel's forcedeth driver. An off-by-one error in the nvsuspend and nvresume functions, which handle saving and restoring non-PCI configuration space, can lead to an out-of-bounds memory access. This occurs during system suspend and resume operations. If specific...

CVE-2026-89511

A flaw was found in the qede driver in the Linux kernel. Under specific memory pressure conditions, the driver can encounter a NULL pointer dereference when processing network traffic using TPA TCP Segmentation Offload continuation fragments. This issue stems from an uninitialized data pointer,...

CVE-2026-89495

A flaw was found in ocfs2 in the Linux kernel. A malicious or compromised node within a Distributed Lock Manager DLM cluster can send specially crafted messages with unchecked length fields. This can lead to a heap out-of-bounds write, potentially allowing for arbitrary code execution, or an...

CVE-2026-89489

A flaw was found in the Linux kernel. The sysor1katomic syscall, specific to the openrisc architecture, does not adequately validate user-provided pointers. An unprivileged process can exploit this by supplying kernel addresses to the syscall, gaining unauthorized read and write access to kernel...

CVE-2026-80936

A flaw was found in the Linux kernel's mt7925 Wi-Fi driver. During multi-link power-save setup, the mlopmwork is queued with a delay but not properly cancelled when the device is stopped. This can lead to the work item attempting to access a deallocated workqueue, resulting in a kernel warning an...

CVE-2026-89654

A flaw was found in the Ceph file system component of the Linux kernel. A race condition exists in the checknewmap function during session handling. This allows a local attacker to exploit a use-after-free vulnerability by freeing a session while another thread attempts to access it. This could...

CVE-2026-89648

A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph Metadata Server MDS could send a specially crafted reply with an unbounded number of delegated inode intervals. This could cause the client to enter an infinite loop or exhaust memory resources, leading to a denia...

CVE-2026-89644

A flaw was found in the Linux kernel's btrfs filesystem. When performing direct I/O writes in a NOCOW No Copy-On-Write range, an extent map reference may not be properly released if an error occurs during extent creation. This oversight can lead to an extent map leak, potentially causing memory...

CVE-2026-89630

A flaw was found in the Linux kernel's Server Message Block SMB client. An incorrect calculation of the dataoffset bound in the isvalidoplockbreak function can lead to a read overflow. This vulnerability allows a malicious SMB server to potentially trigger an out-of-bounds read, which could resul...

CVE-2026-89624

A flaw was found in the Linux kernel's universal-pidff driver. This vulnerability occurs when the force-feedback initialization fails, leaving a hidraw character device active. A local attacker can exploit this by opening the device, leading to a use-after-free condition where the system attempts...

CVE-2026-89598

A flaw was found in the Linux kernel's fbdev framebuffer device subsystem, specifically within the ssd1307fb driver. This vulnerability occurs when display damage callbacks, which handle updates to the display, perform synchronous I2C Inter-Integrated Circuit transfers from an atomic context. Thi...

CVE-2026-89566

A flaw was found in the Linux kernel's jbd2 component. When the kernel's journaling block device jbd2 processes busy checkpoint buffers, it can skip a crucial rescheduling check. This oversight can lead to prolonged holding of a critical lock, causing other central processing units CPUs to wait...

CVE-2026-89553

A flaw was found in the Linux kernel's nouveau/gem component. A race condition exists where the graphics execution manager GEM close path can close a virtual memory area VMA while an information lookup is still trying to access it. This timing issue leads to a use-after-free vulnerability, which...

CVE-2026-89547

A flaw was found in the Linux kernel's SUNRPC component. A local administrator, under specific conditions of memory pressure or fault injection during RPC server startup, can trigger a failure in per-CPU counter allocation. This failure leads to uninitialized counters, which, when subsequently...

CVE-2026-89527

A flaw was found in the Linux kernel's svcrdma module. This vulnerability occurs when a listener creation fails, leading to an improper release of a network namespace reference. This resource leak can be exploited by a local attacker, potentially causing a denial of service DoS by exhausting syst...

CVE-2026-89515

A flaw was found in the Linux kernel's SCSI core component. When processing data transfers using scatter-gather lists, the system does not properly initialize padding bytes for unaligned data elements. This can result in the exposure of uninitialized memory, potentially allowing a local attacker ...