CVE-2026-89977

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: check MMIO mapping errors in probe devmplatformioremapresource returns an error pointer when the register resource cannot be mapped. ethosuprobe stores it and continues until initialization dereferences it through...

CVE-2026-89950

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: linearize skbuff for packet generation batadvmcastforwpacket and batadvmcastforwscrape is not only called indirectly by the unsharing+linearizing batadvrecvmcastpacket handler. When it is called indirectly by...

CVE-2026-89967

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: avoid out-of-bounds writes for compound folios migratedevicerange and migratedevicepfns clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compoun...

CVE-2026-89993

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...

CVE-2026-89990

In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in cephmdscheckaccess MDS session OPEN handling replaces mdsc-scapauths under mdsc-mutex, freeing the previous array and its strings. cephmdscheckaccess traverses this array without holding the mutex. A concurren...

CVE-2026-89998

In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dmsetupmdqueue walks &md-tabledevices without...

CVE-2026-89937

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: sgp30: Handle IAQ thread creation failure kthreadrun can fail and return an error pointer, but sgpprobe stores it and returns success, so the device is registered without its IAQ thread and sgpremove later passes t...

CVE-2026-89942

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix potential use-after-free in anonymous buffer release An anonymous buffer handle holds a reference to the underlying IIO device. The reference is dropped in the buffer handle's release function. If the device has...

CVE-2026-90017

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...

CVE-2026-90031

In the Linux kernel, the following vulnerability has been resolved: usb-storage: eneub6250: fix race between scan work and probe eneub6250probe calls usbstorprobe2, which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls enegetcardtype, which sends a...

CVE-2026-90014

In the Linux kernel, the following vulnerability has been resolved: tracing: Have showeventfilters/triggers files take trace array ref The newly added files showeventfilters and showeventtriggers that show all filters or triggers that are set within the trace array do not take a reference for the...

CVE-2026-90008

In the Linux kernel, the following vulnerability has been resolved: scsi: megaraidsas: Limit NVMe request size to the PRP chain frame megasasmakeprpnvme builds a command's PRP list in cmd-sgframe, a DMA pool buffer of instance-maxchainframesz bytes, spending one entry per NVMe page of the transfe...

CVE-2026-90005

In the Linux kernel, the following vulnerability has been resolved: samples/damon/wsse: handle damonstart failure Patch series "samples/damon: handle damonstart,stop failures". All DAMON sample modules are not correctly handling failures from damonstart. Among those, mtier also has an additional...

CVE-2026-89999

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

CVE-2026-89911

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means i...

CVE-2026-89914

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decoderangetlbi helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not...

CVE-2026-89938

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: use iiotriggerpollnested to fix remove UAF The atlas driver requests its hardware data-ready IRQ with devmrequestthreadedirq; its threaded handler queues an irqwork, atlasworkhandler, that calls...

CVE-2026-89947

In the Linux kernel, the following vulnerability has been resolved: clk: meson: align gxbb32kclksel number of parents with actual count The following out-of-bounds read has been observed by Christian on a GXBB WeTek Hub: ================================================================== BUG: KASA...

CVE-2026-89980

In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ sndharmonycreate registers the IRQ before initializing h-lock and h-mixerlock. A pending interrupt can invoke the handler while these locks are uninitialized. Initialize both...

CVE-2026-89958

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...

CVE-2026-90018

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte...

CVE-2026-89981

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMIDEL1 when MTE is disabled cpuinfostorecpu gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel has disabled MTE CONFIGARM64MTE=n or arm64.nomte. KVM sets HCREL2.TID5 ...

CVE-2026-90046

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: don't spintrylock in NMI on UP Patch series "mm/pagealloc: fixes for freepagesnolock on RT/UP". Pre-existing bugs found by Sashiko during review of this other series:...

CVE-2026-90047

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat CCS storage as usable VRAM getflatccsoffset reads the base of the flat CCS storage from the hardware, scales it by the number of enabled L3 nodes, and rounds the result up to 128K. Everything below...

CVE-2026-90022

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

CVE-2026-89948

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix freeing of claims on meshif deletion When the mesh interface is getting deleted, then batadvbladelbackboneclaims via batadvblapurgebackbonegw could make sure that all claims gets removed. But this function is...

CVE-2026-89951

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

CVE-2026-89968

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that t...

CVE-2026-89991

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...

CVE-2026-90040

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...

CVE-2026-90042

In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc ...

CVE-2026-90030

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active transfer. Older DWC3 programming guide revisions recommended setting...

CVE-2026-90013

In the Linux kernel, the following vulnerability has been resolved: tracing: Take tracearray reference when opening options file The options files do not take the tracearray reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by...

CVE-2026-89987

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: transfer the pmd dirty bit to the folio on zap zaphugepmdfolio propagates the pmd young bit to the folio for the file case, but not the dirty bit. The pte path does propagate it, in zappresentfolioptes and so does...

CVE-2026-89969

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmettcptryrecvpdu reads a PDU header into the fixed 128-byte queue-pdu union, then computes the remaining payload length as queue-left = hdr-hlen - queue-offset ...

CVE-2026-89995

In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dmadirectallocfrompool Commit 5b138c534fda "dma-direct: factor out a dmadirectallocfrompool helper" changed dmadirectallocfrompool to return the CPU address from dmaallocfrompool. That fits...

CVE-2026-89963

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89946

In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l33: drain threaded IRQ before runtime suspend cs35l33runtimesuspend currently switches the codec into regcachecacheonlytrue and powers it down without first quiescing the threaded IRQ registered by...

CVE-2026-89924

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix olddata leak in guest debug error path importwpinfo allocates a per-watchpoint olddata buffer to back up the original guest memory contents. If a later watchpoint of the same KVMSETGUESTDEBUG request fails to impor...

CVE-2026-89996

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89912

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89970

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

CVE-2026-89917

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

CVE-2026-89926

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

CVE-2026-89966

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as a fallback to allocate from all nodes. If order is gigantic,...

CVE-2026-89957

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...

CVE-2026-89916

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...

CVE-2026-89973

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answer...

CVE-2026-90027

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop ccdebouncedwork is queued from the setcc and starttoggling callbacks, which run from TCPM's kthread worker. portstop returns before tcpmunregisterport destroys that...

CVE-2026-89971

In the Linux kernel, the following vulnerability has been resolved: nvme: skip the zoned limits update if the zone info query failed nvmequeryzoneinfo returns either a negative errno or a positive NVMe status code, but nvmeupdatensinfoblock only tests for the negative case: ret =...