CVE-2026-89838

CVE-2026-89838 affects the Linux kernel's F2FS filesystem . The i_name buffer for recovery filenames is not NUL-terminated, yet recover_inode() and recover_dentry() print it with %s. For a 255-byte filename , recovery logging can read past i_name into subsequent raw inode fields. The fix bounds t...

CVE-2026-89837

CVE-2026-89837 affects the Linux kernel's f2fs filesystem . The vulnerability is a dentry folio reference leak in the find_in_level() function. When find_in_block() returns an error, the function stores the error in res_folio and breaks out of the loop without dropping the previously acquired den...

CVE-2026-89836

CVE-2026-89836 is a race condition in the Linux kernel's f2fs filesystem driver. The root cause is that f2fs_get_read_data_folio() calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio, dropping the reference and releasing the folio lock before the page count is read. A c...

CVE-2026-89835

CVE-2026-89835 is a NULL pointer dereference in the Linux kernel's f2fs filesystem . When checkpoint_merge is enabled but no checkpoint thread is running (e.g., on a read-only mount), writing to ckpt_thread_ioprio via sysfs calls set_task_ioprio() on a NULL task pointer (cprc->f2fs_issue_ckpt)...

CVE-2026-89834

CVE-2026-89834 affects the f2fs filesystem in the Linux kernel. In free_segment_range(), the curseg evacuation loop only iterated up to NR_CURSEG_PERSIST_TYPE (0–5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC . Although these types are n...

CVE-2026-89833

CVE-2026-89833 affects the Linux kernel's f2fs filesystem driver. The vulnerability is a race condition in f2fs_fsync_node_pages(): when one thread performs an fsync while another concurrently executes a truncate via f2fs_setattr, the truncate can set folio->mapping = NULL. This causes is_node...

CVE-2026-89832

CVE-2026-89832 affects the f2fs filesystem in the Linux kernel . The root cause is that when a node block is corrupted due to a checksum mismatch or inconsistent footer info, the dirty flag on the node folio was not properly cleared in the error path, causing inconsistent node data to be persiste...

CVE-2026-89831

CVE-2026-89831 affects the f2fs filesystem in the Linux kernel. The critical_task_priority sysfs attribute updates checkpoint or GC kthread scheduling state but was not serialized with the s_umount lock, unlike the similar GC thread control entries and ckpt_thread_ioprio . This omission allows a ...

CVE-2026-89830

CVE-2026-89830 affects the Linux kernel 's f2fs filesystem. In __allocate_data_block(), when a new data block is allocated (dn->data_blkaddr == NULL_ADDR), inc_valid_block_count() is called to increment total_valid_block_count and i_blocks. If the subsequent f2fs_allocate_data_block() call the...

CVE-2026-89829

CVE-2026-89829 affects the f2fs filesystem in the Linux kernel. The root cause is that folio->index was not being passed to f2fs_sanity_check_node_footer(), causing the function to check the same node ID (nid) incorrectly during node footer validation. The fix, applied across three stable kern...

CVE-2026-89828

This CVE affects the Linux kernel's amdgpu DRM driver . The root cause is an initialization ordering bug in amdgpu_vram_mgr_init(): the function drmm_cgroup_register_region() is called before the list heads and buddy allocator are initialized. If it fails, the early return skips those initializat...

CVE-2026-89827

This Linux kernel vulnerability affects the drm/amdgpu driver's UVD (Unified Video Decoder) handling in SR-IOV VF contexts. The root cause is that uvd_v7_0_sw_init() does not initialize the UVD decode ring for a virtual function, yet amdgpu_uvd_resume() unconditionally force-completes that decode...

CVE-2026-89826

This vulnerability affects the Linux kernel 's drm/panthor GPU driver, specifically the panthor_fw_read_build_info() function. Two related flaws allow an out-of-bounds memory read: (1) the metadata range validation uses addition of two u32 fields (hdr.meta_start + hdr.meta_size), which can wrap a...

CVE-2026-89825

CVE-2026-89825 affects the drm/panthor driver in the Linux kernel. The functions panthor_init_cs_iface() and panthor_init_csg_iface() validate firmware control interface offsets using 32-bit arithmetic , which can wrap before the bounds check executes. Additionally, the validation uses the host w...

CVE-2026-89824

CVE-2026-89824 affects the Linux kernel component drm/panel-edp . The root cause is a failure to drop the i2c adapter reference on probe failure (e.g., probe deferral) and on driver unbind, specifically when a devicetree redundantly uses the 'ddc-i2c-bus' property to point to the aux ddc bus. Thi...

CVE-2026-89823

CVE-2026-89823 is a race condition in the Linux kernel's DRM subsystem . When drm_dev_register() partially fails (e.g., the render minor registers but the primary minor fails), the unplugged flag is never set. This allows userspace to enter a drm_dev_enter() critical section on the already-regist...

CVE-2026-89822

In the Linux kernel , the drm/i915 driver is vulnerable to a NULL pointer dereference in i915_pci_probe(). When a device is force-bound via the sysfs driver_override mechanism, pci_match_device() returns a dummy pci_device_id_any entry whose driver_data field is NULL. The probe function unconditi...

CVE-2026-89821

CVE-2026-89821 affects the Linux kernel DRM AMD display subsystem. The function __is_lut_linear() computes each LUT entry as i * MAX_DRM_LUT_VALUE / (size - 1). When called with a single-entry LUT , the divisor becomes zero, triggering a kernel divide error (#DE) . Since a LUT with fewer than two...

CVE-2026-89820

CVE-2026-89820 affects the Linux kernel 's drm/amd/display subsystem. On GPU reset, dm_suspend() acquires the dc_lock and defers its release to dm_resume(). If amdgpu_dm_commit_zero_streams() or dm_dmub_hw_init() fails, the error path returns without releasing the lock , causing every subsequent ...

CVE-2026-89819

CVE-2026-89819 is a Linux kernel vulnerability in the AMD display driver (drm/amd/display). The per-plane degamma LUT size was never validated before use, unlike the CRTC degamma path which is guarded by amdgpu_dm_verify_lut_sizes(). A malformed AMD_PLANE_DEGAMMA_LUT blob could trigger a divide-b...