CVE-2026-89644

CVE-2026-89644 affects the btrfs filesystem in the Linux kernel. The root cause is an extent map reference leak in the NOCOW direct I/O write path: btrfs_get_blocks_direct_write() fails to drop the extent map obtained from btrfs_get_extent() when btrfs_create_dio_extent() returns an error (e.g., ...

CVE-2026-89643

A use-after-free vulnerability exists in the Linux kernel's audit subsystem . The function audit_del_rule() unconditionally calls audit_put_tree() at its end, assuming it always handles a temporary parser-owned tree reference. However, when invoked via fsnotify autoremove for mixed AUDIT_DIR + AU...

CVE-2026-89641

CVE-2026-89641 is a use-after-free vulnerability in the Linux kernel's CIFS filesystem . In cifs_file_set_size(), when the handle-based set_file_size() RPC fails, execution falls through to the path-based fallback which reuses a borrowed tcon pointer. If cifsFileInfo_put() had dropped the last re...

CVE-2026-89642

This vulnerability affects the CIFS filesystem driver in the Linux kernel . The function cifs_setsize() calls truncate_pagecache() when a file is extended but omits the pagecache_isize_extended() call, which is responsible for zeroing the tail of the page that straddles the old end-of-file bounda...

CVE-2026-89640

This CVE affects the CIFS subsystem of the Linux kernel , specifically in cifs_remap_file_range(). When a file-range remap (clone) is issued with len == 0 (clone to EOF) and the offset exceeds the source file's size, the effective length is computed as a negative loff_t , which corrupts the ByteC...

CVE-2026-89639

CVE-2026-89639 affects the Linux kernel CIFS client . The root cause is that cifs_do_truncate() is invoked from cifs_open() without holding i_rwsem, preventing it from using cifs_resize_file_locked() to perform a proper fscache cookie resize . This means that when a file is opened with O_TRUNC (t...

CVE-2026-89638

CVE-2026-89638 is a vulnerability in the Linux kernel CIFS client (cifs.ko). When a file with the setuid or setgid bit set is written over a CIFS mount using the cifsacl, modefromsid, SMB3.1.1 POSIX, or SMB1 Unix extensions, the cleared mode is never propagated to the server . The root cause is t...

CVE-2026-89637

Linux kernel CIFS/SMB client contains a use-after-free and buffer leak in cifs_check_trans2(). When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response is rejected due to an invalid SMB header or a check2ndT2() PDU...

CVE-2026-89636

CVE-2026-89636 is a use-after-free vulnerability in the Linux kernel 's SMB client . When the function free_tgts() releases all structures in ce->tlist, the pointer ce->tgthint is left referencing a freed cache_dfs_tgt structure. If that stale pointer is dereferenced before being reset, a u...

CVE-2026-89635

CVE-2026-89635 affects the ksmbd SMB server in the Linux kernel . In ksmbd_reopen_durable_fd(), the loop that rebinds detached oplocks during a durable reconnect keys only on op->conn == NULL, causing a reconnecting session to adopt an oplock belonging to a different session on the same inode....

CVE-2026-89634

CVE-2026-89634 affects the Linux kernel SMB client subsystem. The vulnerability resides in the symlink_data() error-context loop: when ErrorDataLength is near UINT32_MAX (e.g., 0xFFFFFFF9), the ALIGN(x, 8) macro overflows and wraps to 0 , causing the post-alignment bounds check to pass incorrectl...

CVE-2026-89633

This Linux kernel vulnerability affects the SMB client 's coalesce_t2() function, which computes data pointers from server-supplied DataOffset fields without validating them against buffer bounds. A small DataOffset can push a pointer below the data area, overwriting header fields; a large one ca...

CVE-2026-89632

CVE-2026-89632 affects the Linux kernel SMB client , specifically the reparse_buf_ptr() function. The root cause is a use-before-check flaw: the function reads buf->ReparseDataLength (at offset 4) before verifying that count covers the full 8-byte fixed header. If a server returns an OutputCou...

CVE-2026-89631

CVE-2026-89631 affects the Linux kernel's SMB (CIFS) client . The flaw is in CIFSTCon(), where a server-supplied ByteCount of 0 or 1 causes an integer-to-size_t sign conversion that yields a huge bound. The subsequent __u16 subtraction wraps bytes_left, allowing cifs_strndup_from_utf16() to read ...

CVE-2026-89630

CVE-2026-89630 affects the Linux kernel SMB client (CIFS) , specifically the is_valid_oplock_break() function. A prior commit (83bfbd0bb902) that removed the RFC1002 header from smb_hdr changed the quantity the data_offset bound is measured against. The mechanical substitution to srv->total_re...

CVE-2026-89628

A slab-out-of-bounds read vulnerability exists in the Linux kernel's hid_picolcd driver. The function picolcd_debug_eeprom_read() trusts a length byte supplied by the device in its REPORT_EE_DATA reply, clamping it only to the caller's read count but never checking resp->raw_size—the actual nu...

CVE-2026-89629

CVE-2026-89629 affects the Linux kernel in the HID corsair-void driver . The root cause is an out-of-bounds read triggered by malformed status and firmware events whose size was not validated before being read. The fix adds a size check and emits a warning on unexpected values to prevent the read...

CVE-2026-89627

CVE-2026-89627 affects the Linux kernel 's HID roccat driver. The root cause is a memory leak : roccat_report_event() duplicates each report via kmemdup() into a circular buffer (cbuf[]), but the device destruction paths free struct roccat_device without releasing reports still stored in those sl...

CVE-2026-89626

This Linux kernel vulnerability affects the HID sensor custom driver. The function hid_sensor_custom_add_attributes() creates one sysfs group per custom sensor field; if sysfs_create_group() fails after some groups are already created, the previously created groups are left in place. The fix adds...

CVE-2026-89625

CVE-2026-89625 is a use-after-free in the Linux kernel's hid-sony driver, triggered during unbinding of Guitar Hero Live (GHL) PS4 dongles (VID 0x1430 / PID 0x07bb). The root cause is a race in sony_remove(): timer_delete_sync() does not block re-arming, and usb_free_urb() only drops a reference ...