CVE-2026-89848

A use-after-free in the Linux kernel qla2xxx SCSI driver occurs during queue-pair teardown. qla2xxx_delete_qpair() frees the request queue before releasing the response-queue MSI-X interrupt; in that window a late response interrupt can fire and dereference the freed rsp->req pointer via qla24...

CVE-2026-89847

CVE-2026-89847 is a use-after-free in the Linux kernel qla2xxx SCSI driver . When qla24xx_async_abort_cmd() fails in qla2x00_async_iocb_timeout(), both the SRB_LOGIN_CMD and SRB_CTRL_VP paths call sp->done() unconditionally without verifying the SRB was actually found and removed from outstand...

CVE-2026-89846

CVE-2026-89846 is a critical out-of-bounds read in the Linux kernel's qla2xxx SCSI driver. In qla2x00_status_entry(), the FWI2 status path subtracts rsp_info_len (a 32-bit value from the target's FCP response) from par_sense_len (the IOCB data area size: 28 bytes for 24xx, 60 bytes for 29xx) with...

CVE-2026-89845

CVE-2026-89845 affects the Linux kernel qla2xxx SCSI driver (QLogic HBA). The function qla2x00_error_entry() reads ha->req_q_map[que] twice — once for a NULL check and again when assigning the pointer. During queue teardown, qla25xx_free_req_que() clears the slot to NULL under mq_lock, but the...

CVE-2026-89844

CVE-2026-89844 is a locking race in the Linux kernel qla2xxx SCSI driver. In qla24xx_report_id_acquisition(), the format-1 path drops vport_slock after taking the vport reference and then calls qla_update_host_map() without holding the lock. That function mutates the ha->host_map btree via btr...

CVE-2026-89843

CVE-2026-89843 affects the Linux kernel scsi: qla2xxx driver (QLogic). Several bsg handlers use an uninitialized 256-byte on-stack buffer (uint8_t bsg[DMA_POOL_SIZE]) that is filled via sg_copy_to_buffer(), which copies only the user-supplied request length. When the request is shorter than the s...

CVE-2026-89842

CVE-2026-89842 affects the Linux kernel's qla2xxx driver (QLogic Fibre Channel HBA). When firmware is not started (fw_started clear), qla_nvme_xmt_ls_rsp() unconditionally emits a NVMe LS reject IOCB via the out: path, ringing the firmware doorbell and writing to the request queue in-pointer regi...

CVE-2026-89841

CVE-2026-89841 affects the f2fs filesystem in the Linux kernel . The flaw resides in redirty_blocks(), where a do/while loop introduced by commit 5951fee46bef causes an extra iteration when read_cache_folio() fails before any folio is pinned. If readahead has already populated the failed folio in...

CVE-2026-89840

CVE-2026-89840 is a vulnerability in the Linux kernel's f2fs filesystem affecting the F2FS_IOC_MOVE_RANGE ioctl. The ioctl validates the source range but fails to check the destination end before updating i_size. When a source hole is present, __clone_blkaddrs() skips NULL_ADDR entries and return...

CVE-2026-89839

CVE-2026-89839 affects the f2fs filesystem in the Linux kernel. The function f2fs_xattr_advise_set() calls inode_owner_or_capable() with &nop_mnt_idmap instead of the idmap that the VFS passes to the ->set() handler when checking ownership for the "system.advise" xattr . On idmapped mounts , t...

CVE-2026-89838

CVE-2026-89838 affects the Linux kernel's F2FS filesystem . The i_name buffer for recovery filenames is not NUL-terminated, yet recover_inode() and recover_dentry() print it with %s. For a 255-byte filename , recovery logging can read past i_name into subsequent raw inode fields. The fix bounds t...

CVE-2026-89837

CVE-2026-89837 affects the Linux kernel's f2fs filesystem . The vulnerability is a dentry folio reference leak in the find_in_level() function. When find_in_block() returns an error, the function stores the error in res_folio and breaks out of the loop without dropping the previously acquired den...

CVE-2026-89836

CVE-2026-89836 is a race condition in the Linux kernel's f2fs filesystem driver. The root cause is that f2fs_get_read_data_folio() calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio, dropping the reference and releasing the folio lock before the page count is read. A c...

CVE-2026-89835

CVE-2026-89835 is a NULL pointer dereference in the Linux kernel's f2fs filesystem . When checkpoint_merge is enabled but no checkpoint thread is running (e.g., on a read-only mount), writing to ckpt_thread_ioprio via sysfs calls set_task_ioprio() on a NULL task pointer (cprc->f2fs_issue_ckpt)...

CVE-2026-89834

CVE-2026-89834 affects the f2fs filesystem in the Linux kernel. In free_segment_range(), the curseg evacuation loop only iterated up to NR_CURSEG_PERSIST_TYPE (0–5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC . Although these types are n...

CVE-2026-89833

CVE-2026-89833 affects the Linux kernel's f2fs filesystem driver. The vulnerability is a race condition in f2fs_fsync_node_pages(): when one thread performs an fsync while another concurrently executes a truncate via f2fs_setattr, the truncate can set folio->mapping = NULL. This causes is_node...

CVE-2026-89832

CVE-2026-89832 affects the f2fs filesystem in the Linux kernel . The root cause is that when a node block is corrupted due to a checksum mismatch or inconsistent footer info, the dirty flag on the node folio was not properly cleared in the error path, causing inconsistent node data to be persiste...

CVE-2026-89831

CVE-2026-89831 affects the f2fs filesystem in the Linux kernel. The critical_task_priority sysfs attribute updates checkpoint or GC kthread scheduling state but was not serialized with the s_umount lock, unlike the similar GC thread control entries and ckpt_thread_ioprio . This omission allows a ...

CVE-2026-89830

CVE-2026-89830 affects the Linux kernel 's f2fs filesystem. In __allocate_data_block(), when a new data block is allocated (dn->data_blkaddr == NULL_ADDR), inc_valid_block_count() is called to increment total_valid_block_count and i_blocks. If the subsequent f2fs_allocate_data_block() call the...

CVE-2026-89829

CVE-2026-89829 affects the f2fs filesystem in the Linux kernel. The root cause is that folio->index was not being passed to f2fs_sanity_check_node_footer(), causing the function to check the same node ID (nid) incorrectly during node footer validation. The fix, applied across three stable kern...