CVE-2026-89988

This Linux kernel vulnerability affects the kprobes subsystem, specifically the kprobe_blacklist list. The root cause is a use-after-free : __within_kprobe_blacklist() traverses the blacklist without holding kprobe_mutex, so when a module is unloaded and kprobe_remove_area_blacklist() frees entri...

CVE-2026-89989

CVE-2026-89989 affects the Linux kernel's IMA (Integrity Measurement Architecture) subsystem. In validate_hash_algo(), the return value of dentry_path() is passed directly to integrity_audit_msg() without checking for error pointers. When a path exceeds the buffer, dentry_path() returns ERR_PTR(-...

CVE-2026-89987

CVE-2026-89987 affects the Linux kernel in the mm/huge_memory subsystem. The function zap_huge_pmd_folio() fails to propagate the PMD dirty bit to the folio when a PMD-mapped shmem/tmpfs page is unmapped, unlike the PTE path and PMD split path. This causes silent data loss for processes that stor...

CVE-2026-89986

CVE-2026-89986 is a Linux kernel vulnerability in the mm/mempolicy subsystem, specifically in alloc_pages_bulk_weighted_interleave(). The function hardcoded GFP_KERNEL when allocating a temporary weights array via kmalloc(), which can trigger a sleeping allocation in atomic or RCU read-side conte...

CVE-2026-89985

CVE-2026-89985 is a vulnerability in the Linux kernel's memory cgroup (memcg) subsystem . The root cause is a broken invariant in memcg_reparent_objcgs(): when a folio migrates across NUMA nodes, it inherits the old node's objcg, which desynchronizes objcg reparenting from LRU list reparenting. T...

CVE-2026-89984

This vulnerability affects the Linux kernel 's perf/x86/intel subsystem. Before Arch LBR gained CPL filtering support, intel_pmu_lbr_filter() did not fully validate the privilege level of sampled entries. While it filtered some mismatches based on branch type and the destination address, it faile...

CVE-2026-89983

CVE-2026-89983 is a use-after-free vulnerability in the Linux kernel I2C core subsystem. The root cause is a race condition: i2c_del_adapter() frees the adapter's debugfs directory before the adapter device is fully unregistered, while the new_device sysfs attribute remains writable until device_...

CVE-2026-89981

CVE-2026-89981 affects the Linux kernel on arm64 platforms. The __cpuinfo_store_cpu() function reads the GMID_EL1 register based on the raw ID_AA64PFR1_EL1 value, even when the kernel has MTE disabled (CONFIG_ARM64_MTE=n or arm64.nomte). In a pKVM (protected KVM) environment, KVM sets HCR_EL2.TID...

CVE-2026-89982

This Linux kernel vulnerability affects the I2C mux subsystem. In i2c_mux_add_adapter(), a reference to the Device Tree channel node is taken before registering the new adapter; if registration fails, the error path frees the private data without dropping that reference , causing a node leak . Th...

CVE-2026-89980

CVE-2026-89980 affects the Linux kernel ALSA Harmony driver. The function snd_harmony_create() registers the IRQ before initializing h->lock and h->mixer_lock , allowing a pending interrupt to invoke the handler while these locks are still in an uninitialized state . The fix reorders initia...

CVE-2026-89979

CVE-2026-89979 is a race condition in the Linux kernel ALSA PCM subsystem. Non-atomic operations (hw_params, hw_free, prepare) can be in progress when another thread issues an atomic PCM trigger-start , causing state inconsistency (e.g., ODEBUG warnings reported by syzkaller ). The CVSS 3.1 score...

CVE-2026-89978

CVE-2026-89978 affects the Linux kernel accel/amdxdna driver (AMD NPU). The SYNC_BO ioctl does not validate that the requested size is non-zero, so a zero-byte request reaches drm_clflush_virt_range(), which unconditionally calls clflushopt(end - 1). For an empty range this dereferences the guard...

CVE-2026-89977

CVE-2026-89977 affects the accel/ethosu driver in the Linux kernel . The root cause is a missing error check: devm_platform_ioremap_resource() can return an error pointer when the register resource cannot be mapped, but ethosu_probe() stores the pointer and continues execution until later initial...

CVE-2026-89976

CVE-2026-89976 affects the Linux kernel's accel/ethosu driver (Arm Ethos-U NPU accelerator). In ethosu_ioctl_submit_job(), the done_fence is allocated before buffer handles are validated. On error paths, ethosu_job_err_cleanup() frees the job but leaks the uninitialized fence. Additionally, a sch...

CVE-2026-89974

CVE-2026-89974 is a double free vulnerability in the Linux kernel's nvme-fc (NVMe over Fibre Channel) transport . The fabrics options pointer (ctrl->ctrl.opts) is freed by both nvme_fc_ctrl_free() and nvmf_create_ctrl() when nvme_add_ctrl() fails, after commit 1a9e218195a5 introduced a second ...

CVE-2026-89975

Linux kernel nvme-fabrics contains a memory leak in the DHCHAP secret parsing path. When nvmf_parse_options() validates a dhchap_secret or dhchap_ctrl_secret value and the DHHC-1: representation check fails, the temporary string duplicated by match_strdup() is never assigned to the options struct...

CVE-2026-89973

CVE-2026-89973 affects the nvme-tcp driver in the Linux kernel. The function nvme_tcp_handle_c2h_data() validates a C2HData PDU's command ID and payload presence but does not check the data direction . A malicious or buggy NVMe controller can trigger a kernel warning (WARN_ON_ONCE in _copy_to_ite...

CVE-2026-89972

CVE-2026-89972 is a use-after-free vulnerability in the Linux kernel NVMe subsystem . The error path in nvme_alloc_ns() removes a namespace from the siblings list via list_del_rcu() but fails to call synchronize_srcu() before freeing the namespace struct. Concurrent readers in nvme_find_path() an...

CVE-2026-89971

CVE-2026-89971 affects the Linux kernel NVMe subsystem . The root cause is an insufficient error check in nvme_update_ns_info_block(): it only handles negative errno returns from nvme_query_zone_info(), missing positive NVMe status codes. This causes setup to proceed with zero-initialized zone li...

CVE-2026-89970

CVE-2026-89970 is a use-after-free vulnerability in the Linux kernel NVMe Target (nvmet) authentication subsystem. During Submission Queue (SQ) teardown, nvmet_auth_sq_free() uses cancel_delayed_work() to stop auth_expired_work, but if the work has already started, cancellation does not wait for ...