CVE-2026-89635

CVE-2026-89635 affects the ksmbd SMB server in the Linux kernel . In ksmbd_reopen_durable_fd(), the loop that rebinds detached oplocks during a durable reconnect keys only on op->conn == NULL, causing a reconnecting session to adopt an oplock belonging to a different session on the same inode....

CVE-2026-89634

CVE-2026-89634 affects the Linux kernel SMB client subsystem. The vulnerability resides in the symlink_data() error-context loop: when ErrorDataLength is near UINT32_MAX (e.g., 0xFFFFFFF9), the ALIGN(x, 8) macro overflows and wraps to 0 , causing the post-alignment bounds check to pass incorrectl...

CVE-2026-89633

This Linux kernel vulnerability affects the SMB client 's coalesce_t2() function, which computes data pointers from server-supplied DataOffset fields without validating them against buffer bounds. A small DataOffset can push a pointer below the data area, overwriting header fields; a large one ca...

CVE-2026-89632

CVE-2026-89632 affects the Linux kernel SMB client , specifically the reparse_buf_ptr() function. The root cause is a use-before-check flaw: the function reads buf->ReparseDataLength (at offset 4) before verifying that count covers the full 8-byte fixed header. If a server returns an OutputCou...

CVE-2026-89631

CVE-2026-89631 affects the Linux kernel's SMB (CIFS) client . The flaw is in CIFSTCon(), where a server-supplied ByteCount of 0 or 1 causes an integer-to-size_t sign conversion that yields a huge bound. The subsequent __u16 subtraction wraps bytes_left, allowing cifs_strndup_from_utf16() to read ...

CVE-2026-89630

CVE-2026-89630 affects the Linux kernel SMB client (CIFS) , specifically the is_valid_oplock_break() function. A prior commit (83bfbd0bb902) that removed the RFC1002 header from smb_hdr changed the quantity the data_offset bound is measured against. The mechanical substitution to srv->total_re...

CVE-2026-89628

A slab-out-of-bounds read vulnerability exists in the Linux kernel's hid_picolcd driver. The function picolcd_debug_eeprom_read() trusts a length byte supplied by the device in its REPORT_EE_DATA reply, clamping it only to the caller's read count but never checking resp->raw_size—the actual nu...

CVE-2026-89629

CVE-2026-89629 affects the Linux kernel in the HID corsair-void driver . The root cause is an out-of-bounds read triggered by malformed status and firmware events whose size was not validated before being read. The fix adds a size check and emits a warning on unexpected values to prevent the read...

CVE-2026-89627

CVE-2026-89627 affects the Linux kernel 's HID roccat driver. The root cause is a memory leak : roccat_report_event() duplicates each report via kmemdup() into a circular buffer (cbuf[]), but the device destruction paths free struct roccat_device without releasing reports still stored in those sl...

CVE-2026-89625

CVE-2026-89625 is a use-after-free in the Linux kernel's hid-sony driver, triggered during unbinding of Guitar Hero Live (GHL) PS4 dongles (VID 0x1430 / PID 0x07bb). The root cause is a race in sony_remove(): timer_delete_sync() does not block re-arming, and usb_free_urb() only drops a reference ...

CVE-2026-89626

This Linux kernel vulnerability affects the HID sensor custom driver. The function hid_sensor_custom_add_attributes() creates one sysfs group per custom sensor field; if sysfs_create_group() fails after some groups are already created, the previously created groups are left in place. The fix adds...

CVE-2026-89624

A use-after-free write vulnerability in the Linux kernel 's HID universal-pidff driver occurs when force-feedback initialisation fails after the device has already been started via hid_hw_start(). The hidraw character device is not devres-managed, so it survives the error path; opening the orphan...

CVE-2026-89623

CVE-2026-89623 affects the Linux kernel's HID mcp2221 driver . During probe failure or device removal, incoming HID reports could race with hardware teardown in the mcp2221_hid_unregister() devm cleanup callback, resulting in a potential use-after-free . The fix quiesces device I/O by calling hid...

CVE-2026-89622

CVE-2026-89622 is a write use-after-free in the Linux kernel's HID mcp2221 driver. The function mcp_i2c_smbus_read() stores a caller-supplied buffer pointer in mcp->rxbuf for the duration of an I2C/SMBus transfer but never clears it on completion or timeout. Once the caller frees or reuses the...

CVE-2026-89621

CVE-2026-89621 is a Linux kernel vulnerability in the HID mcp2221 driver's mcp2221_raw_event() function. The function fails to validate the size of incoming HID reports in the MCP2221_I2C_GET_DATA path, trusting a device-supplied data[3] field as the copy length without verifying that 4 + data[3]...

CVE-2026-89619

CVE-2026-89619 affects the Linux kernel intel-thc-hid driver (Intel QuickSPI HID). The root cause is a buffer overflow in quickspi_get_report(): the function copies the entire device-supplied report into the caller's buffer without validating that the response length does not exceed the buffer si...

CVE-2026-89620

CVE-2026-89620 is a heap buffer overflow in the Linux kernel's HID intel-thc-hid intel-quickspi driver. The function write_cmd_to_txdma() copies a caller-supplied report into qsdev->report_buf, a heap buffer sized to the device-descriptor-derived max_report_len (a few hundred bytes for a touch...

CVE-2026-89618

CVE-2026-89618 affects the Linux kernel 's eventfs (event filesystem) subsystem. The root cause is that init_ei() does not initialize the eventfs_inode list heads (ei->children and ei->list). When eventfs_create_dir() fails due to memory pressure , it calls free_ei() before the lists are in...

CVE-2026-89617

CVE-2026-89617 affects the Linux kernel's NTFS3 filesystem driver (fs/ntfs3). The root cause is a missing size validation for the page_lcns[] array within each DIR_PAGE_ENTRY during log replay: check_rstbl() validates table bookkeeping but never confirms that the on-disk lcns_follow field does no...

CVE-2026-89616

CVE-2026-89616 is an information leak in the Linux kernel fs/ntfs3 driver. In ni_read_frame() , the LZNT decompression of a $DATA frame can terminate early when the compressed stream is exhausted (e.g., a zero chunk header), returning a byte count far less than frame_size . The bytes between the ...