CVE-2026-89997

CVE-2026-89997 affects the Linux kernel device-mapper (dm) subsystem . A race condition occurs when the resume and remove ioctls are issued simultaneously: the device may be resumed after being suspended in __dm_destroy, causing the table to be destroyed without invoking the postsuspend method. S...

CVE-2026-89996

CVE-2026-89996 affects the Linux kernel 's dma-heap subsystem. In DMA_HEAP_IOCTL_ALLOC, the file descriptor is installed into the caller's fd table via fd_install() before copy_to_user() completes. If copy_to_user() fails, the fd and its underlying dma-buf reference are leaked for the process lif...

CVE-2026-89994

CVE-2026-89994 affects the Linux kernel 's fsl-edma DMA engine driver . The fsl-edma trace events store a pointer to struct fsl_edma_engine in the ringbuffer and dereference it during log output, at which point the pointer may already be invalid (use-after-free) . A local user with tracing access...

CVE-2026-89995

This Linux kernel vulnerability affects the dma-direct subsystem. A prior refactor (commit 5b138c534fda) changed dma_direct_alloc_from_pool() to return a CPU address instead of a struct page * , which is what dma_direct_alloc_pages() expects. The fix restores the struct page * return type and pas...

CVE-2026-89993

CVE-2026-89993 affects the Linux kernel in the dmaengine dw-edma driver. The root cause is an initialization-order bug: dw_edma_irq_request() passes struct dw_edma_irq to request_irq() before dw_edma_channel_setup() fills the back pointer. As a result, a shared interrupt can enter the handler wit...

CVE-2026-89992

CVE-2026-89992 is a memory management flaw in the Linux kernel 's cpuidle driver, specifically in the dt_idle_genpd subsystem. The root cause is a use-after-free / invalid free : dt_idle_pd_alloc() calls kasprintf() to allocate the full device-tree node path, then sets pd->name to point at kba...

CVE-2026-89991

CVE-2026-89991 is a bug in the Linux kernel BPF subsystem affecting __pcpu_freelist_push(). When only one CPU is possible (e.g., CONFIG_SMP=n or nr_cpus=1), an NMI re-enters pcpu_freelist_push() while the interrupted context already holds that CPU's freelist lock. The fallback loop skips the curr...

CVE-2026-89990

This use-after-free vulnerability in the Linux kernel's Ceph filesystem driver occurs when ceph_mds_check_access() traverses the mdsc->s_cap_auths array without holding mdsc->mutex. A concurrent MDS session OPEN replaces and frees that array, so a racing file-open path (e.g. ceph_atomic_ope...

CVE-2026-89988

This Linux kernel vulnerability affects the kprobes subsystem, specifically the kprobe_blacklist list. The root cause is a use-after-free : __within_kprobe_blacklist() traverses the blacklist without holding kprobe_mutex, so when a module is unloaded and kprobe_remove_area_blacklist() frees entri...

CVE-2026-89989

CVE-2026-89989 affects the Linux kernel's IMA (Integrity Measurement Architecture) subsystem. In validate_hash_algo(), the return value of dentry_path() is passed directly to integrity_audit_msg() without checking for error pointers. When a path exceeds the buffer, dentry_path() returns ERR_PTR(-...

CVE-2026-89987

CVE-2026-89987 affects the Linux kernel in the mm/huge_memory subsystem. The function zap_huge_pmd_folio() fails to propagate the PMD dirty bit to the folio when a PMD-mapped shmem/tmpfs page is unmapped, unlike the PTE path and PMD split path. This causes silent data loss for processes that stor...

CVE-2026-89986

CVE-2026-89986 is a Linux kernel vulnerability in the mm/mempolicy subsystem, specifically in alloc_pages_bulk_weighted_interleave(). The function hardcoded GFP_KERNEL when allocating a temporary weights array via kmalloc(), which can trigger a sleeping allocation in atomic or RCU read-side conte...

CVE-2026-89985

CVE-2026-89985 is a vulnerability in the Linux kernel's memory cgroup (memcg) subsystem . The root cause is a broken invariant in memcg_reparent_objcgs(): when a folio migrates across NUMA nodes, it inherits the old node's objcg, which desynchronizes objcg reparenting from LRU list reparenting. T...

CVE-2026-89984

This vulnerability affects the Linux kernel 's perf/x86/intel subsystem. Before Arch LBR gained CPL filtering support, intel_pmu_lbr_filter() did not fully validate the privilege level of sampled entries. While it filtered some mismatches based on branch type and the destination address, it faile...

CVE-2026-89983

CVE-2026-89983 is a use-after-free vulnerability in the Linux kernel I2C core subsystem. The root cause is a race condition: i2c_del_adapter() frees the adapter's debugfs directory before the adapter device is fully unregistered, while the new_device sysfs attribute remains writable until device_...

CVE-2026-89981

CVE-2026-89981 affects the Linux kernel on arm64 platforms. The __cpuinfo_store_cpu() function reads the GMID_EL1 register based on the raw ID_AA64PFR1_EL1 value, even when the kernel has MTE disabled (CONFIG_ARM64_MTE=n or arm64.nomte). In a pKVM (protected KVM) environment, KVM sets HCR_EL2.TID...

CVE-2026-89982

This Linux kernel vulnerability affects the I2C mux subsystem. In i2c_mux_add_adapter(), a reference to the Device Tree channel node is taken before registering the new adapter; if registration fails, the error path frees the private data without dropping that reference , causing a node leak . Th...

CVE-2026-89980

CVE-2026-89980 affects the Linux kernel ALSA Harmony driver. The function snd_harmony_create() registers the IRQ before initializing h->lock and h->mixer_lock , allowing a pending interrupt to invoke the handler while these locks are still in an uninitialized state . The fix reorders initia...

CVE-2026-89979

CVE-2026-89979 is a race condition in the Linux kernel ALSA PCM subsystem. Non-atomic operations (hw_params, hw_free, prepare) can be in progress when another thread issues an atomic PCM trigger-start , causing state inconsistency (e.g., ODEBUG warnings reported by syzkaller ). The CVSS 3.1 score...

CVE-2026-89978

CVE-2026-89978 affects the Linux kernel accel/amdxdna driver (AMD NPU). The SYNC_BO ioctl does not validate that the requested size is non-zero, so a zero-byte request reaches drm_clflush_virt_range(), which unconditionally calls clflushopt(end - 1). For an empty range this dereferences the guard...