CVE-2026-89984

This vulnerability affects the Linux kernel 's perf/x86/intel subsystem. Before Arch LBR gained CPL filtering support, intel_pmu_lbr_filter() did not fully validate the privilege level of sampled entries. While it filtered some mismatches based on branch type and the destination address, it faile...

CVE-2026-89983

CVE-2026-89983 is a use-after-free vulnerability in the Linux kernel I2C core subsystem. The root cause is a race condition: i2c_del_adapter() frees the adapter's debugfs directory before the adapter device is fully unregistered, while the new_device sysfs attribute remains writable until device_...

CVE-2026-89982

This Linux kernel vulnerability affects the I2C mux subsystem. In i2c_mux_add_adapter(), a reference to the Device Tree channel node is taken before registering the new adapter; if registration fails, the error path frees the private data without dropping that reference , causing a node leak . Th...

CVE-2026-89981

CVE-2026-89981 affects the Linux kernel on arm64 platforms. The __cpuinfo_store_cpu() function reads the GMID_EL1 register based on the raw ID_AA64PFR1_EL1 value, even when the kernel has MTE disabled (CONFIG_ARM64_MTE=n or arm64.nomte). In a pKVM (protected KVM) environment, KVM sets HCR_EL2.TID...

CVE-2026-89980

CVE-2026-89980 affects the Linux kernel ALSA Harmony driver. The function snd_harmony_create() registers the IRQ before initializing h->lock and h->mixer_lock , allowing a pending interrupt to invoke the handler while these locks are still in an uninitialized state . The fix reorders initia...

CVE-2026-89979

CVE-2026-89979 is a race condition in the Linux kernel ALSA PCM subsystem. Non-atomic operations (hw_params, hw_free, prepare) can be in progress when another thread issues an atomic PCM trigger-start , causing state inconsistency (e.g., ODEBUG warnings reported by syzkaller ). The CVSS 3.1 score...

CVE-2026-89978

CVE-2026-89978 affects the Linux kernel accel/amdxdna driver (AMD NPU). The SYNC_BO ioctl does not validate that the requested size is non-zero, so a zero-byte request reaches drm_clflush_virt_range(), which unconditionally calls clflushopt(end - 1). For an empty range this dereferences the guard...

CVE-2026-89977

CVE-2026-89977 affects the accel/ethosu driver in the Linux kernel . The root cause is a missing error check: devm_platform_ioremap_resource() can return an error pointer when the register resource cannot be mapped, but ethosu_probe() stores the pointer and continues execution until later initial...

CVE-2026-89976

CVE-2026-89976 affects the Linux kernel's accel/ethosu driver (Arm Ethos-U NPU accelerator). In ethosu_ioctl_submit_job(), the done_fence is allocated before buffer handles are validated. On error paths, ethosu_job_err_cleanup() frees the job but leaks the uninitialized fence. Additionally, a sch...

CVE-2026-89974

CVE-2026-89974 is a double free vulnerability in the Linux kernel's nvme-fc (NVMe over Fibre Channel) transport . The fabrics options pointer (ctrl->ctrl.opts) is freed by both nvme_fc_ctrl_free() and nvmf_create_ctrl() when nvme_add_ctrl() fails, after commit 1a9e218195a5 introduced a second ...

CVE-2026-89975

Linux kernel nvme-fabrics contains a memory leak in the DHCHAP secret parsing path. When nvmf_parse_options() validates a dhchap_secret or dhchap_ctrl_secret value and the DHHC-1: representation check fails, the temporary string duplicated by match_strdup() is never assigned to the options struct...

CVE-2026-89973

CVE-2026-89973 affects the nvme-tcp driver in the Linux kernel. The function nvme_tcp_handle_c2h_data() validates a C2HData PDU's command ID and payload presence but does not check the data direction . A malicious or buggy NVMe controller can trigger a kernel warning (WARN_ON_ONCE in _copy_to_ite...

CVE-2026-89972

CVE-2026-89972 is a use-after-free vulnerability in the Linux kernel NVMe subsystem . The error path in nvme_alloc_ns() removes a namespace from the siblings list via list_del_rcu() but fails to call synchronize_srcu() before freeing the namespace struct. Concurrent readers in nvme_find_path() an...

CVE-2026-89971

CVE-2026-89971 affects the Linux kernel NVMe subsystem . The root cause is an insufficient error check in nvme_update_ns_info_block(): it only handles negative errno returns from nvme_query_zone_info(), missing positive NVMe status codes. This causes setup to proceed with zero-initialized zone li...

CVE-2026-89970

CVE-2026-89970 is a use-after-free vulnerability in the Linux kernel NVMe Target (nvmet) authentication subsystem. During Submission Queue (SQ) teardown, nvmet_auth_sq_free() uses cancel_delayed_work() to stop auth_expired_work, but if the work has already started, cancellation does not wait for ...

CVE-2026-89969

CVE-2026-89969 is a critical out-of-bounds write in the Linux kernel's NVMe over TCP target (nvmet-tcp) module. The function nvmet_tcp_try_recv_pdu() reads PDU data into a fixed 128-byte buffer without bounding the payload length against the buffer size. When a header digest has been negotiated a...

CVE-2026-89968

CVE-2026-89968 affects the Linux kernel's NVMe/TCP target (nvmet-tcp). The function nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU without verifying that the target has actually solicited the data via an R2T for that command. A remote host can exploit this by sending an H2CData PDU before...

CVE-2026-89967

CVE-2026-89967 is an out-of-bounds write in the Linux kernel 's mm/migrate_device subsystem. The functions migrate_device_range() and migrate_device_pfns() clear entries following a compound folio to maintain page-granular PFN arrays, but fail to limit writes to the number of slots remaining in t...

CVE-2026-89966

CVE-2026-89966 affects the Linux kernel in the mm/hugetlb_cma subsystem. The root cause is a NULL nodemask dereference in hugetlb_cma_alloc_frozen_folio(): when alloc_buddy_hugetlb_folio_with_mpol() passes a NULL nodemask as a fallback for gigantic (e.g., 1 GB) hugepage allocations, the function ...

CVE-2026-89965

CVE-2026-89965 affects the Linux kernel nvdimm/btt subsystem. The BTT info block's nfree field (number of reserve free blocks) is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size per-lane freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by la...