CVE-2026-89963

CVE-2026-89963 affects the Linux kernel in the powerpc/kexec_file subsystem. A potential NULL pointer dereference exists in the function kexec_extra_fdt_size_ppc64() : on platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving the pointer 'rmem' unal...

CVE-2026-89962

CVE-2026-89962 affects the Linux kernel 's powerpc/kexec_file subsystem. The __merge_memory_ranges() function contains two logic flaws: it compares the current range's start address against the previous element (i-1) instead of the running merged index (idx), and it unconditionally overwrites ran...

CVE-2026-89961

CVE-2026-89961 affects the Linux kernel 's powerpc/mm subsystem, specifically the vmemmap_populate_compound_pages() function. The root cause is a mismatch in how addr_pfn is advanced relative to the loop's addr variable in vmemmap address space. Because each PAGE_SIZE step in addr spans PAGE_SIZE...

CVE-2026-89960

CVE-2026-89960 is a use-after-free in the Linux kernel's s390 vfio-ap (Protected Crypto Accelerator) subsystem. In vfio_ap_mdev_set_kvm(), the kvm->arch.crypto.pqap_hook pointer is set before checking for a conflicting mdev assignment. If another mdev already owns the KVM instance, the functio...

CVE-2026-89959

CVE-2026-89959 is a Linux kernel vulnerability in the s390/vfio-ap subsystem. The vfio_ap_config_remove function incorrectly used bitmap_andnot instead of bitmap_and when clearing bits from the matrix_mdev->matrix.adm bitmap (which tracks control domains assigned to a mediated device). This pr...

CVE-2026-89958

This vulnerability affects the Linux kernel 's s390/vfio-ap driver. The root cause is a NULL pointer dereference : the vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete callback functions acquire the matrix_mdev->kvm->lock mutex without first checking whether matrix_mdev->kvm is NULL. ...

CVE-2026-89957

CVE-2026-89957 affects the Linux kernel s390 vfio-ap driver. In vfio_ap_mdev_hot_unplug_cfg(), the return value of bitmap_andnot() is used to decide whether the guest APCB needs updating. When the last AP adapter or domain assigned to an mdev is removed, the resulting empty bitmap causes bitmap_a...

CVE-2026-89955

A NULL pointer dereference vulnerability exists in the Linux kernel's s390/vfio-ap module. The race occurs when vfio_ap_mdev_probe_queue() creates the sysfs attribute group before the queue's driver data is set; a concurrent read of the status attribute then retrieves NULL via dev_get_drvdata() a...

CVE-2026-89956

CVE-2026-89956 affects the s390/vfio-ap subsystem of the Linux kernel. The root cause is a missing matrix_dev->guests_lock mutex when traversing or modifying the mdev_list of ap_matrix_mdev objects. Two functions are affected: vfio_ap_mdev_probe , which added objects to the list using the wron...

CVE-2026-89954

CVE-2026-89954 affects the Linux kernel 's MTD AFS (Async Flash Storage) v2 parser. The root cause is insufficient bounds validation: the parser uses footer[8] to locate the image information block and the region_count field to walk entries from a fixed local array, but neither value—both taken f...

CVE-2026-89953

CVE-2026-89953 is a memory leak in the Linux kernel's mtdoops module. The root cause is that mtdoops_notify_remove() detaches from the backing MTD device but leaves the oops_page_used bitmap allocated. When the same MTD device is subsequently re-registered, the add path allocates a new bitmap and...

CVE-2026-89952

CVE-2026-89952 affects the Linux kernel's mtd: rawnand subsystem , specifically the nand_flash_detect_ext_param_page() function. The root cause is an insufficient bounds check: the function allocates memory based on the length declared in the ONFI parameter page, then reads a fixed header and wal...

CVE-2026-89951

CVE-2026-89951 affects the batman-adv module in the Linux kernel. During fragment reassembly, the skb from the highest-numbered buffered fragment is reused as the merged packet. If that fragment was received on a hard interface that is deleted before reassembly completes, the merged skb re-enters...

CVE-2026-89950

In the Linux kernel batman-adv module, multicast packet generation functions batadv_mcast_forw_packet() and batadv_mcast_forw_scrape() can be reached via the batadv_mcast_forw_mcsend() call path, where the socket buffer is unshared but not linearized . Unlike the batadv_recv_mcast_packet() handle...

CVE-2026-89949

CVE-2026-89949 affects the Linux kernel 's batman-adv module, specifically the DAT (Distributed ARP Table) component. When extracting IP addresses from ARP packets, either batadv_arp_ip_src or batadv_arp_ip_dst performs an unaligned memory access that triggers a fault on hardware lacking native u...

CVE-2026-89948

CVE-2026-89948 affects the batman-adv (B.A.T.M.A.N. advanced) module in the Linux kernel , specifically its BLA (Backbone Link Aggregation) subsystem. The root cause is a logic bug: when a mesh interface is deleted, batadv_bla_del_backbone_claims() is never actually executed because bat_priv->...

CVE-2026-89947

CVE-2026-89947 is a global-out-of-bounds read in the Linux kernel's Amlogic Meson GXBB clock driver . When commit 7915d7d5407c removed a non-existing 32k clock parent from the gxbb_32k_clk_sel mux, it did not adjust the hard-coded num_parents field, causing __clk_register to read past the end of ...

CVE-2026-89946

CVE-2026-89946 affects the Linux kernel's ASoC cs35l33 codec driver . The root cause is that cs35l33_runtime_suspend() switches the codec into regcache_cache_only(true) and powers it down without first quiescing the threaded IRQ, leaving a window where cs35l33_irq_thread() can still execute. If t...

CVE-2026-89945

CVE-2026-89945 affects the ASoC cs35l34 codec driver in the Linux kernel . The root cause is that cs35l34_runtime_suspend() transitions the codec into regcache_cache_only mode, asserts reset low, and powers the device off without first quiescing the threaded IRQ registered via devm_request_thread...

CVE-2026-89944

CVE-2026-89944 is a reference-count leak in the Linux kernel's ASoC hdac_hda driver. In hdac_hda_dev_probe(), an HDA link reference is acquired via snd_hdac_ext_bus_link_get() before registering the ASoC component. If component registration fails, the function returns without calling snd_hdac_ext...