CVE-2026-89615

This vulnerability affects the Linux kernel 's NTFS3 filesystem driver (fs/ntfs3). The root cause is an out-of-bounds write on the page_lcns[] array: the copy_lcns and redo shorten loops index the array at j + i, where i is bounded only by the log record's own lcns_follow count rather than by the...

CVE-2026-89614

This vulnerability affects the Linux kernel NTFS filesystem driver. The root cause is a slab out-of-bounds read in ntfs_cluster_alloc(): the free-cluster bitmap scan is bounded by the on-disk $Bitmap size, but the in-memory array vol->lcn_empty_bits_per_page is sized from vol->nr_clusters a...

CVE-2026-89613

CVE-2026-89613 affects the Linux kernel 's NTFS filesystem driver . The root cause is that the driver fails to reject an NTFS attribute with empty mapping pairs when the attribute carries an inconsistent highest VCN and size combination. The fix, as indicated by the description stating the vulner...

CVE-2026-89612

CVE-2026-89612 affects the Linux kernel NTFS filesystem driver . The root cause is a type mismatch in parse_ntfs_boot_sector(): MFT and MFTMirr locations are stored as unsigned 64-bit LCNs in the NTFS boot sector but decoded into an s64 , allowing a crafted high-bit value to become negative and b...

CVE-2026-89611

CVE-2026-89611 is a Linux kernel vulnerability in the NTFS filesystem driver where the validator for non-resident attributes fails to check that name_offset falls within safe boundaries during sparse/non-sparse attribute conversion. A malicious MFT record could position the attribute name at the ...

CVE-2026-89609

CVE-2026-89609 affects the ecryptfs module in the Linux kernel. The vulnerability is a race condition: ecryptfs_exorcise_daemon() drops queued messages from a dying daemon without holding the ecryptfs_msg_ctx_lists_mux lock, while ecryptfs_msg_ctx_alloc_to_free() requires that lock to be held. Th...

CVE-2026-89610

CVE-2026-89610 affects the Linux kernel NTFS filesystem driver. The mapping pairs decoder validates that a starting LCN is within the volume but does not check whether the run (LCN + length) extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array can cause th...

CVE-2026-89608

CVE-2026-89608 affects the Linux kernel's ecryptfs filesystem. The vulnerability is in ecryptfs_parse_packet_set(), which calculates the remaining packet buffer size as PAGE_SIZE - 8 instead of using the actual buffer length. For version 1 headers , where the packet set starts later in the header...

CVE-2026-89607

This Linux kernel vulnerability affects the ecryptfs module's passphrase-based decryption path. In parse_tag_3_packet(), the encrypted_key_size field from a Tag 3 packet body is used without bounding it against ECRYPTFS_MAX_KEY_BYTES (64) . When the value exceeds 64, decrypt_passphrase_encrypted_...

CVE-2026-89606

CVE-2026-89606 is a vulnerability in the Linux kernel 's ecryptfs filesystem module. The function ecryptfs_parse_tag_70_packet() subtracts fixed metadata fields from the parsed packet body size to compute the encrypted filename size. A malformed tag 70 packet with a body smaller than those fixed ...

CVE-2026-89605

CVE-2026-89605 affects the ecryptfs module in the Linux kernel . The root cause is in ecryptfs_send_message_locked(), which moves a message context from the free list to the allocated list before sending a request to the userspace daemon. If ecryptfs_send_miscdev() subsequently fails, the context...

CVE-2026-89604

CVE-2026-89604 affects the Linux kernel's efivarfs filesystem. Unprivileged users can repeatedly call statfs() on the efivarfs mount point, triggering a flood of calls to the QueryVariableInfo() UEFI runtime service. On x86 systems where the EFI variable store is backed by SMM (System Management ...

CVE-2026-89603

CVE-2026-89603 is a race condition in the Linux kernel 's syscall_trace_enter() path. When a thread is stopped for ptrace , another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC, setting the SYSCALL_WORK_SECCOMP flag on the stopped thread. However, syscall_trace_enter() evalu...

CVE-2026-89602

CVE-2026-89602 affects the erofs filesystem driver in the Linux kernel . The flaw is in the global buffer resize path: z_erofs_gbuf_nrpages is advanced only after all buffers have been grown, so a retry after a partial resize failure revisits already-enlarged buffers. Retrying the same size cause...

CVE-2026-89601

CVE-2026-89601 affects the Linux kernel ext2 filesystem. The vulnerability resides in ext2_setsize() and ext2_xattr_set2() , where for IS_SYNC inodes, the code called sync_inode_metadata() without first marking the inode dirty. Since sync_inode_metadata() only operates on already-dirty inodes, in...

CVE-2026-89600

CVE-2026-89600 is a use-after-free in the Linux kernel's fanotify subsystem. The function fsnotify_pre_content() builds a file_range on the triggering task's stack, and fanotify_alloc_perm_event() saves a pointer to range.pos inside the heap-allocated permission event. If a signal interrupts the ...

CVE-2026-89599

CVE-2026-89599 affects the Linux kernel 's fbdev/omapfb/panel-dsi-cm driver. The root cause is an initialization order flaw : dsicm_probe() calls omapdss_register_display() to publish the display before initializing the ddata->lock mutex. Once the display is published, another consumer can rea...

CVE-2026-89598

CVE-2026-89598 affects the ssd1307fb fbdev driver in the Linux kernel . The root cause is that fbdev damage callbacks may execute from fbcon while printk has disabled preemption, causing the driver to enter a sleeping I2C transfer path from atomic context . The reported consequence is a "scheduli...

CVE-2026-89597

CVE-2026-89597 affects the uvesafb driver in the Linux kernel (fbdev subsystem). The root cause is in uvesafb_init(): the v86d connector callback is registered before the platform driver. If platform_driver_register() fails, the function returns the error without unregistering the callback, leavi...

CVE-2026-89596

CVE-2026-89596 is an off-by-one error in the Linux kernel's forcedeth (NVIDIA Ethernet) driver, in the nv_suspend() and nv_resume() functions. The loops use <= instead of < when walking the non-PCI configuration space, causing one extra iteration that reads and writes one dword past the map...