CVE-2026-89876

CVE-2026-89876 affects the tda18250 driver in the Linux kernel's media subsystem. The vulnerability is a possible integer overflow that occurs when the variable exp equals zero, causing the expression 1 <

CVE-2026-89875

This is a use-after-free vulnerability in the Linux kernel's Texas Instruments VIP (Video Imaging Processors) driver, specifically the vpe media subsystem. The root cause is that vip_stop_streaming() masks and clears per-list IRQs but does not synchronize the hardirq handler or disable the recove...

CVE-2026-89874

CVE-2026-89874 affects the Linux kernel media subsystem (v4l2-async). The vulnerability is a NULL pointer dereference in v4l2_async_match_notify(): when ancillary media link creation fails, the function jumps to err_call_unbind before asc_subdev_entry is inserted into sd->asc_list. Because asy...

CVE-2026-89873

CVE-2026-89873 affects the Linux kernel 's media: v4l2-ctrls subsystem, which handles HEVC video decoding controls. The vulnerability is a missing input validation on the HEVC Sequence Parameter Set (SPS) Reference Picture Set (RPS) counts. Specifically, SPS values exceeding the HEVC limits of 64...

CVE-2026-89872

CVE-2026-89872 affects the Linux kernel in the v4l2-fwnode media subsystem. The root cause is a fwnode reference leak in v4l2_fwnode_parse_link(): the remote endpoint fwnode handle acquired via fwnode_graph_get_remote_endpoint() is properly released on error paths but is not released on the succe...

CVE-2026-89871

CVE-2026-89871 affects the Linux kernel in the media: video-i2c subsystem. The root cause is that kthread_run() returns an ERR_PTR on failure (not NULL), and when start_streaming() fails, the data->kthread_vid_cap field is left holding this error pointer instead of being reset. This leads to t...

CVE-2026-89870

CVE-2026-89870 is a double-free vulnerability in the Linux kernel 's zoran media driver. During device teardown, zoran_exit_video_devices() called video_unregister_device() (which eventually triggers the V4L2 core's release callback to free the video_device) and then explicitly called kfree(zr-&g...

CVE-2026-89869

The Linux kernel's qcom iris media driver has a race condition in the VPU power-off path. The function iris_vpu_power_off() used disable_irq_nosync(), which does not wait for an already-queued threaded IRQ handler to finish. As a result, a threaded IRQ handler could still execute after the VPU ha...

CVE-2026-89868

This CVE affects the Linux kernel 's chips-media: wave5 VPU decoder driver. The root cause is a potential infinite loop in the stop_streaming function, which can occur when the driver attempts to stop a video decoding stream. The fix introduces a bounded poll of the queue status: the driver now l...

CVE-2026-89867

CVE-2026-89867 affects the Linux kernel chips-media wave5 VPU driver in the media subsystem. Decoder instances sharing a VPU also share a single v4l2_m2m job slot . During end-of-stream (EOS), device_run() defers job_finish() expecting a DEC_PIC completion IRQ to release the slot. However, a job ...

CVE-2026-89866

This vulnerability affects the chips-media wave5 VPU driver in the Linux kernel . When the End-of-Stream (EOS) flag is set via send_firmware_command(), it accesses VPU registers that may be powered down if the device is in a runtime-suspended state. Both the STREAMOFF path (wave5_vpu_dec_job_abor...

CVE-2026-89864

CVE-2026-89864 is a buffer overflow in the Linux kernel 's scsi: qla2xxx driver. The struct qla_i2c_access carries a 16-bit length field paired with a fixed 64-byte buffer , but qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied i2c->length without any bounds check. Because the s...

CVE-2026-89865

CVE-2026-89865 affects the Linux kernel's qla2xxx SCSI driver (QLogic). The FRU and I2C bsg handlers stage transfers in a 256-byte DMA bounce buffer allocated via dma_pool_alloc() , which does not zero the memory. Only a small leading prefix is initialized (e.g., 36 bytes for a FRU version, 1 byt...

CVE-2026-89863

CVE-2026-89863 is a NULL pointer dereference in the Linux kernel's qla2xxx SCSI driver, specifically in the EDIF (Extended Data Integrity Field) subsystem. The function qla_chk_edif_rx_sa_delete_pending() obtains a SCSI command pointer via GET_CMD_SP(sp) and immediately dereferences cmd->sc_da...

CVE-2026-89862

CVE-2026-89862 affects the Linux kernel in the scsi: qla2xxx driver. The function qla28xx_validate_flash_image() returns QLA_SUCCESS (0) unconditionally, signaling to the FC BSG transport that the driver owns and will complete the request. However, bsg_job_done() is guarded by an if (!rval) check...

CVE-2026-89860

CVE-2026-89860 affects the qla2xxx (QLogic) SCSI driver in the Linux kernel , specifically its NVMe abort handling. The root cause is that qla_nvme_fcp_abort() and qla_nvme_ls_abort() called INIT_WORK() on priv->abort_work immediately before schedule_work(). When an abort is issued more than o...

CVE-2026-89861

A use-after-free vulnerability exists in the Linux kernel's qla2xxx SCSI driver, specifically in qla24xx_report_id_acquisition(). In the format 1 path, the virtual port is located on ha->vp_list while holding vport_slock, but the lock is dropped before the vport is subsequently used by qla_upd...

CVE-2026-89859

This Linux kernel vulnerability affects the scsi: qla2xxx (QLogic Fibre Channel HBA) driver. In qla2x00_do_dport_diagnostics(), the qla_dport_diag response buffer is allocated with kmalloc_obj() (non-zeroing), but only a subset of the buffer is populated by the user request. The options and unuse...

CVE-2026-89858

CVE-2026-89858 affects the Linux kernel's qla2xxx SCSI driver in the function qla2x00_update_fru_versions(). A user-supplied BSG request is copied into a fixed 256-byte stack buffer , and the loop iteration count (list->count) is taken directly from user input with no upper bound , while only ...

CVE-2026-89857

CVE-2026-89857 affects the Linux kernel qla2xxx SCSI driver, specifically the NVMe-FC path. The root cause is a missing lock : qla_nvme_ls_reject_iocb() allocates and advances the request ring assuming the hardware lock is held, but two callers—qla_nvme_xmt_ls_rsp() (NVMe-FC transport callback er...