CVE-2026-89595

CVE-2026-89595 is a race condition in the Linux kernel's fsnotify subsystem affecting both fanotify and inotify . When concurrent updates modify different marks on the same connector, a scanning thread can read a mark before a new event bit is added, while the updater skips recalculation, leaving...

CVE-2026-89594

CVE-2026-89594 affects the Linux kernel component hsi: omap_ssi_core (OMAP SSI driver). The synthetic HSI controller device is allocated via hsi_alloc_controller(), bypassing the normal OF/platform device initialization path, so its embedded struct device has no DMA mask set. After recent DMA API...

CVE-2026-89593

CVE-2026-89593 affects the Linux kernel hugetlb subsystem. Since commit df7a6d1f6405, the function __unmap_hugepage_range can adjust page reservations during unmapping. The vulnerability arises when a folio is mapped in both a parent and a child process: if the parent unmaps the range first, the ...

CVE-2026-89592

CVE-2026-89592 affects the Linux kernel's accel/rocket driver , specifically the rocket_job_push() function. Two distinct bugs exist: (1) a missing NULL check after a kvmalloc_array() call, which can cause a kernel NULL pointer dereference if the allocation fails; and (2) an integer overflow wher...

CVE-2026-89591

CVE-2026-89591 affects the Linux kernel accel/rocket driver. In rocket_ioctl_submit_job(), error paths release the job via rocket_job_put(), which calls rocket_job_cleanup() and unconditionally invokes rocket_iommu_domain_put(job->domain). However, job->domain is only assigned after task co...

CVE-2026-89590

CVE-2026-89590 affects the Linux kernel's accel/rocket NPU driver. In rocket_job_run(), three error-path bugs exist: a dma_fence reference leak (the extra fence reference taken via dma_fence_get() is never released), a runtime PM usage counter leak (pm_runtime_get_sync() increments the counter ev...

CVE-2026-89589

CVE-2026-89589 affects the Linux kernel in the acpi/apei/ghes subsystem, specifically the CXL CPER work registration and unregistration helpers. The root cause is a deadlock : the CXL CPER work locks are acquired with a regular spinlock guard (interrupts enabled) in register/unregister paths, whi...

CVE-2026-89588

CVE-2026-89588 affects the Linux kernel ACPI APEI GHES subsystem. In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header, the remaining length was incorrectly reduced by sizeof(err) (the pointer size ) instead of sizeof(*err) (the structure size ). This overestimates the avail...

CVE-2026-89587

CVE-2026-89587 is a stack buffer overflow in the Linux kernel's ACPI pfr_update driver. The function query_capability() copies four firmware-supplied ACPI _DSM buffer objects into fixed-size u8[16] fields of the stack-allocated struct pfru_update_cap_info using memcpy with the firmware-provided l...

CVE-2026-89586

CVE-2026-89586 affects the Linux kernel 's ata: libata-scsi subsystem. The function ata_format_dsm_trim_descr() builds a DSM TRIM descriptor into a fixed 2048-byte staging buffer and clamps the return value accordingly. On devices with a logical sector size greater than 2048 bytes (e.g., 4Kn devi...

CVE-2026-89585

CVE-2026-89585 affects the Linux kernel auxdisplay charlcd driver. With CONFIG_CHARLCD_BL_FLASH enabled, charlcd_init() schedules a delayed work item (bl_work) before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while the delayed work still ...

CVE-2026-89583

CVE-2026-89583 affects the Linux kernel Bluetooth EIR subsystem. The function eir_get_service_data() walks advertising data for a matching Service Data UUID but incorrectly decrements eir_len by only the field's data length, omitting the length and type bytes. This shortfall compounds across skip...

CVE-2026-89584

CVE-2026-89584 affects the Linux kernel block subsystem. The root cause is that bio-based drivers do not necessarily check the alignment split, and stacking block drivers do not always handle a misalignment detected after submitting the bio. The fix validates user space vectors against the device...

CVE-2026-89582

This double free vulnerability affects the bnx2x network driver in the Linux kernel . In the error path of bnx2x_init_firmware(), the pointers bp->init_ops, bp->init_data, and bp->init_ops_offsets are freed via kfree() without being set to NULL . When the cleanup function bnx2x_release_f...

CVE-2026-89581

CVE-2026-89581 is a Linux kernel BPF x86 backend bug where the REX prefix is incorrectly built with add_1mod() (setting REX.B) instead of add_2mod() (setting REX.R) when encoding per-CPU address MOV instructions targeting extended registers (R5, R7, R8, R9). The lost high register bit causes reso...

CVE-2026-89580

CVE-2026-89580 affects the Linux kernel BPF subsystem, specifically __bpf_get_stack(). The root cause is a preemption race : a preemptible BPF program (e.g., a non-sleepable raw tracepoint on a PREEMPT kernel) can be scheduled out between obtaining a per-CPU perf_callchain_entry buffer and copyin...

CVE-2026-89579

This Linux kernel vulnerability affects the BPF bloom filter implementation in bloom_map_alloc() on 32-bit kernels . Two distinct defects are present: first, 32-bit arithmetic in DIV_ROUND_UP causes an under-allocation of the bitmap when the computed size reaches the U32_MAX fallback, allowing ou...

CVE-2026-89578

CVE-2026-89578 affects the Linux kernel's dm-io component. In do_region(), DM_IO_BIO requests rebuilt each destination bio by walking the source bio's biovec and re-adding pages individually, using sector-based accounting . When a misaligned O_DIRECT buffer was split across pages, the vector leng...

CVE-2026-89577

CVE-2026-89577 affects the Linux kernel device-mapper subsystem, specifically dm-io and dm-raid1 . The root cause is that the error codes BLK_STS_NOTSUPP and BLK_STS_INVAL were incorrectly treated as retryable errors, causing a leg failure on dm-raid1 when they should not. The fix introduces two ...

CVE-2026-89575

CVE-2026-89575 affects the Linux kernel 's device-mapper RAID1 (dm raid1) subsystem. The vulnerability is a buffer overflow in the build_constructor_string() function, where the code fails to reserve space for the NUL-terminator after the maximum 20 decimal digits of a long long value when callin...