CVE-2026-89576

In the Linux kernel 's dm-era (device mapper era) target, metadata_take_snap() can permanently leak a metadata block on each failed snapshot operation. When dm_tm_shadow_block() allocates a new shadow block for the metadata snapshot, a subsequent failure in dm_sm_inc_block() for either writeset_t...

CVE-2026-89574

CVE-2026-89574 affects the Device Mapper (dm) array subsystem in the Linux kernel . The vulnerability stems from insufficient validation in array_block_check(), which checks only the block number and checksum but not the structural header fields (value_size, max_entries, nr_entries). Because dm_a...

CVE-2026-89573

CVE-2026-89573 affects the dm-array component of the Linux kernel , used by dm-cache . The root cause is a value-size mismatch between dm-cache's two arrays (8-byte mappings and 4-byte hints). Because array_block_check() only validates a block against its own header, a crafted superblock can poin...

CVE-2026-89572

CVE-2026-89572 affects the Linux kernel cpufreq: apple-soc driver. The root cause is an incorrect OPP (Operating Performance Points) table cleanup mechanism: apple_soc_cpufreq_init() adds OPP tables loaded from firmware, but some failure paths do not remove them, and the driver relies on dev_pm_o...

CVE-2026-89571

CVE-2026-89571 affects the Linux kernel 's CXL subsystem (cxl/features). The function fwctl_cmd_rpc() allocates a buffer of cmd->in_len bytes, but the CXL callback cxlctl_fw_rpc() ignores that length and never validates the user-controlled op_size against it. As a result, cxlctl_set_feature() ...

CVE-2026-54135

AirSane is a SANE frontend and scanner server supporting Apple's AirScan protocol. Versions prior to 0.4.12 are vulnerable to a remote, unauthenticated Denial of Service (OOM) in its custom HTTP server. The root cause lies in the HttpServer::Request::content function in httpserver.cpp, which read...

CVE-2026-89570

CVE-2026-89570 affects the Linux kernel's CXL (Compute Express Link) MCE notifier . A lifetime management flaw caused the notifier—stored in struct cxl_memdev_state and registered per memory device—to outlive the objects it referenced, leading to NULL dereferences and use-after-free in the MCE ha...

CVE-2026-89568

In the Linux kernel , the function kho_preserved_memory_reserve() contains a size-calculation bug. It computes the size of a memory preservation using 1 <

CVE-2026-89569

CVE-2026-89569 is a use-after-free vulnerability in the Linux kernel Bluetooth RFCOMM subsystem. The function rfcomm_security_cfm() looks up an RFCOMM session and walks its DLC (data link connection) list without holding rfcomm_mutex , while the krfcommd thread can concurrently tear down and free...

CVE-2026-89567

CVE-2026-89567 affects the jbd2 (Journalling Block Device v2) subsystem of the Linux kernel . The root cause is that the jbd2 shrinker accounts only successfully released checkpoint buffers against its scan budget (nr_to_scan ), meaning busy buffers consume no budget. If a checkpoint transaction ...

CVE-2026-89566

CVE-2026-89566 affects the Linux kernel's jbd2 (ext3/ext4 journaling) subsystem. The vulnerability exists in journal_shrink_one_cp_list(): when called with JBD2_SHRINK_BUSY_SKIP, the continue statement used to skip busy checkpoint buffers bypasses the need_resched() check at the end of the loop b...

CVE-2026-89564

CVE-2026-89564 affects the Linux kernel 's IPv4 and IPv6 input paths. When a multicast packet is not locally deliverable, the original skb retains a stale skb->sk pointer installed by bpf_sk_assign() or UDP early demux , where no socket reference is guaranteed. After the prefetched socket is d...

CVE-2026-89565

In the Linux kernel , the ipip and mplsip tunnel drivers leak a socket buffer (skb) in collect_md mode when ip_tun_rx_dst() fails to allocate a metadata_dst struct via atomic allocation. The function ipip_tunnel_rcv() returns 0 without freeing the skb, and the callers (tunnel4_rcv() / tunnelmpls4...

CVE-2026-89563

CVE-2026-89563 affects the Linux kernel IPv6 tunnel subsystem (ip6_tunnel). The root cause is in ip6_tnl_xmit(), which used skb_realloc_headroom() to expand headroom before pushing outer IPv6 and optional encapsulation headers. That call consumed the original socket buffer while keeping the repla...

CVE-2026-89562

CVE-2026-89562 is a Linux kernel vulnerability in the ip6_gre module. The function ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This misconfiguration affects both NBMA ip6gre tunnels (wher...

CVE-2026-89561

CVE-2026-89561 is a NULL pointer dereference in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) segment routing path. The function ipv6_rpl_srh_rcv() reads idev->cnf.rpl_seg_enabled after calling __in6_dev_get() without a NULL check. When a device's MTU drops be...

CVE-2026-89560

CVE-2026-89560 is a Landlock LSM flaw in the Linux kernel affecting whiteout creation in userspace OverlayFS (fuse-overlayfs). Whiteout objects, used to mark absent files in the upper overlay layer, could be created via mknod(2) with S_IFCHR/makedev(0,0) or renameat2(2) with RENAME_WHITEOUT. The ...

CVE-2026-89559

CVE-2026-89559 is a Linux kernel vulnerability in the libnvdimm/labels subsystem. The on-media namespace index field nslot (a u32) is read from DIMM label storage or userspace via ND_CMD_SET_CONFIG_DATA. In __nd_label_validate(), the product nslot * label_size is evaluated in 32-bit unsigned arit...

CVE-2026-89558

CVE-2026-89558 affects the Linux kernel md/raid10 subsystem. A refactoring commit (fe6a19d40ceb) converted the still_degraded variable from int to bool but inverted its assignment—still_degraded = 1 became still_degraded = false. When a device is recovered while another mirror remains missing, th...

CVE-2026-89556

CVE-2026-89556 affects the Linux kernel module loader's ELF validity caching. In elf_validity_cache_sechdrs, section sizes and offsets are validated only when the section type is neither SHT_NULL nor SHT_NOBITS. However, elf_validity_cache_secstrings and elf_validity_cache_index_str subsequently ...