CVE-2026-89601

CVE-2026-89601 affects the Linux kernel ext2 filesystem. The vulnerability resides in ext2_setsize() and ext2_xattr_set2() , where for IS_SYNC inodes, the code called sync_inode_metadata() without first marking the inode dirty. Since sync_inode_metadata() only operates on already-dirty inodes, in...

CVE-2026-89600

CVE-2026-89600 is a use-after-free in the Linux kernel's fanotify subsystem. The function fsnotify_pre_content() builds a file_range on the triggering task's stack, and fanotify_alloc_perm_event() saves a pointer to range.pos inside the heap-allocated permission event. If a signal interrupts the ...

CVE-2026-89599

CVE-2026-89599 affects the Linux kernel 's fbdev/omapfb/panel-dsi-cm driver. The root cause is an initialization order flaw : dsicm_probe() calls omapdss_register_display() to publish the display before initializing the ddata->lock mutex. Once the display is published, another consumer can rea...

CVE-2026-89598

CVE-2026-89598 affects the ssd1307fb fbdev driver in the Linux kernel . The root cause is that fbdev damage callbacks may execute from fbcon while printk has disabled preemption, causing the driver to enter a sleeping I2C transfer path from atomic context . The reported consequence is a "scheduli...

CVE-2026-89597

CVE-2026-89597 affects the uvesafb driver in the Linux kernel (fbdev subsystem). The root cause is in uvesafb_init(): the v86d connector callback is registered before the platform driver. If platform_driver_register() fails, the function returns the error without unregistering the callback, leavi...

CVE-2026-89596

CVE-2026-89596 is an off-by-one error in the Linux kernel's forcedeth (NVIDIA Ethernet) driver, in the nv_suspend() and nv_resume() functions. The loops use <= instead of < when walking the non-PCI configuration space, causing one extra iteration that reads and writes one dword past the map...

CVE-2026-89595

CVE-2026-89595 is a race condition in the Linux kernel's fsnotify subsystem affecting both fanotify and inotify . When concurrent updates modify different marks on the same connector, a scanning thread can read a mark before a new event bit is added, while the updater skips recalculation, leaving...

CVE-2026-89594

CVE-2026-89594 affects the Linux kernel component hsi: omap_ssi_core (OMAP SSI driver). The synthetic HSI controller device is allocated via hsi_alloc_controller(), bypassing the normal OF/platform device initialization path, so its embedded struct device has no DMA mask set. After recent DMA API...

CVE-2026-89593

CVE-2026-89593 affects the Linux kernel hugetlb subsystem. Since commit df7a6d1f6405, the function __unmap_hugepage_range can adjust page reservations during unmapping. The vulnerability arises when a folio is mapped in both a parent and a child process: if the parent unmaps the range first, the ...

CVE-2026-89592

CVE-2026-89592 affects the Linux kernel's accel/rocket driver , specifically the rocket_job_push() function. Two distinct bugs exist: (1) a missing NULL check after a kvmalloc_array() call, which can cause a kernel NULL pointer dereference if the allocation fails; and (2) an integer overflow wher...

CVE-2026-89591

CVE-2026-89591 affects the Linux kernel accel/rocket driver. In rocket_ioctl_submit_job(), error paths release the job via rocket_job_put(), which calls rocket_job_cleanup() and unconditionally invokes rocket_iommu_domain_put(job->domain). However, job->domain is only assigned after task co...

CVE-2026-89590

CVE-2026-89590 affects the Linux kernel's accel/rocket NPU driver. In rocket_job_run(), three error-path bugs exist: a dma_fence reference leak (the extra fence reference taken via dma_fence_get() is never released), a runtime PM usage counter leak (pm_runtime_get_sync() increments the counter ev...

CVE-2026-89589

CVE-2026-89589 affects the Linux kernel in the acpi/apei/ghes subsystem, specifically the CXL CPER work registration and unregistration helpers. The root cause is a deadlock : the CXL CPER work locks are acquired with a regular spinlock guard (interrupts enabled) in register/unregister paths, whi...

CVE-2026-89588

CVE-2026-89588 affects the Linux kernel ACPI APEI GHES subsystem. In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header, the remaining length was incorrectly reduced by sizeof(err) (the pointer size ) instead of sizeof(*err) (the structure size ). This overestimates the avail...

CVE-2026-89587

CVE-2026-89587 is a stack buffer overflow in the Linux kernel's ACPI pfr_update driver. The function query_capability() copies four firmware-supplied ACPI _DSM buffer objects into fixed-size u8[16] fields of the stack-allocated struct pfru_update_cap_info using memcpy with the firmware-provided l...

CVE-2026-89586

CVE-2026-89586 affects the Linux kernel 's ata: libata-scsi subsystem. The function ata_format_dsm_trim_descr() builds a DSM TRIM descriptor into a fixed 2048-byte staging buffer and clamps the return value accordingly. On devices with a logical sector size greater than 2048 bytes (e.g., 4Kn devi...

CVE-2026-89585

CVE-2026-89585 affects the Linux kernel auxdisplay charlcd driver. With CONFIG_CHARLCD_BL_FLASH enabled, charlcd_init() schedules a delayed work item (bl_work) before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while the delayed work still ...

CVE-2026-89584

CVE-2026-89584 affects the Linux kernel block subsystem. The root cause is that bio-based drivers do not necessarily check the alignment split, and stacking block drivers do not always handle a misalignment detected after submitting the bio. The fix validates user space vectors against the device...

CVE-2026-89583

CVE-2026-89583 affects the Linux kernel Bluetooth EIR subsystem. The function eir_get_service_data() walks advertising data for a matching Service Data UUID but incorrectly decrements eir_len by only the field's data length, omitting the length and type bytes. This shortfall compounds across skip...

CVE-2026-89582

This double free vulnerability affects the bnx2x network driver in the Linux kernel . In the error path of bnx2x_init_firmware(), the pointers bp->init_ops, bp->init_data, and bp->init_ops_offsets are freed via kfree() without being set to NULL . When the cleanup function bnx2x_release_f...