CVE-2026-89584

CVE-2026-89584 affects the Linux kernel block subsystem. The root cause is that bio-based drivers do not necessarily check the alignment split, and stacking block drivers do not always handle a misalignment detected after submitting the bio. The fix validates user space vectors against the device...

CVE-2026-89583

CVE-2026-89583 affects the Linux kernel Bluetooth EIR subsystem. The function eir_get_service_data() walks advertising data for a matching Service Data UUID but incorrectly decrements eir_len by only the field's data length, omitting the length and type bytes. This shortfall compounds across skip...

CVE-2026-89582

This double free vulnerability affects the bnx2x network driver in the Linux kernel . In the error path of bnx2x_init_firmware(), the pointers bp->init_ops, bp->init_data, and bp->init_ops_offsets are freed via kfree() without being set to NULL . When the cleanup function bnx2x_release_f...

CVE-2026-89581

CVE-2026-89581 is a Linux kernel BPF x86 backend bug where the REX prefix is incorrectly built with add_1mod() (setting REX.B) instead of add_2mod() (setting REX.R) when encoding per-CPU address MOV instructions targeting extended registers (R5, R7, R8, R9). The lost high register bit causes reso...

CVE-2026-89580

CVE-2026-89580 affects the Linux kernel BPF subsystem, specifically __bpf_get_stack(). The root cause is a preemption race : a preemptible BPF program (e.g., a non-sleepable raw tracepoint on a PREEMPT kernel) can be scheduled out between obtaining a per-CPU perf_callchain_entry buffer and copyin...

CVE-2026-89579

This Linux kernel vulnerability affects the BPF bloom filter implementation in bloom_map_alloc() on 32-bit kernels . Two distinct defects are present: first, 32-bit arithmetic in DIV_ROUND_UP causes an under-allocation of the bitmap when the computed size reaches the U32_MAX fallback, allowing ou...

CVE-2026-89578

CVE-2026-89578 affects the Linux kernel's dm-io component. In do_region(), DM_IO_BIO requests rebuilt each destination bio by walking the source bio's biovec and re-adding pages individually, using sector-based accounting . When a misaligned O_DIRECT buffer was split across pages, the vector leng...

CVE-2026-89577

CVE-2026-89577 affects the Linux kernel device-mapper subsystem, specifically dm-io and dm-raid1 . The root cause is that the error codes BLK_STS_NOTSUPP and BLK_STS_INVAL were incorrectly treated as retryable errors, causing a leg failure on dm-raid1 when they should not. The fix introduces two ...

CVE-2026-89575

CVE-2026-89575 affects the Linux kernel 's device-mapper RAID1 (dm raid1) subsystem. The vulnerability is a buffer overflow in the build_constructor_string() function, where the code fails to reserve space for the NUL-terminator after the maximum 20 decimal digits of a long long value when callin...

CVE-2026-89576

In the Linux kernel 's dm-era (device mapper era) target, metadata_take_snap() can permanently leak a metadata block on each failed snapshot operation. When dm_tm_shadow_block() allocates a new shadow block for the metadata snapshot, a subsequent failure in dm_sm_inc_block() for either writeset_t...

CVE-2026-89574

CVE-2026-89574 affects the Device Mapper (dm) array subsystem in the Linux kernel . The vulnerability stems from insufficient validation in array_block_check(), which checks only the block number and checksum but not the structural header fields (value_size, max_entries, nr_entries). Because dm_a...

CVE-2026-89573

CVE-2026-89573 affects the dm-array component of the Linux kernel , used by dm-cache . The root cause is a value-size mismatch between dm-cache's two arrays (8-byte mappings and 4-byte hints). Because array_block_check() only validates a block against its own header, a crafted superblock can poin...

CVE-2026-89572

CVE-2026-89572 affects the Linux kernel cpufreq: apple-soc driver. The root cause is an incorrect OPP (Operating Performance Points) table cleanup mechanism: apple_soc_cpufreq_init() adds OPP tables loaded from firmware, but some failure paths do not remove them, and the driver relies on dev_pm_o...

CVE-2026-89571

CVE-2026-89571 affects the Linux kernel 's CXL subsystem (cxl/features). The function fwctl_cmd_rpc() allocates a buffer of cmd->in_len bytes, but the CXL callback cxlctl_fw_rpc() ignores that length and never validates the user-controlled op_size against it. As a result, cxlctl_set_feature() ...

CVE-2026-89570

CVE-2026-89570 affects the Linux kernel's CXL (Compute Express Link) MCE notifier . A lifetime management flaw caused the notifier—stored in struct cxl_memdev_state and registered per memory device—to outlive the objects it referenced, leading to NULL dereferences and use-after-free in the MCE ha...

CVE-2026-54135

AirSane is a SANE frontend and scanner server supporting Apple's AirScan protocol. Versions prior to 0.4.12 are vulnerable to a remote, unauthenticated Denial of Service (OOM) in its custom HTTP server. The root cause lies in the HttpServer::Request::content function in httpserver.cpp, which read...

CVE-2026-89568

In the Linux kernel , the function kho_preserved_memory_reserve() contains a size-calculation bug. It computes the size of a memory preservation using 1 <

CVE-2026-89569

CVE-2026-89569 is a use-after-free vulnerability in the Linux kernel Bluetooth RFCOMM subsystem. The function rfcomm_security_cfm() looks up an RFCOMM session and walks its DLC (data link connection) list without holding rfcomm_mutex , while the krfcommd thread can concurrently tear down and free...

CVE-2026-89567

CVE-2026-89567 affects the jbd2 (Journalling Block Device v2) subsystem of the Linux kernel . The root cause is that the jbd2 shrinker accounts only successfully released checkpoint buffers against its scan budget (nr_to_scan ), meaning busy buffers consume no budget. If a checkpoint transaction ...

CVE-2026-89566

CVE-2026-89566 affects the Linux kernel's jbd2 (ext3/ext4 journaling) subsystem. The vulnerability exists in journal_shrink_one_cp_list(): when called with JBD2_SHRINK_BUSY_SKIP, the continue statement used to skip busy checkpoint buffers bypasses the need_resched() check at the end of the loop b...