CVE-2026-89589

CVE-2026-89589 affects the Linux kernel in the acpi/apei/ghes subsystem, specifically the CXL CPER work registration and unregistration helpers. The root cause is a deadlock : the CXL CPER work locks are acquired with a regular spinlock guard (interrupts enabled) in register/unregister paths, whi...

CVE-2026-89588

CVE-2026-89588 affects the Linux kernel ACPI APEI GHES subsystem. In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header, the remaining length was incorrectly reduced by sizeof(err) (the pointer size ) instead of sizeof(*err) (the structure size ). This overestimates the avail...

CVE-2026-89587

CVE-2026-89587 is a stack buffer overflow in the Linux kernel's ACPI pfr_update driver. The function query_capability() copies four firmware-supplied ACPI _DSM buffer objects into fixed-size u8[16] fields of the stack-allocated struct pfru_update_cap_info using memcpy with the firmware-provided l...

CVE-2026-89586

CVE-2026-89586 affects the Linux kernel 's ata: libata-scsi subsystem. The function ata_format_dsm_trim_descr() builds a DSM TRIM descriptor into a fixed 2048-byte staging buffer and clamps the return value accordingly. On devices with a logical sector size greater than 2048 bytes (e.g., 4Kn devi...

CVE-2026-89585

CVE-2026-89585 affects the Linux kernel auxdisplay charlcd driver. With CONFIG_CHARLCD_BL_FLASH enabled, charlcd_init() schedules a delayed work item (bl_work) before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while the delayed work still ...

CVE-2026-89583

CVE-2026-89583 affects the Linux kernel Bluetooth EIR subsystem. The function eir_get_service_data() walks advertising data for a matching Service Data UUID but incorrectly decrements eir_len by only the field's data length, omitting the length and type bytes. This shortfall compounds across skip...

CVE-2026-89584

CVE-2026-89584 affects the Linux kernel block subsystem. The root cause is that bio-based drivers do not necessarily check the alignment split, and stacking block drivers do not always handle a misalignment detected after submitting the bio. The fix validates user space vectors against the device...

CVE-2026-89582

This double free vulnerability affects the bnx2x network driver in the Linux kernel . In the error path of bnx2x_init_firmware(), the pointers bp->init_ops, bp->init_data, and bp->init_ops_offsets are freed via kfree() without being set to NULL . When the cleanup function bnx2x_release_f...

CVE-2026-89581

CVE-2026-89581 is a Linux kernel BPF x86 backend bug where the REX prefix is incorrectly built with add_1mod() (setting REX.B) instead of add_2mod() (setting REX.R) when encoding per-CPU address MOV instructions targeting extended registers (R5, R7, R8, R9). The lost high register bit causes reso...

CVE-2026-89580

CVE-2026-89580 affects the Linux kernel BPF subsystem, specifically __bpf_get_stack(). The root cause is a preemption race : a preemptible BPF program (e.g., a non-sleepable raw tracepoint on a PREEMPT kernel) can be scheduled out between obtaining a per-CPU perf_callchain_entry buffer and copyin...

CVE-2026-89579

This Linux kernel vulnerability affects the BPF bloom filter implementation in bloom_map_alloc() on 32-bit kernels . Two distinct defects are present: first, 32-bit arithmetic in DIV_ROUND_UP causes an under-allocation of the bitmap when the computed size reaches the U32_MAX fallback, allowing ou...

CVE-2026-89578

CVE-2026-89578 affects the Linux kernel's dm-io component. In do_region(), DM_IO_BIO requests rebuilt each destination bio by walking the source bio's biovec and re-adding pages individually, using sector-based accounting . When a misaligned O_DIRECT buffer was split across pages, the vector leng...

CVE-2026-89577

CVE-2026-89577 affects the Linux kernel device-mapper subsystem, specifically dm-io and dm-raid1 . The root cause is that the error codes BLK_STS_NOTSUPP and BLK_STS_INVAL were incorrectly treated as retryable errors, causing a leg failure on dm-raid1 when they should not. The fix introduces two ...

CVE-2026-89575

CVE-2026-89575 affects the Linux kernel 's device-mapper RAID1 (dm raid1) subsystem. The vulnerability is a buffer overflow in the build_constructor_string() function, where the code fails to reserve space for the NUL-terminator after the maximum 20 decimal digits of a long long value when callin...

CVE-2026-89576

In the Linux kernel 's dm-era (device mapper era) target, metadata_take_snap() can permanently leak a metadata block on each failed snapshot operation. When dm_tm_shadow_block() allocates a new shadow block for the metadata snapshot, a subsequent failure in dm_sm_inc_block() for either writeset_t...

CVE-2026-89574

CVE-2026-89574 affects the Device Mapper (dm) array subsystem in the Linux kernel . The vulnerability stems from insufficient validation in array_block_check(), which checks only the block number and checksum but not the structural header fields (value_size, max_entries, nr_entries). Because dm_a...

CVE-2026-89572

CVE-2026-89572 affects the Linux kernel cpufreq: apple-soc driver. The root cause is an incorrect OPP (Operating Performance Points) table cleanup mechanism: apple_soc_cpufreq_init() adds OPP tables loaded from firmware, but some failure paths do not remove them, and the driver relies on dev_pm_o...

CVE-2026-89573

CVE-2026-89573 affects the dm-array component of the Linux kernel , used by dm-cache . The root cause is a value-size mismatch between dm-cache's two arrays (8-byte mappings and 4-byte hints). Because array_block_check() only validates a block against its own header, a crafted superblock can poin...

CVE-2026-89571

CVE-2026-89571 affects the Linux kernel 's CXL subsystem (cxl/features). The function fwctl_cmd_rpc() allocates a buffer of cmd->in_len bytes, but the CXL callback cxlctl_fw_rpc() ignores that length and never validates the user-controlled op_size against it. As a result, cxlctl_set_feature() ...

CVE-2026-89570

CVE-2026-89570 affects the Linux kernel's CXL (Compute Express Link) MCE notifier . A lifetime management flaw caused the notifier—stored in struct cxl_memdev_state and registered per memory device—to outlive the objects it referenced, leading to NULL dereferences and use-after-free in the MCE ha...