CVE-2026-89539

Linux kernel SUNRPC subsystem: gssx_dec_option_array() processes wire-supplied GSS option entries and calls gssx_dec_linux_creds() for each CREDS_VALUE match. Because that helper unconditionally overwrites creds->cr_group_info without releasing the previous pointer, a reply containing two CRED...

CVE-2026-89538

CVE-2026-89538 affects the Linux kernel SUNRPC subsystem. The vulnerability resides in gss_krb5_unwrap_v2() , where a peer holding a valid GSS context can encrypt a Kerberos v2 wrap token whose 16-bit "extra count" (ec) field exceeds the plaintext length. Although a prior fix clamped the subtract...

CVE-2026-89537

CVE-2026-89537 is an out-of-bounds read in the Linux kernel 's SUNRPC subsystem, specifically in gss_krb5_verify_mic_v2() . The function reads the token ID, flags byte, and padding from a GSS-KRB5 MIC token without first checking read_token->len against the minimum safe size of GSS_KRB5_TOK_HD...

CVE-2026-89536

CVE-2026-89536 affects the Linux kernel SUNRPC subsystem. The root cause is a race condition between cancellation and completion during a client-side TLS handshake. When xs_tls_handshake_sync() drops its reference to the lower transport after calling tls_handshake_cancel(), the completion callbac...

CVE-2026-89535

CVE-2026-89535 is a use-after-free vulnerability in the Linux kernel's svcrdma (RDMA-based NFS server) subsystem. In svc_rdma_free(), the call to rdma_destroy_id(sc_cm_id) frees the CM ID while the transport's sc_rn notification entry remains installed in the device's rd_xa xarray until the subse...

CVE-2026-89534

CVE-2026-89534 affects the Linux kernel's svcrdma (SCS RDMA) subsystem. When svc_rdma_listen_handler() processes an RDMA_CM_EVENT_ADDR_CHANGE event, it allocates a replacement listener cm_id and signals the CM core to destroy the old one. If the replacement allocation fails , sc_cm_id still point...

CVE-2026-89533

CVE-2026-89533 is a Linux kernel vulnerability in the svcrdma (NFS/RDMA server) subsystem. Two arithmetic defects in svc_rdma_read_chunk_range() cause incorrect DMA lengths and a u32 underflow : a boundary check uses > instead of >=, and the offset subtraction is applied outside the min_t()...

CVE-2026-89532

CVE-2026-89532 is a Linux kernel vulnerability in the svcrdma (SUNRPC RDMA server) subsystem. The pcl_for_each_segment macro computes its loop bound as ch_segments[ch_segcount - 1]; when ch_segcount is zero, the u32 subtraction wraps to 0xFFFFFFFF, causing the loop to walk far past the flex array...

CVE-2026-89531

This CVE affects the svcrdma module in the Linux kernel . The vulnerability resides in handle_connect_req() : when svc_rdma_create_xprt() fails to allocate a new transport, the handler returns without action, causing the CM core to retain the new rdma_cm_id rather than destroying it. Each allocat...

CVE-2026-89530

A vulnerability in the Linux kernel 's svcrdma (RPC-over-RDMA server) component allows an RPC-over-RDMA client to trigger a buffer overflow when requesting a reply (e.g., an NFS READ payload) without providing a Write list or Reply chunk. When the reply requires more scatter/gather entries than t...

CVE-2026-89529

CVE-2026-89529 affects the svcrdma (NFS/RDMA server) subsystem in the Linux kernel . The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation: xdr_count_read_segments() checks 4-byte alignment but does not cap the segment length. An oversized rs_length reaches svc_rd...

CVE-2026-89528

CVE-2026-89528 affects the Linux kernel 's svcrdma subsystem (SVC RDMA, used in NFS/RDMA). Individual Read segment lengths are validated at decode time, but a requester can send multiple segments whose cumulative length exceeds the rq_pages array budget . When one segment fills the page array exa...

CVE-2026-89527

This Linux kernel vulnerability affects the svcrdma (RPC/NFS RDMA server) subsystem. The root cause is an improper error-path cleanup in svc_rdma_create(): when svc_rdma_create_listen_id() fails, the code calls kfree() on the transport structure, bypassing svc_xprt_free(). This leaks the net name...

CVE-2026-89526

CVE-2026-89526 affects the Linux kernel's svcrdma (NFS/RPC over RDMA server) module. The root cause is that the RPC/RDMA Read chunk position field is supplied by the remote client and used verbatim without validation against the received inline body length. In the single-chunk path, a position pa...

CVE-2026-89525

This vulnerability affects the Linux kernel's UDF 1.50 virtual partition mapping in the function udf_get_pblock_virt15() . The root cause is an off-by-one bounds check : the code rejected only indexes greater than s_num_entries, but valid VAT indexes are strictly below that value. A crafted UDF i...

CVE-2026-89524

This vulnerability affects the ath6kl WiFi driver in the Linux kernel . In ath6kl_cfg80211_connect_event(), fixed IE offsets (4 bytes for the association request, 6 bytes for the response) are subtracted from unsigned 8-bit length fields with no lower bound. When a malicious or malformed associat...

CVE-2026-89523

CVE-2026-89523 affects the Linux kernel wireless driver mt76 (mt7925) , used with MediaTek Wi-Fi 7 chips. A delayed work item (mlo_pm_work) can execute after the device is reset, suspended, or unregistered, leading to a use-after-free of vif/bss data or the sending of MCU commands while the firmw...

CVE-2026-89522

CVE-2026-89522 is a use-after-free in the Linux kernel's media: staging/ipu7 driver. When a probe step (e.g., isys_fw_log_init()) fails after isys_register_devices() has registered the V4L2 async notifier, the error path calls isys_unregister_devices() but never unregisters or cleans up the async...

CVE-2026-89521

CVE-2026-89521 affects the Linux kernel scheduler (sched/core ). The vulnerability is in core scheduling's pick_next_task() : when a ->pick_task() implementation can release the rq lock, the selection state derived on entry becomes invalid. This can cause the single-CPU fast path to commit an ...

CVE-2026-89520

CVE-2026-89520 affects the Linux kernel's core scheduling subsystem (sched/core). The root cause is a lock-ordering bug in pick_next_task(): when a ->pick_task() call releases the rq lock mid-selection, every sibling __lock becomes momentarily free, allowing __sched_core_flip(false) to complet...