CVE-2026-89512

CVE-2026-89512 is a device reference leak in the Linux kernel's remoteproc: scp subsystem. When the driver attempts to look up the SCP device's driver data before the driver has been bound, a reference to the device is taken but not properly dropped if the lookup fails. Holding a device reference...

CVE-2026-89511

A NULL pointer dereference in the Linux kernel's qede (Qualcomm Ethernet) driver can cause a kernel panic under memory pressure. The root cause is that commit 8a8633978b84 accidentally dropped the assignment of tpa_info->buffer.data in qede_tpa_start(). When an SKB allocation fails, the driver...

CVE-2026-89510

CVE-2026-89510 affects the Linux kernel 's RDMA/cxgb4 driver. The root cause is a use-after-free condition: c4iw_remove() can free ctx->dev while a previously queued reg_work (originated by c4iw_uld_state_change()) is still pending or running, causing c4iw_register_device() to access the alrea...

CVE-2026-89509

CVE-2026-89509 affects the Linux kernel 's RDMA/ionic driver . The root cause is that the ionic driver was merged without adapting to the rdma_zalloc_drv_obj() API introduced by commit 7e53b31acc7f, which requires drivers to embed struct rdma_counter in a driver-specific struct and register its s...

CVE-2026-89508

The Linux kernel RDMA/ucma subsystem contains a race condition in ucma_set_ib_path(), which calls ucma_event_handler() from the write path without acquiring the handler lock. A concurrent ucma_migrate_id() can reassign ctx->file between mutex operations, causing list_add_tail() to target a dif...

CVE-2026-89507

CVE-2026-89507 is a race condition in the Linux kernel's RDMA/ucma subsystem, specifically in ucma_write_cm_event(). The function re-reads ctx->file for each of its four dereferences, and ucma_migrate_id() can swap that pointer mid-sequence while the writer sleeps inside mutex_lock(). This cau...

CVE-2026-89506

CVE-2026-89506 affects the Linux kernel RDMA/uverbs subsystem. The root cause is a missing UVERBS_ATTR_UHW attribute in the UVERBS_METHOD_REG_MR ioctl definition. Three drivers—mthca , irdma , and siw —associate UHW data with reg_mr but assume the udata pointer is non-NULL. Because the attribute ...

CVE-2026-89505

CVE-2026-89505 is a vulnerability in the Linux kernel RDMA/uverbs subsystem. In the legacy write() path, the uverbs_attr_bundle passed to provider code does not contain an ioctl method element. If malformed provider input causes the common uverbs validation code to emit an error message, uverbs_g...

CVE-2026-89504

CVE-2026-89504 is a memory-management bug in the Linux kernel AS3722 regulator driver. In as3722_get_regulator_dt_data(), the function of_get_child_by_name() acquires a reference on a node pointer (np) and assigns it to pdev->dev.of_node, but the subsequent immediate call to of_node_put(np) re...

CVE-2026-89503

CVE-2026-89503 affects the Linux kernel ring-buffer subsystem. A race condition exists between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set: if subbuf_order changes during the execution of ring_buffer_alloc_read_page(), the resulting bpage->order may not match the actual allo...

CVE-2026-89502

CVE-2026-89502 is a Linux kernel vulnerability in the ring-buffer subsystem. The root cause is that when sub-buffers use a page order greater than 0 , the cpu_buffer->free_page field is allocated using subbuf_order but subsequently freed with the wrong order, leading to an incorrect page relea...

CVE-2026-89501

CVE-2026-89501 affects the Linux kernel ring-buffer subsystem. The vulnerability is a race condition introduced because ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page without holding cpu_buffer->lock, racing with ring_buffer_alloc_read_page() and ring_buffer_free_read_page()...

CVE-2026-89500

CVE-2026-89500 affects the Linux kernel ring-buffer subsystem. The flaw resides in cpu_buffer::free_page: when a cached reader page is discarded after a concurrent ring buffer resize , the free_pages() call uses the new global subbuf_order rather than the order under which the page was originally...

CVE-2026-89499

This Linux kernel vulnerability affects the ring-buffer subsystem. The swap_reader_page remote callback can return -EBUSY when the writer moves the head before the remote reader catches up—particularly during an event storm on a small buffer. The function __rb_get_reader_page_from_remote() previo...

CVE-2026-89498

CVE-2026-89498 affects the orangefs (PVFS2) module in the Linux kernel. On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf via vfree() when copy_from_iter_full() fails but does not clear the pointer before jumping to the error path. The waiter in do_readdir() is...

CVE-2026-89497

CVE-2026-89497 affects the orangefs module in the Linux kernel. The vulnerability resides in orangefs_prepare_cdm_array(), which sizes each client debug keyword buffer using strcspn(cds_head, " ") but then parses the keyword with %s via sscanf(). Because %s skips leading whitespace while strcspn(...

CVE-2026-89496

CVE-2026-89496 is a memory leak in the Linux kernel OCFS2 filesystem, discovered via local fuzzing of version 6.12.94 . The leak occurs when copy_file_range() is called within the same OCFS2 filesystem, triggering a copy-on-write path that fails to release deallocation caches (ocfs2_cache_block_d...

CVE-2026-89495

Linux kernel (ocfs2/dlm subsystem) is vulnerable to a heap out-of-bounds write in dlm_migrate_request_handler(). A peer-supplied namelen field (u8) from a DLM_MIGRATE_REQUEST message is passed unchecked to dlm_init_mle(), which memcpy()s it into a fixed 32-byte mname[] array, allowing up to ~215 ...

CVE-2026-89494

CVE-2026-89494 is a Linux kernel vulnerability in the OCFS2 DLM subsystem, specifically in dlm_mig_lockres_handler. A node receiving a DLM_MIG_LOCKRES message trusts peer-supplied num_locks and lockname_len fields without validation. This leads to two distinct issues: an out-of-bounds read in dlm...

CVE-2026-89492

Linux kernel ocfs2 filesystem contains a slab out-of-bounds read in the indexed-directory validation path. The functions ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check ECC and signatures but fail to bound de_num_used and de_count against the 4 KB block capacity. A crafted on-disk ima...