CVE-2026-89499

This Linux kernel vulnerability affects the ring-buffer subsystem. The swap_reader_page remote callback can return -EBUSY when the writer moves the head before the remote reader catches up—particularly during an event storm on a small buffer. The function __rb_get_reader_page_from_remote() previo...

CVE-2026-89498

CVE-2026-89498 affects the orangefs (PVFS2) module in the Linux kernel. On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf via vfree() when copy_from_iter_full() fails but does not clear the pointer before jumping to the error path. The waiter in do_readdir() is...

CVE-2026-89497

CVE-2026-89497 affects the orangefs module in the Linux kernel. The vulnerability resides in orangefs_prepare_cdm_array(), which sizes each client debug keyword buffer using strcspn(cds_head, " ") but then parses the keyword with %s via sscanf(). Because %s skips leading whitespace while strcspn(...

CVE-2026-89495

Linux kernel (ocfs2/dlm subsystem) is vulnerable to a heap out-of-bounds write in dlm_migrate_request_handler(). A peer-supplied namelen field (u8) from a DLM_MIGRATE_REQUEST message is passed unchecked to dlm_init_mle(), which memcpy()s it into a fixed 32-byte mname[] array, allowing up to ~215 ...

CVE-2026-89496

CVE-2026-89496 is a memory leak in the Linux kernel OCFS2 filesystem, discovered via local fuzzing of version 6.12.94 . The leak occurs when copy_file_range() is called within the same OCFS2 filesystem, triggering a copy-on-write path that fails to release deallocation caches (ocfs2_cache_block_d...

CVE-2026-89494

CVE-2026-89494 is a Linux kernel vulnerability in the OCFS2 DLM subsystem, specifically in dlm_mig_lockres_handler. A node receiving a DLM_MIG_LOCKRES message trusts peer-supplied num_locks and lockname_len fields without validation. This leads to two distinct issues: an out-of-bounds read in dlm...

CVE-2026-89492

Linux kernel ocfs2 filesystem contains a slab out-of-bounds read in the indexed-directory validation path. The functions ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check ECC and signatures but fail to bound de_num_used and de_count against the 4 KB block capacity. A crafted on-disk ima...

CVE-2026-89493

CVE-2026-89493 affects the ocfs2 filesystem in the Linux kernel. In ocfs2_validate_refcount_block(), the rl_used and rl_count fields of an on-disk refcount block are never checked against the block's fixed record capacity (247 for a 4K block) or against each other. A crafted or corrupted block wi...

CVE-2026-89491

CVE-2026-89491 affects the OCFS2 cluster subsystem in the Linux kernel. The o2hb_region_pin() function is called while holding the o2hb_live_lock spinlock, yet it invokes configfs_depend_item(), which sleeps by taking the configfs root inode rwsem and pinning the filesystem. Under CONFIG_DEBUG_AT...

CVE-2026-89489

CVE-2026-89489 affects the Linux kernel on the OpenRISC (or1k) architecture. The sys_or1k_atomic() syscall (number 244) swaps two user-supplied pointers via hand-written assembly but fails to validate them with access_ok() , and the four memory operations lack exception table entries. An unprivil...

CVE-2026-89490

CVE-2026-89490 affects the ocfs2 filesystem in the Linux kernel on 32-bit systems. In ocfs2_dir_foreach_blk_el(), the directory position mask derived from sb->s_blocksize (a 32-bit unsigned long) is zero-extended to 64 bits when ANDed with the loff_t-typed ctx->pos, silently clearing the hi...

CVE-2026-89488

CVE-2026-89488 is a slab-use-after-free in the Linux kernel's Open vSwitch (OVS) connection-tracking (CT) limit handling. Packet processing reads CT limit state under RCU , while network-namespace teardown frees it under ovs_mutex without a grace period, leaving a dangling pointer that packet pro...

CVE-2026-89487

In the Linux kernel's Open vSwitch subsystem, queue_userspace_packet() erroneously calls skb_tx_error() on a borrowed skb that do_execute_actions() continues to forward, stripping the SKBFL_SHARED_FRAG flag. For a MSG_ZEROCOPY skb carrying page-cache fragments, this causes a later ESP-in-UDP deli...

CVE-2026-89486

CVE-2026-89486 is a use-after-free in the Linux kernel IPMI subsystem. A prior commit (9e91f8a6c868) removed the synchronize_rcu() call before freeing entries from the cmd_rcvrs list, but that list is still traversed under plain RCU by find_cmd_rcvr() and handle_ipmb_get_msg_cmd(). Without the gr...

CVE-2026-89485

CVE-2026-89485 is a use-after-free vulnerability in the Linux kernel's lockd (NLM) subsystem, specifically in nlm_traverse_files(). The function pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but the saved next pointer remains unpinned . A concurrent nlm_releas...

CVE-2026-89483

CVE-2026-89483 is a Linux kernel vulnerability in the NVMe subsystem. When nvme_setup_discard() maps a 4096-byte DSM payload but a single-range discard fills only the first 16 bytes, the remaining 4080 bytes come from the fallback ctrl->discard_page, which is allocated via alloc_page(GFP_KERNE...

CVE-2026-89484

CVE-2026-89484 is a NULL pointer dereference in the Linux kernel's lockd (Network Lock Manager) subsystem. The bug occurs when nlmclnt_find_lockowner() fails to allocate a lockowner, yet nlmclnt_locks_init_private() still installs NLM file lock operations. When the VFS subsequently tears down the...

CVE-2026-89482

CVE-2026-89482 affects the nvme-tcp driver in the Linux kernel . The root cause is a gap in the receive-side gate: it checks blk_rq_payload_bytes() but not req->data_len. For REQ_OP_WRITE_ZEROES operations, no physical segments exist yet blk_rq_bytes() is non-zero, so req->iter retains a st...

CVE-2026-89481

CVE-2026-89481 affects the nvme-tcp driver in the Linux kernel . The function nvme_tcp_handle_r2t() fails to verify the direction of the NVMe request when processing a Ready to Transfer (R2T) message. A malicious NVMe controller can send an R2T referencing a READ command, causing the host to tran...

CVE-2026-89479

CVE-2026-89479 is a use-after-free in the Linux kernel's SCTP subsystem. In sctp_endpoint_bh_rcv(), a packet's association and transport are cached without holding a reference. A peer can bundle COOKIE ECHO , SHUTDOWN , and SHUTDOWN ACK in a single packet, causing the association to be freed mid-...