CVE-2026-89482

CVE-2026-89482 affects the nvme-tcp driver in the Linux kernel . The root cause is a gap in the receive-side gate: it checks blk_rq_payload_bytes() but not req->data_len. For REQ_OP_WRITE_ZEROES operations, no physical segments exist yet blk_rq_bytes() is non-zero, so req->iter retains a st...

CVE-2026-89481

CVE-2026-89481 affects the nvme-tcp driver in the Linux kernel . The function nvme_tcp_handle_r2t() fails to verify the direction of the NVMe request when processing a Ready to Transfer (R2T) message. A malicious NVMe controller can send an R2T referencing a READ command, causing the host to tran...

CVE-2026-89479

CVE-2026-89479 is a use-after-free in the Linux kernel's SCTP subsystem. In sctp_endpoint_bh_rcv(), a packet's association and transport are cached without holding a reference. A peer can bundle COOKIE ECHO , SHUTDOWN , and SHUTDOWN ACK in a single packet, causing the association to be freed mid-...

CVE-2026-89480

CVE-2026-89480 affects the nvme-tcp driver in the Linux kernel . The root cause is that nvme_tcp_recv_data() completes a read request once the current C2HData PDU is consumed, without comparing the total bytes received against the length the command requested. No receive-side counter exists in st...

CVE-2026-89478

CVE-2026-89478 is a use-after-free in the Linux kernel SCTP subsystem. The root cause is a race condition: an authenticated ASCONF DEL-IP can remove a transport while a received chunk still holds a reference to it. After the packet is processed, the reference count drops, the transport is freed v...

CVE-2026-89476

CVE-2026-89476 is a Linux kernel vulnerability in the SCTP subsystem. A cached RECONF chunk may contain more than one request parameter, so a duplicate response can find and process the same ADD_OUT request again while another parameter is still outstanding, rolling back stream->outcnt twice a...

CVE-2026-89477

CVE-2026-89477 is a NULL pointer dereference in the Linux kernel SCTP subsystem , specifically in the stream reconfiguration (RECONF) completion path. When a reconfiguration request is published in asoc->strreset_chunk but has not yet been transmitted, its chunk->transport pointer remains N...

CVE-2026-89475

A use-after-free vulnerability in the Linux kernel's bq24257 power supply driver is triggered during device removal. The STAT-pin interrupt is devm-managed and stays armed until devm cleanup runs after remove() returns. While remove() cancels the iilimit_setup_work, the threaded interrupt handler...

CVE-2026-89473

This Linux kernel vulnerability affects the bq25890 charger driver in the power supply subsystem. The function bq25890_fw_probe() acquires a reference to a secondary charger via power_supply_get_by_name(), but the reference is not released on subsequent probe failures (e.g., failure in bq25890_hw...

CVE-2026-89474

CVE-2026-89474 is a use-after-free in the Linux kernel's bq256xx power supply driver. On driver removal, the USB-PHY notifier queues a work item (usb_work) whose handler calls power_supply_changed(bq->charger). Because the reset devm action was registered before the power supplies, the devm un...

CVE-2026-89472

CVE-2026-89472 is a use-after-free in the Linux kernel's power: supply: charger-manager driver. The root cause is an ordering defect: on removal and probe-error paths, charger regulators are freed via regulator_put() before the corresponding power_supply sysfs entries are torn down, creating a wi...

CVE-2026-89470

Linux kernel cros_usbpd-charger driver (power/supply) fails to properly bound the charger port count returned by the embedded controller (EC) during probe. The only check is against the EC-defined USB PD port count, so a malicious EC can report an inflated port count (up to 255), causing an out-o...

CVE-2026-89471

CVE-2026-89471 affects the Linux kernel's cros_usbpd-charger driver (power: supply subsystem). In cros_usbpd_charger_probe(), the EC-reported num_charger_ports value is used as a loop bound to populate a fixed-size array ports[EC_USB_PD_MAX_PORTS] of 8 entries, but is never validated against that...

CVE-2026-89469

CVE-2026-89469 is a use-after-free vulnerability in the Linux kernel's power: supply: lp8727 driver. The root cause is a race condition in lp8727_release_irq(): it cancels the delayed work before freeing the IRQ, so an IRQ arriving between those two operations can re-arm the work via the threaded...

CVE-2026-89467

CVE-2026-89467 is a use-after-free vulnerability in the Linux kernel 's Qualcomm battery management driver (power: supply: qcom_battmgr). The root cause is that qcom_battmgr_pdr_notify() can keep queueing enable_work while the PMIC GLINK client remains on the client list until its devres release ...

CVE-2026-89468

This use-after-free vulnerability affects the lp8788-charger driver in the Linux kernel. During device removal, lp8788_charger_remove() flushed charger_work before unregistering IRQs, allowing an IRQ thread to queue work after the flush completed. That work could then run after devres freed the p...

CVE-2026-89466

CVE-2026-89466 affects the Linux kernel 's qcom_battmgr driver on the SC8280XP platform. The function qcom_battmgr_sc8280xp_strcpy() copies all BATTMGR_STRING_LEN bytes from firmware without a null terminator when the firmware does not send a Pascal-style string. The affected fields—model_number ...

CVE-2026-89465

A use-after-free vulnerability in the Linux kernel's rt9455 power supply driver (Richtek RT9455 charger/fuel-gauge IC). During rt9455_remove() or a probe error path, a race condition allowed batt_presence_work to re-queue max_charging_time_work after it had already been cancelled, and the IRQ cou...

CVE-2026-89464

CVE-2026-89464 affects the Linux kernel component power: supply: twl4030_charger . The root cause is a use-after-free : the bci structure is devm-allocated, but twl4030_bci_remove() fails to cancel two workers (bci->work and bci->current_worker) that dereference it, allowing a pending worke...

CVE-2026-89463

This vulnerability is a use-after-free in the Linux kernel's power: supply: ucs1002 driver, triggered during device removal. Because the driver has no explicit remove callback, unbind relies entirely on devm cleanup. The alert IRQ handler queues a health_poll delayed work that reschedules itself ...