CVE-2026-89449

CVE-2026-89449 is a memory leak in the Linux kernel IOMMU subsystem, specifically in iommu_mock_device_add() (drivers/iommu/iommu.c). When iommu_fwspec_init() successfully allocates both dev->iommu and dev->iommu->fwspec, but the subsequent device_add() call fails, the error path only ca...

CVE-2026-89447

CVE-2026-89447 affects the Linux kernel iommufd subsystem. In iommufd_access_notify_unmap() , the code calls iommufd_lock_obj() before checking whether the access is internal. When the access is internal, the loop skips it via continue, bypassing the matching iommufd_put_object() call used by the...

CVE-2026-89448

CVE-2026-89448 is a CRITICAL (CVSS 9.3) vulnerability in the Linux kernel's Intel VT-d IOMMU subsystem. The function detect_intel_iommu() fails to check for tboot when determining whether to request ACS (Access Control Services) . When tboot is enabled, tboot_force_iommu() forces the IOMMU on, bu...

CVE-2026-89446

CVE-2026-89446 affects the Linux kernel iommufd subsystem. The root cause is in the error-handling path of iommufd_take_all_iova_rwsem(): when xa_store() fails to insert the current IOAS into the ioas_list xarray, the subsequent call to iommufd_release_all_iova_rwsem() only unwinds entries alread...

CVE-2026-89444

CVE-2026-89444 affects the Linux kernel's platform/x86: dell-wmi-sysman driver. The set_attribute() function populates the security area of the BIOS attribute request buffer with the current admin password via populate_security_buffer(), then calls print_hex_dump_bytes() to dump the entire reques...

CVE-2026-89445

CVE-2026-89445 is a Use-After-Free in the Linux kernel 's iommufd selftest component. The TRIGGER_IOPF selftest borrows an attach handle from group->pasid_array without synchronizing against PASID detach, allowing a concurrent iommu_report_device_fault() to dereference a freed struct iommufd_a...

CVE-2026-89443

CVE-2026-89443 affects the Linux kernel's platform/x86 ISST (Intel Speed Select Technology) module . The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use a user-provided level parameter as an index into perf_levels[] without first validating it against max_level, unlik...

CVE-2026-89442

CVE-2026-89442 affects the Linux kernel 's platform/x86 ISST (Intelligent Speed and Frequency Tuning) module. The isst_if_clos_assoc() ioctl function improperly validates the user-supplied socket_id: it uses > instead of >= against topology_max_packages(), allowing an out-of-bounds array ac...

CVE-2026-89441

CVE-2026-89441 is a use-after-free vulnerability in the Linux kernel's mmc: via-sdmmc driver. During device removal, a previously queued carddet_work can still execute after via_sd_remove() returns, dereferencing the freed host's MMIO base via container_of(). This can lead to system instability o...

CVE-2026-89440

CVE-2026-89440 affects the Linux kernel's via-sdmmc MMC driver . The root cause is a use-after-free that occurs when mmc_add_host() fails during device probe: the SD card-detect interrupt (request_irq()) remains registered and its handler (via_sdc_isr()) continues to dereference the freed host st...

CVE-2026-89439

CVE-2026-89439 affects the Linux kernel's platform/x86 ISST driver . The vulnerability stems from a missing NULL check on isst_common.sst_inst[] when socket loading fails. The fix adds a NULL check to be consistent with other code paths that already handle this condition. No specific affected ker...

CVE-2026-89438

This CVE affects the Linux kernel 's platform/x86: ISST (Intelligent Speed and Frequency Tuning Technology) driver. The root cause is a missing validation of the maximum CLOS ID and logical CPU ID for the core power feature. These values are used to calculate MMIO offsets , so an out-of-range val...

CVE-2026-89437

CVE-2026-89437 affects the Linux kernel 's platform/x86 int1092 driver. The root cause is a memory leak in sar_probe() : memory allocated for device_mode_info by parse_package() (called via sar_get_data() ) is not freed along certain error paths. The fix converts these allocations to device-manag...

CVE-2026-81018

CVE-2026-81018 is a memory leak in the Linux kernel 's platform/x86: think-lmi driver. When multi-certificate support is active, the system authentication object stores ->signature and ->save_signature, which are not freed when the driver is removed. The fix frees these signatures on driver...

CVE-2026-89436

CVE-2026-89436 is an out-of-bounds write in the Linux kernel's panasonic-laptop driver (platform/x86). In acpi_pcc_retrieve_biosdata(), a trailing sentinel is written at pcc->sinf[hkey->package.count], but when a DSDT's SINF package count equals SQTY+1 (a known off-by-one hardware quirk han...

CVE-2026-81017

CVE-2026-81017 affects the Linux kernel's platform/chrome/sensorhub driver. The root cause is a missing validation of the 8-bit EC-reported sensor number in cros_ec_sensorhub_ring_handler(); the unvalidated value is then used to index sensorhub->batch_state[], an array allocated with only sens...

CVE-2026-81015

A resource leak in the Linux kernel's AMD PMC (Power Management Controller) driver (platform/x86/amd/pmc) occurs when amd_stb_s2d_init() fails during probe. The error path leaves the LPS0 s2idle handler registered on the global list and leaks the debugfs directory, while devm-managed resources ar...

CVE-2026-81016

This vulnerability affects the Linux kernel's AMD Platform Management Controller (PMC) driver (platform/x86/amd/pmc). The function amd_stb_s2d_init() discards return values from several S2D SMU commands. When the SMU refuses a command, the S2D_PHYS_ADDR_LOW/HIGH return values are ignored, leaving...

CVE-2026-81014

CVE-2026-81014 is a heap out-of-bounds read in the Linux kernel's platform/x86: hp-bioscfg driver, affecting the sk_store() and kek_store() sysfs write handlers. Both functions strip a trailing newline from user input and allocate a key buffer of size length (one byte shorter), but then pass the ...

CVE-2026-81012

CVE-2026-81012 is an off-by-one write in the Linux kernel's platform/x86: hp-bioscfg driver. The function hp_get_string_from_buffer() uses a strict greater-than (>) comparison when clamping the converted string length against the destination buffer size. When the converted length is exactly eq...