CVE-2026-89772

CVE-2026-89772 affects the btrfs filesystem in the Linux kernel . A patch (commit 095be159f3eb) replaced the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a plain folio_test_dirty() check, losing the write-protection of shared mmap PTEs during data writeback. Without this pro...

CVE-2026-89773

CVE-2026-89773 affects the drm/amd/display driver in the Linux kernel. The root cause is that the HDCP configuration routine was being invoked during a transition state , in which no valid dm_stream_ctx exists. The fix skips updating HDCP configuration unless a valid stream has been created, as r...

CVE-2026-89771

CVE-2026-89771 is a race condition in the Linux kernel ring-buffer subsystem. The trace_buffer field subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can be concurrently resized via ring_buffer_subbuf_order_set(). Even with resize_disabled, a race wit...

CVE-2026-89770

CVE-2026-89770 is a NULL pointer dereference in the Linux kernel's iomap subsystem . When PI (Protection Information) verification is disabled on a block device, fs_bio_integrity_alloc may fail to allocate a bio integrity payload. The function iomap_bio_read_folio_range_sync then calls fs_bio_int...

CVE-2026-89768

CVE-2026-89768 is a Linux kernel bug in the backing_file_open() function affecting nested stacking filesystems (overlayfs, FUSE passthrough, EROFS ishare). When a user file is itself a backing file (e.g., overlayfs stacked on overlayfs), the function incorrectly derives the stored path from user_...

CVE-2026-89769

CVE-2026-89769 affects the NXP PIT clocksource driver in the Linux kernel. When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has successfully registered an IRQ via request_irq , the error path skips releasing that IRQ and jumps directly to unregistering the clocksource. Since kfree(p...

CVE-2026-89767

CVE-2026-89767 is a Linux kernel overlayfs vulnerability in ovl_create_real() that causes a double call to end_creating() when a casefold consistency check fails on directory creation. This results in the parent directory's i_rwsem being unlocked twice and the dentry being released twice, wedgein...

CVE-2026-89766

This Linux kernel vulnerability affects the PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl(), which perform a ptrace credentials check before handing out a namespace file descriptor. Unlike the equivalent procfs paths (proc_ns_get_link, proc_ns_readlink), the pidfd path did not hold the target task'...

CVE-2026-89764

CVE-2026-89764 addresses a race condition in the Linux kernel's Rust devres (device resource management) subsystem. When two paths concurrently attempt to revoke a Devres—the driver core's devres_release_all() calling Revocable::revoke() and Devres::drop() calling revoke_nosync() on another CPU—o...

CVE-2026-89765

CVE-2026-89765 is a Linux kernel information disclosure vulnerability in the timers/itimer subsystem. On native sparc64 , the __kernel_old_timeval struct contains a four-byte alignment hole after tv_usec (because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit). The put_itimerval() function...

CVE-2026-89763

CVE-2026-89763 affects the Linux kernel's trusted_tpm key-type module. The root cause is a teardown ordering flaw : trusted_tpm_exit() drops the TPM chip reference and frees the digest array before calling unregister_key_type(). Because unregister_key_type() is the synchronization point that bloc...

CVE-2026-89762

CVE-2026-89762 affects the Linux kernel 's AppArmor LSM module. The root cause is a Use-After-Free (UAF) of struct cred introduced by begin_current_label_crit_section(), which replaces credentials during VFS/socket LSM hooks. When overridden credentials are active, the replacement can corrupt ref...

CVE-2026-89760

A flaw in the Linux kernel 's mm, swap subsystem where swap_free_hibernation_slot() unconditionally calls __swap_cluster_free_entries() without first checking whether a folio resides on the slot in the swap cache. Cluster readahead can place a folio on a hibernation slot; freeing the slot then cl...

CVE-2026-89761

CVE-2026-89761 is an out-of-bounds write in the Linux kernel's AppArmor LSM. The root cause is that vec_setup() does not reserve the null-terminator entry required by aa_vec_unique() when VEC_FLAG_TERMINATE is passed, causing a write one slot past the end of the local array or heap allocation. An...

CVE-2026-89759

CVE-2026-89759 affects the Linux kernel's mm/kmemleak subsystem. The root cause is that kmemleak_scan() walks every task stack under a single rcu_read_lock() with no reschedule point; on hosts with a very large number of threads (amplified by KASAN/lockdep in debug builds), the loop can hog a CPU...

CVE-2026-89758

CVE-2026-89758 affects the Linux kernel mm/mempolicy subsystem. The root cause is in queue_folios_pmd(), which is called under pmd_trans_huge_lock(). Since pmd_is_huge() returns true for any non-present, non-none PMD (including device-private swap entries left by HMM-based GPU drivers ), a bogus ...

CVE-2026-89756

CVE-2026-89756 is a Linux kernel flaw in migrate_pages_batch() (mm/migrate). On PREEMPTION kernels, the loop's cond_resched() call is a no-op, and involuntary preemption does not constitute a Tasks-RCU quiescent state . When large page-migration batches run on KVM hosts , the expensive tdp_mmu_za...

CVE-2026-89757

CVE-2026-89757 affects the Linux kernel 's multi-gen LRU (mglru) subsystem. The root cause is a buggy shortcut in sort_folio() for handling unevictable folios: it fails to initialize mlock_count , causing it to alias LIST_POISON2 (value 290). As a result, __munlock_folio() cannot clear the PG_mlo...

CVE-2026-89755

CVE-2026-89755 affects the Linux kernel in the mm/migrate_device subsystem. The root cause is a stale folio mapping retained after folio_free_swap() succeeds: the mapping still points to swap_space, causing folio_migrate_mapping() to take the mapped-folio path and operate on swap_space.i_pages wi...

CVE-2026-89754

CVE-2026-89754 is a stale-state bug in the Linux kernel mm/pagewalk subsystem. When ->pmd_entry() sets walk->action = ACTION_AGAIN and the PMD entry is subsequently cleared, walk_pmd_range() may return without resetting the action to ACTION_SUBTREE. This stale ACTION_AGAIN was harmless unti...