CVE-2026-89770

CVE-2026-89770 is a NULL pointer dereference in the Linux kernel's iomap subsystem . When PI (Protection Information) verification is disabled on a block device, fs_bio_integrity_alloc may fail to allocate a bio integrity payload. The function iomap_bio_read_folio_range_sync then calls fs_bio_int...

CVE-2026-89768

CVE-2026-89768 is a Linux kernel bug in the backing_file_open() function affecting nested stacking filesystems (overlayfs, FUSE passthrough, EROFS ishare). When a user file is itself a backing file (e.g., overlayfs stacked on overlayfs), the function incorrectly derives the stored path from user_...

CVE-2026-89769

CVE-2026-89769 affects the NXP PIT clocksource driver in the Linux kernel. When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has successfully registered an IRQ via request_irq , the error path skips releasing that IRQ and jumps directly to unregistering the clocksource. Since kfree(p...

CVE-2026-89767

CVE-2026-89767 is a Linux kernel overlayfs vulnerability in ovl_create_real() that causes a double call to end_creating() when a casefold consistency check fails on directory creation. This results in the parent directory's i_rwsem being unlocked twice and the dentry being released twice, wedgein...

CVE-2026-89766

This Linux kernel vulnerability affects the PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl(), which perform a ptrace credentials check before handing out a namespace file descriptor. Unlike the equivalent procfs paths (proc_ns_get_link, proc_ns_readlink), the pidfd path did not hold the target task'...

CVE-2026-89764

CVE-2026-89764 addresses a race condition in the Linux kernel's Rust devres (device resource management) subsystem. When two paths concurrently attempt to revoke a Devres—the driver core's devres_release_all() calling Revocable::revoke() and Devres::drop() calling revoke_nosync() on another CPU—o...

CVE-2026-89765

CVE-2026-89765 is a Linux kernel information disclosure vulnerability in the timers/itimer subsystem. On native sparc64 , the __kernel_old_timeval struct contains a four-byte alignment hole after tv_usec (because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit). The put_itimerval() function...

CVE-2026-89763

CVE-2026-89763 affects the Linux kernel's trusted_tpm key-type module. The root cause is a teardown ordering flaw : trusted_tpm_exit() drops the TPM chip reference and frees the digest array before calling unregister_key_type(). Because unregister_key_type() is the synchronization point that bloc...

CVE-2026-89762

CVE-2026-89762 affects the Linux kernel 's AppArmor LSM module. The root cause is a Use-After-Free (UAF) of struct cred introduced by begin_current_label_crit_section(), which replaces credentials during VFS/socket LSM hooks. When overridden credentials are active, the replacement can corrupt ref...

CVE-2026-89760

A flaw in the Linux kernel 's mm, swap subsystem where swap_free_hibernation_slot() unconditionally calls __swap_cluster_free_entries() without first checking whether a folio resides on the slot in the swap cache. Cluster readahead can place a folio on a hibernation slot; freeing the slot then cl...

CVE-2026-89761

CVE-2026-89761 is an out-of-bounds write in the Linux kernel's AppArmor LSM. The root cause is that vec_setup() does not reserve the null-terminator entry required by aa_vec_unique() when VEC_FLAG_TERMINATE is passed, causing a write one slot past the end of the local array or heap allocation. An...

CVE-2026-89759

CVE-2026-89759 affects the Linux kernel's mm/kmemleak subsystem. The root cause is that kmemleak_scan() walks every task stack under a single rcu_read_lock() with no reschedule point; on hosts with a very large number of threads (amplified by KASAN/lockdep in debug builds), the loop can hog a CPU...

CVE-2026-89758

CVE-2026-89758 affects the Linux kernel mm/mempolicy subsystem. The root cause is in queue_folios_pmd(), which is called under pmd_trans_huge_lock(). Since pmd_is_huge() returns true for any non-present, non-none PMD (including device-private swap entries left by HMM-based GPU drivers ), a bogus ...

CVE-2026-89756

CVE-2026-89756 is a Linux kernel flaw in migrate_pages_batch() (mm/migrate). On PREEMPTION kernels, the loop's cond_resched() call is a no-op, and involuntary preemption does not constitute a Tasks-RCU quiescent state . When large page-migration batches run on KVM hosts , the expensive tdp_mmu_za...

CVE-2026-89757

CVE-2026-89757 affects the Linux kernel 's multi-gen LRU (mglru) subsystem. The root cause is a buggy shortcut in sort_folio() for handling unevictable folios: it fails to initialize mlock_count , causing it to alias LIST_POISON2 (value 290). As a result, __munlock_folio() cannot clear the PG_mlo...

CVE-2026-89755

CVE-2026-89755 affects the Linux kernel in the mm/migrate_device subsystem. The root cause is a stale folio mapping retained after folio_free_swap() succeeds: the mapping still points to swap_space, causing folio_migrate_mapping() to take the mapped-folio path and operate on swap_space.i_pages wi...

CVE-2026-89754

CVE-2026-89754 is a stale-state bug in the Linux kernel mm/pagewalk subsystem. When ->pmd_entry() sets walk->action = ACTION_AGAIN and the PMD entry is subsequently cleared, walk_pmd_range() may return without resetting the action to ACTION_SUBTREE. This stale ACTION_AGAIN was harmless unti...

CVE-2026-89753

CVE-2026-89753 affects the Linux kernel in the memory management subsystem (mm/vmscan ). The root cause is that the scan loop in shrink_lruvec() only calls cond_resched(), which is a no-op on PREEMPTION kernels . Since involuntary preemption does not count as a Tasks-RCU quiescent state , a recla...

CVE-2026-89752

A race condition in the Linux kernel's memory cgroup (memcg) subsystem can cause an indefinite reclaim loop when two open files concurrently update memory.max or memory.high. Because kernfs serializes operations only per open file, a first writer may continue reclaiming toward a stale target afte...

CVE-2026-89751

CVE-2026-89751 is an off-by-one error in the Linux kernel's x86 TDX (Trusted Domain Extensions) port I/O handling. The functions handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c compute a bitmask using GENMASK(BITS_PER_BYTE * size, 0). Since GENMASK(h, l) includes bit h , this produces a m...