CVE-2026-89592

CVE-2026-89592 affects the Linux kernel's accel/rocket driver , specifically the rocket_job_push() function. Two distinct bugs exist: (1) a missing NULL check after a kvmalloc_array() call, which can cause a kernel NULL pointer dereference if the allocation fails; and (2) an integer overflow wher...

CVE-2026-89591

CVE-2026-89591 affects the Linux kernel accel/rocket driver. In rocket_ioctl_submit_job(), error paths release the job via rocket_job_put(), which calls rocket_job_cleanup() and unconditionally invokes rocket_iommu_domain_put(job->domain). However, job->domain is only assigned after task co...

CVE-2026-89590

CVE-2026-89590 affects the Linux kernel's accel/rocket NPU driver. In rocket_job_run(), three error-path bugs exist: a dma_fence reference leak (the extra fence reference taken via dma_fence_get() is never released), a runtime PM usage counter leak (pm_runtime_get_sync() increments the counter ev...

CVE-2026-89589

CVE-2026-89589 affects the Linux kernel in the acpi/apei/ghes subsystem, specifically the CXL CPER work registration and unregistration helpers. The root cause is a deadlock : the CXL CPER work locks are acquired with a regular spinlock guard (interrupts enabled) in register/unregister paths, whi...

CVE-2026-89588

CVE-2026-89588 is a Linux kernel vulnerability in the ACPI APEI GHES (Generic Hardware Error Source) component, specifically in ghes_handle_arm_hw_error(). After skipping the cper_sec_proc_arm header via pointer arithmetic (err + 1), the remaining buffer length was incorrectly reduced by sizeof(e...

CVE-2026-89587

CVE-2026-89587 is a stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) driver. The query_capability() function uses memcpy to copy four firmware-supplied ACPI buffer objects (code_type, drv_type, platform_id, oem_id) into fixed-size u8[16] fields of the...

CVE-2026-89586

CVE-2026-89586 affects the Linux kernel libata-scsi component. The root cause is that ata_format_dsm_trim_descr() clamps the TRIM descriptor copy length to 2048 bytes (ATA_SCSI_RBUF_SIZE), while the caller compares the result against the device's logical sector size . On devices with sector sizes...

CVE-2026-89585

A use-after-free vulnerability in the Linux kernel's auxdisplay: charlcd driver occurs when charlcd_init() schedules a delayed backlight work item (bl_work) before charlcd_register() completes. If registration fails, the charlcd object is freed while the delayed work still holds its address. A lo...

CVE-2026-89584

CVE-2026-89584 is a vulnerability in the Linux kernel block layer where user-space I/O vectors (iov_iter) are not validated against the device's DMA alignment requirements. Bio-based drivers may not check alignment splits, and stacking block drivers may not handle misalignment detected after bio ...

CVE-2026-89583

CVE-2026-89583 is an out-of-bounds (OOB) read in the Linux kernel's Bluetooth EIR parser, specifically in eir_get_service_data(). The root cause is an incorrect length calculation: when walking Extended Inquiry Response advertising data, the eir_len variable is decremented by only the data length...

CVE-2026-89582

This double free vulnerability affects the bnx2x network driver in the Linux kernel . In the error path of bnx2x_init_firmware(), the pointers bp->init_ops, bp->init_data, and bp->init_ops_offsets are freed via kfree() without being set to NULL . When the cleanup function bnx2x_release_f...

CVE-2026-89581

A BPF x86 JIT flaw in the Linux kernel causes incorrect per-CPU address resolution when the destination is an extended register (R5–R9). The root cause is an encoding error: the REX prefix is built with add_1mod() (setting REX.B) instead of add_2mod() (setting REX.R), so the high register bit is ...

CVE-2026-89580

CVE-2026-89580 is a race condition in the Linux kernel's BPF subsystem , specifically in __bpf_get_stack. A preemptible BPF program (e.g., a non-sleepable raw tracepoint program on a PREEMPT kernel) can be scheduled out between obtaining a per-CPU perf_callchain_entry buffer and copying it. Anoth...

CVE-2026-89579

CVE-2026-89579 affects the Linux kernel's BPF bloom filter on 32-bit x86 systems. Two distinct flaws exist in bloom_map_alloc() when the computed bitmap reaches the U32_MAX fallback: (1) a 32-bit arithmetic wrap in DIV_ROUND_UP causes under-allocation of the bitmap, and (2) hash values in the ran...

CVE-2026-89578

CVE-2026-89578 affects the Linux kernel's dm-io component. In do_region(), DM_IO_BIO requests rebuilt each destination bio by walking the source bio's biovec and re-adding pages individually, using sector-based accounting . When a misaligned O_DIRECT buffer was split across pages, the vector leng...

CVE-2026-89577

CVE-2026-89577 affects the Linux kernel device-mapper subsystem, specifically dm-io and dm-raid1 . The root cause is that the error codes BLK_STS_NOTSUPP and BLK_STS_INVAL were incorrectly treated as retryable errors, causing a leg failure on dm-raid1 when they should not. The fix introduces two ...

CVE-2026-89575

CVE-2026-89575 affects the Linux kernel 's device-mapper RAID1 (dm raid1) subsystem. The vulnerability is a buffer overflow in the build_constructor_string() function, where the code fails to reserve space for the NUL-terminator after the maximum 20 decimal digits of a long long value when callin...

CVE-2026-89576

In the Linux kernel 's dm-era (device mapper era) target, metadata_take_snap() can permanently leak a metadata block on each failed snapshot operation. When dm_tm_shadow_block() allocates a new shadow block for the metadata snapshot, a subsequent failure in dm_sm_inc_block() for either writeset_t...

CVE-2026-89574

CVE-2026-89574 is a vulnerability in the Linux kernel's device mapper (dm) array component. The root cause is insufficient validation of array block headers during read operations: array_block_check() only verifies blocknr and csum, while element_at() performs unguarded pointer arithmetic driven ...

CVE-2026-89572

CVE-2026-89572 affects the Linux kernel cpufreq: apple-soc driver. The root cause is an incorrect OPP (Operating Performance Points) table cleanup mechanism: apple_soc_cpufreq_init() adds OPP tables loaded from firmware, but some failure paths do not remove them, and the driver relies on dev_pm_o...