CVE-2026-89484

CVE-2026-89484 is a NULL pointer dereference in the Linux kernel's lockd (Network Lock Manager) subsystem. The bug occurs when nlmclnt_find_lockowner() fails to allocate a lockowner, yet nlmclnt_locks_init_private() still installs NLM file lock operations. When the VFS subsequently tears down the...

CVE-2026-89482

CVE-2026-89482 is a wild-memory-access vulnerability in the Linux kernel's nvme-tcp module. The root cause is an incorrect receive-side gate: for REQ_OP_WRITE_ZEROES commands, blk_rq_payload_bytes() returns a non-zero value despite the absence of physical segments, so the setup phase leaves req-&...

CVE-2026-89481

CVE-2026-89481 affects the Linux kernel's NVMe over TCP (nvme-tcp) component. The root cause is that nvme_tcp_handle_r2t() does not validate the direction of the request a Ready to Transfer (R2T) refers to. A malicious NVMe controller can send an R2T for a READ command; the host then sends the co...

CVE-2026-89479

CVE-2026-89479 is a use-after-free in the Linux kernel's SCTP implementation. In sctp_endpoint_bh_rcv(), the association is cached in chunk->asoc and chunk->transport without holding a reference. A remote peer can bundle COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK in a single packet: the COOKIE...

CVE-2026-89480

CVE-2026-89480 affects the NVMe-TCP driver in the Linux kernel. The function nvme_tcp_recv_data() completes a read request once the current C2HData PDU is consumed, but no mechanism compares the total bytes received against the length requested by the command. A malicious or faulty NVMe controlle...

CVE-2026-89478

CVE-2026-89478 is a use-after-free in the Linux kernel's SCTP implementation. An authenticated attacker can send an ASCONF DEL-IP to remove a transport while a DATA chunk is still in flight (on the socket backlog or direct path). The chunk's lingering transport reference causes the transport to b...

CVE-2026-89476

CVE-2026-89476 affects the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. A cached RECONF chunk may contain multiple request parameters, so a duplicate response can re-process the same ADD_OUT request while another parameter is still outstanding, rolling back stream-&g...

CVE-2026-89477

CVE-2026-89477 is a NULL pointer dereference in the Linux kernel's SCTP stream reconfiguration code. When a reconfiguration request is queued in asoc->strreset_chunk but not yet transmitted, chunk->transport remains NULL; three completion functions (sctp_process_strreset_outreq, sctp_proces...

CVE-2026-89475

A use-after-free vulnerability in the Linux kernel's bq24257 power supply driver is triggered during device removal. The STAT-pin interrupt is devm-managed and stays armed until devm cleanup runs after remove() returns. While remove() cancels the iilimit_setup_work, the threaded interrupt handler...

CVE-2026-89474

CVE-2026-89474 is a use-after-free in the Linux kernel's bq256xx power supply driver. On driver removal, the USB-PHY notifier queues a work item (usb_work) whose handler calls power_supply_changed(bq->charger). Because the reset devm action was registered before the power supplies, the devm un...

CVE-2026-89473

This Linux kernel vulnerability affects the bq25890 charger driver in the power supply subsystem. The function bq25890_fw_probe() acquires a reference to a secondary charger via power_supply_get_by_name(), but the reference is not released on subsequent probe failures (e.g., failure in bq25890_hw...

CVE-2026-89472

CVE-2026-89472 is a use-after-free vulnerability in the Linux kernel's power supply charger-manager driver. The root cause is a race condition in the device removal and probe-error paths: charger regulators are freed via regulator_put() before the corresponding power_supply sysfs entries are unre...

CVE-2026-89470

A vulnerability in the Linux kernel's cros_usbpd-charger driver (power supply / USB power delivery) allows a malicious embedded controller to return an exaggerated charger port count (up to 255) that is not bounded by EC_USB_PD_MAX_PORTS , resulting in an out-of-bounds write and subsequent memory...

CVE-2026-89471

CVE-2026-89471 affects the Linux kernel cros_usbpd-charger driver (power supply subsystem). The driver uses an EC-reported num_charger_ports value as a loop bound for an 8-entry fixed-size array (ports[EC_USB_PD_MAX_PORTS]) without validating it against the array size. A malicious or malfunctioni...

CVE-2026-89469

CVE-2026-89469 is a use-after-free vulnerability in the Linux kernel's lp8727 power supply driver . A race condition in lp8727_release_irq() allows a delayed work item to be re-armed by a threaded IRQ handler after the associated memory has been freed by the devm layer, potentially causing memory...

CVE-2026-89467

CVE-2026-89467 is a use-after-free vulnerability in the Linux kernel 's Qualcomm battery management driver (power: supply: qcom_battmgr). The root cause is that qcom_battmgr_pdr_notify() can keep queueing enable_work while the PMIC GLINK client remains on the client list until its devres release ...

CVE-2026-89468

This use-after-free vulnerability affects the lp8788-charger driver in the Linux kernel. During device removal, lp8788_charger_remove() flushed charger_work before unregistering IRQs, allowing an IRQ thread to queue work after the flush completed. That work could then run after devres freed the p...

CVE-2026-89466

CVE-2026-89466 is an out-of-bounds read in the Linux kernel's qcom_battmgr power supply driver (Qualcomm battery manager). The function qcom_battmgr_sc8280xp_strcpy() copies firmware-provided strings for model_number , serial_number , and oem_info without a null terminator when the firmware does ...

CVE-2026-89465

CVE-2026-89465 is a use-after-free in the Linux kernel's rt9455 power supply driver . The threaded IRQ handler can queue delayed work items that are not properly cancelled during device removal or probe failure. Specifically, rt9455_remove() cancels max_charging_time_work before batt_presence_wor...

CVE-2026-89464

CVE-2026-89464 affects the Linux kernel component power: supply: twl4030_charger . The root cause is a use-after-free : the bci structure is devm-allocated, but twl4030_bci_remove() fails to cancel two workers (bci->work and bci->current_worker) that dereference it, allowing a pending worke...