CVE-2026-89463

This vulnerability is a use-after-free in the Linux kernel's power: supply: ucs1002 driver, triggered during device removal. Because the driver has no explicit remove callback, unbind relies entirely on devm cleanup. The alert IRQ handler queues a health_poll delayed work that reschedules itself ...

CVE-2026-89462

CVE-2026-89462 affects the Linux kernel power: supply: max17040 driver. The functions max17040_get_vcell() and max17040_get_soc() ignore errors returned by regmap_read() . When an I2C transfer fails , the uninitialized register value is converted and reported to userspace as a valid voltage or st...

CVE-2026-89461

CVE-2026-89461 affects the Linux kernel's max17040 fuel gauge power supply driver. The root cause is a race condition during system suspend: max17040_work() requeues itself after every poll, and cancel_delayed_work() only cancels a pending instance without waiting for a callback that is already e...

CVE-2026-89460

CVE-2026-89460 affects the Linux kernel on s390 systems using the CPUMF (Command Processor Measurement Facility) PMU driver. The root cause is that per-CPU cpu_cf_events structures are allocated only for CPUs online at event-creation time. If a CPU is hotplugged online during a perf stat run with...

CVE-2026-89459

CVE-2026-89459 affects the Linux kernel's s390/percpu component. The macro MVIY_PERCPU() stringifies arguments that are already C string literals, producing whitespace-separated quoted assembler macro arguments. When compiled with GNU as prior to binutils 2.39 , the assembler drops separating whi...

CVE-2026-89458

CVE-2026-89458 affects the s390/dasd driver in the Linux kernel. The function dasd_int_handler() completes an NRF read of an unallocated ESE track by calling ese_read() and unconditionally marking the request as DASD_CQR_SUCCESS. However, dasd_eckd_ese_read() can return an error before zeroing th...

CVE-2026-89456

CVE-2026-89456 affects the Linux kernel 's s390/dasd (Direct Access Storage Device) driver. During error recovery path (ERP) processing, dasd_default_erp_postaction() fails to propagate the proc_bytes field from a finished ERP request back to the original request. When a disk read is partially co...

CVE-2026-89457

CVE-2026-89457 affects the s390/dasd subsystem in the Linux kernel. During dasd_generic_set_online(), a device's discipline is assigned before check_device() allocates device->private. Several sysfs show/store handlers dereference this pointer without a null check, so an unprivileged read of a...

CVE-2026-89455

CVE-2026-89455 is a use-after-free vulnerability in the Linux kernel's PCI PLDA driver . During device teardown, irq_domain_remove() frees the event IRQ domain's internal data before the deferred free_irq() calls (managed by devres) execute, causing a later dereference of the already-freed domain...

CVE-2026-89453

CVE-2026-89453 is a PCI device reference count leak in the Linux kernel's iommu/amd subsystem. The function iommu_call_iopf_notifier() calls pci_get_domain_bus_and_slot() which increments the device's reference count, but neither the successful iommu_report_device_fault() path nor the abort path ...

CVE-2026-89454

CVE-2026-89454 affects the Linux kernel in the PCI plda driver. The function plda_init_interrupts() initializes IRQ domains and creates IRQ mappings but fails to unwind them when a later step fails. Specifically, if platform_get_irq() or irq_create_mapping() fails, the domains are never deinitial...

CVE-2026-89452

CVE-2026-89452 affects the iommu/msm driver in the Linux kernel. The root cause is an improper error-handling path in msm_iommu_probe(): when iommu_device_sysfs_add() or iommu_device_register() fails, the IOMMU object is left in the global qcom_iommu_devices list after its devm-managed memory has...

CVE-2026-89450

CVE-2026-89450 affects the Linux kernel's iommu/tegra241-cmdqv module. The function tegra241_vintf_init_vsid() programs a guest-provided virtual Stream ID (vSID) into the SID_MATCH register, whose VIRT_SID field spans only 20 bits (bits [20:1]). The existing bound check rejects only virt_sid >...

CVE-2026-89451

CVE-2026-89451 is a race condition in the Linux kernel 's iommu/sva subsystem. iommu_attach_device_pasid() installs the SVA attach handle into the group PASID lookup before iommu_sva_bind_device() returns, allowing a concurrent bind to find and reuse the handle after iommu_sva_lock is dropped. Ho...

CVE-2026-89449

CVE-2026-89449 is a memory leak in the Linux kernel IOMMU subsystem, specifically in iommu_mock_device_add() (drivers/iommu/iommu.c). When iommu_fwspec_init() successfully allocates both dev->iommu and dev->iommu->fwspec, but the subsequent device_add() call fails, the error path only ca...

CVE-2026-89447

CVE-2026-89447 affects the Linux kernel iommufd subsystem. In iommufd_access_notify_unmap() , the code calls iommufd_lock_obj() before checking whether the access is internal. When the access is internal, the loop skips it via continue, bypassing the matching iommufd_put_object() call used by the...

CVE-2026-89448

CVE-2026-89448 is a CRITICAL (CVSS 9.3) vulnerability in the Linux kernel's Intel VT-d IOMMU subsystem. The function detect_intel_iommu() fails to check for tboot when determining whether to request ACS (Access Control Services) . When tboot is enabled, tboot_force_iommu() forces the IOMMU on, bu...

CVE-2026-89446

CVE-2026-89446 affects the Linux kernel iommufd subsystem. The root cause is in the error-handling path of iommufd_take_all_iova_rwsem(): when xa_store() fails to insert the current IOAS into the ioas_list xarray, the subsequent call to iommufd_release_all_iova_rwsem() only unwinds entries alread...

CVE-2026-89444

CVE-2026-89444 affects the Linux kernel's platform/x86: dell-wmi-sysman driver. The set_attribute() function populates the security area of the BIOS attribute request buffer with the current admin password via populate_security_buffer(), then calls print_hex_dump_bytes() to dump the entire reques...

CVE-2026-89445

CVE-2026-89445 is a Use-After-Free in the Linux kernel 's iommufd selftest component. The TRIGGER_IOPF selftest borrows an attach handle from group->pasid_array without synchronizing against PASID detach, allowing a concurrent iommu_report_device_fault() to dereference a freed struct iommufd_a...