CVE-2026-89944

CVE-2026-89944 is a reference-count leak in the Linux kernel's ASoC hdac_hda driver. In hdac_hda_dev_probe(), an HDA link reference is acquired via snd_hdac_ext_bus_link_get() before registering the ASoC component. If component registration fails, the function returns without calling snd_hdac_ext...

CVE-2026-89945

CVE-2026-89945 affects the ASoC cs35l34 codec driver in the Linux kernel . The root cause is that cs35l34_runtime_suspend() transitions the codec into regcache_cache_only mode, asserts reset low, and powers the device off without first quiescing the threaded IRQ registered via devm_request_thread...

CVE-2026-89943

CVE-2026-89943 affects the Linux kernel's ASoC (ALSA) loongson audio driver. In the loongson_card_parse_acpi() function, the return value of device_property_read_string() for the codec-dai-name ACPI property was ignored. When the property is missing or invalid, an uninitialized pointer is subsequ...

CVE-2026-89942

CVE-2026-89942 is a use-after-free in the Linux kernel's IIO buffer subsystem, specifically in the anonymous buffer release path. When an anonymous buffer handle holds the last reference to an IIO device that has been removed (via unbind or hot-unplug), the release function's scoped guard causes ...

CVE-2026-89941

CVE-2026-89941 is a use-after-free vulnerability in the Linux kernel IIO buffer subsystem (iio: buffer). The iio_dma_fence implementation provided a custom release callback that called kfree(), which is not RCU-safe as required by the dma_fence documentation. The fix removes the custom release, a...

CVE-2026-89940

CVE-2026-89940 is a use-after-free in the Linux kernel's IIO buffer subsystem. The iio_dma_fence implementation used a lock embedded in iio_dmabuf_priv, but the fence can outlive the iio_dmabuf_priv struct, leading to a use-after-free when the fence accesses the freed lock. The fix ties the lock'...

CVE-2026-89938

CVE-2026-89938 is a use-after-free (UAF) in the Linux kernel's IIO chemical atlas-sensor driver. When the driver is removed, the devm-managed IRQ is freed via free_irq() during the devres unwind, but a pending irq_work (atlas_work_handler) is not flushed first. If a buffer is enabled, the handler...

CVE-2026-89939

In the Linux kernel 's iio: chemical: atlas-sensor driver, atlas_buffer_postenable() acquires a runtime PM reference via pm_runtime_resume_and_get() but returns the result of atlas_set_interrupt() directly. If that call fails, the reference is leaked , preventing the device from ever autosuspendi...

CVE-2026-89937

CVE-2026-89937 affects the Linux kernel 's IIO chemical sensor driver sgp30 . The root cause is that sgp_probe() fails to check the return value of kthread_run() when creating the IAQ (Indoor Air Quality) thread. If the thread creation fails, an error pointer is stored but the probe still returns...

CVE-2026-89936

CVE-2026-89936 affects the Linux kernel 's iio: dac: m62332 driver (Microchip M62332 DAC). The function m62332_set_value() enables the Vcc regulator on every non-zero channel write and disables it on every zero write, but does not track the channel's prior state. Because the regulator is referenc...

CVE-2026-89935

CVE-2026-89935 affects the Linux kernel iio: light: apds9306 driver (APDS9306 ambient light sensor). The root cause is a runtime PM reference leak : apds9306_read_data() calls pm_runtime_resume_and_get() but several error paths return without the matching pm_runtime_put_autosuspend(), preventing ...

CVE-2026-89934

CVE-2026-89934 is a runtime PM (Power Management) reference leak in the Linux kernel's LTRF216A light sensor driver (IIO subsystem). The function ltrf216a_get_lux() acquires a runtime PM reference via ltrf216a_set_power_state(data, true), but when ltrf216a_read_data() fails, it returns without re...

CVE-2026-89933

CVE-2026-89933 is a NULL pointer dereference in the Linux kernel's IIO pressure driver for the DPS310 (Infineon IFX3100). When the device is enumerated via its ACPI HID (IFX3100) , i2c_client_get_device_id() returns NULL because the ACPI-derived client name does not match the driver's i2c_device_...

CVE-2026-89931

CVE-2026-89931 affects the Linux kernel's KVM nVMX (nested virtualization) subsystem. The root cause is that the KVM_REQ_GET_NESTED_STATE_PAGES flag is not reliably cleared when emulating a nested VM-Exit, specifically when KVM is built with CONFIG_KVM_HYPERV=n . Because KVM implicitly relies on ...

CVE-2026-89932

CVE-2026-89932 affects the Linux kernel's KVM nested VMX (nVMX) subsystem. The root cause is that the last_vpid variable is not reset to 0 when the L2 VPID (vpid02) is freed on VMXOFF. If KVM subsequently reuses a VPID that still has stale TLB entries on the physical CPU from a previous vCPU or a...

CVE-2026-89930

CVE-2026-89930 affects the Linux kernel's KVM nVMX subsystem (nested virtualization). The root cause is that KVM failed to service local TLB flushes when a nested VM-Enter failed (e.g., due to failed VMCS checks in nested_vmx_enter_non_root_mode()). Specifically, a failed VM-Enter would update la...

CVE-2026-89929

CVE-2026-89929 affects the Linux kernel KVM subsystem, specifically the nested virtualization (nVM ) code path that emulates the INVVPID instruction. When a guest L1 vCPU migrates between physical CPUs and issues INVVPID, KVM executes the instruction on the current physical CPU rather than the on...

CVE-2026-89928

CVE-2026-89928 is a slab use-after-free in the Linux kernel's KVM x86/mmu subsystem. The root cause is a race condition in the lockless reverse-mapping (rmap) walk: kvm_rmap_age_gfn_range() ignores the value returned by kvm_rmap_lock_readonly() and instead re-reads the rmap head via rmap_get_firs...

CVE-2026-89927

CVE-2026-89927 is an integer overflow vulnerability in the Linux kernel's KVM x86 Hyper-V synthetic timer (stimer) emulation. When the STIMER COUNT MSR is programmed with a value close to U64_MAX , the deadline calculation overflows, producing a deadline in the past. This causes the hrtimer to fi...

CVE-2026-89926

CVE-2026-89926 affects the Linux kernel KVM s390 subsystem in the __import_wp_info() function. The root cause is a type truncation : the user-space-controlled kvm_hw_breakpoint::len (a __u64) is assigned to wp_info->len (an int). The bounds check evaluates the truncated value, but the subseque...