CVE-2026-90425

A flaw was found in the Linux kernel, specifically within the IOMMU Input/Output Memory Management Unit Tegra241 command queue driver. This vulnerability arises from improper handling of virtual Stream IDs vSID when a device has either multiple or no physical Stream IDs. A malicious guest operati...

CVE-2026-90423

A flaw was found in the Linux kernel's RDMA/rxe component. An error in the On-Demand Paging ODP initialization path can lead to a Use-After-Free UAF vulnerability. During error handling, memory is prematurely released, but a pointer to it is not properly cleared. This allows subsequent operations...

CVE-2026-90420

A flaw was found in the nilfs2 component of the Linux kernel. When the nilfs2 filesystem encounters an I/O error and is subsequently remounted as read-only, a cleaner input/output control ioctl operation can enter an infinite loop. This condition causes the affected task to hang indefinitely,...

CVE-2026-90421

A flaw was found in the Linux kernel's Peripheral Component Interconnect PCI subsystem. This Use-After-Free UAF vulnerability arises when a PCI device probe operation occurs concurrently with the removal of a dynamic ID. This timing issue could allow a local attacker to cause a system crash,...

CVE-2026-90418

A flaw was found in nilfs2, a file system in the Linux kernel. This vulnerability occurs when a dirty page unexpectedly loses its dirty status during a copy operation, particularly after the filesystem detects metadata corruption and transitions to read-only mode. An attacker could potentially...

CVE-2026-90419

A flaw was found in the nilfs2 filesystem implementation within the Linux kernel. This vulnerability occurs due to insufficient validation of super-root inode metadata size before parsing. A local attacker could craft a malicious filesystem image that, when processed, causes an out-of-bounds read...

CVE-2026-90416

A flaw was found in the Linux kernel's RDMA/mlx5 component. The getparam function, used for debugging congestion parameters, incorrectly formats a 32-bit unsigned integer as a signed integer. This can lead to a stack out-of-bounds read when a large value is processed, potentially causing unexpect...

CVE-2026-90413

A flaw was found in the Linux kernel's IB/isert component. A remote attacker can exploit this vulnerability by sending a specially crafted login Protocol Data Unit PDU that declares a larger data segment length than the actual data received. This discrepancy causes an out-of-bounds read during...

CVE-2026-90412

A flaw was found in the nvmet component of the Linux kernel. When processing an RMI log page, if memory allocation for the log buffer fails, the system incorrectly reports a successful operation to the host. This can lead to the host believing data was transferred when it was not, potentially...

CVE-2026-90410

A flaw was found in the Linux kernel's Serial Peripheral Interface SPI davinci component. A timing issue exists during the deallocation of the SPI controller, where its memory can be freed before the associated interrupt handler is fully drained. This can lead to a use-after-free vulnerability,...

CVE-2026-90408

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This vulnerability arises from insufficient length enforcement for event structures and unchecked firmware input used as loop bounds. An attacker could potentially exploit this to cause an out-of-bounds read, which may lead to informatio...

CVE-2026-90409

A flaw was found in the Linux kernel's drm/panthor driver. This vulnerability arises from a missing check that allows user-mode virtual memory VM bind mappings to overlap with memory regions reserved for kernel Buffer Objects BOs. A local attacker could exploit this to cause memory corruption,...

CVE-2026-90406

A flaw was found in the Linux kernel's media: qcom: iris driver. This vulnerability occurs when the iriscoredeinit function fails to properly handle a runtime Power Management PM resume failure. An attacker could potentially exploit this by triggering a scenario where the pmruntimeresumeandget...

CVE-2026-90405

A flaw was found in the media: stm32: dcmi component of the Linux kernel. Improper error handling in the probe function can lead to a null pointer dereference. This issue occurs because dmareleasechannel is called before the dcmi-dmachan variable is properly assigned, potentially allowing a local...

CVE-2026-90403

A flaw was found in the Linux kernel's rtlwifi PCI driver. An issue in the rtlpciprobe error handling path causes cleanup functions to be skipped. This prevents proper de-initialization of resources, which could lead to resource exhaustion or system instability, potentially resulting in a Denial ...

CVE-2026-90401

A flaw was found in the Linux kernel's Multiple Device MD RAID personalities, specifically raid1, raid10, and raid456. This vulnerability arises from incomplete support for the REQNOWAIT flag during write operations. When one mirror succeeds and another fails with an -EAGAIN error, the MD driver...

CVE-2026-90400

A flaw was found in the Linux kernel's Multiple Device MD driver. A race condition exists where the system may attempt to remove or replace RAID array devices while they are still actively being used for input/output operations. This can lead to a null pointer dereference, causing the system to...

CVE-2026-90399

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This vulnerability stems from incorrect memory handling within the macphycapsparse function. When processing certain data packets from firmware, specifically short Type-Length-Value TLV structures, the driver attempts to write more data...

CVE-2026-90398

A flaw was found in the Linux kernel ath11k Wi-Fi driver. This vulnerability occurs in the macphycapsparse function due to a mismatch between the allocated memory size and the size used for copying data. When processing certain firmware messages, the driver attempts to write information beyond th...

CVE-2026-90397

A flaw was found in the Linux kernel's Qualcomm qcom Secure Channel Manager SCM firmware component. This vulnerability allows for a NULL pointer dereference due to improper initialization of a shared memory pointer. An attacker could exploit this timing issue, potentially leading to a system cras...