CVE-2026-90299

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols. It is because the verifier does not verify whether the symb...

DEBIAN-CVE-2026-90299

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols. It is because the verifier does not verify whether the symb...

AZL-102824 CVE-2026-90279 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5bitmapsectormap aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunksectors multiplied by the number of data...

CVE-2026-90098

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

SUSE CVE-2026-89755

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: clear stale mapping after freeing swapcache migratedevicepages reads the folio mapping before calling foliofreeswap. When foliofreeswap succeeds, the folio is removed from the swap cache, but the saved mapping...

SUSE CVE-2026-89841

In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...

SUSE CVE-2026-89950

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: linearize skbuff for packet generation batadvmcastforwpacket and batadvmcastforwscrape is not only called indirectly by the unsharing+linearizing batadvrecvmcastpacket handler. When it is called indirectly by...

CVE-2026-93185 ASoC: rt700-sdw: always drain jack work on remove

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt700-sdw: always drain jack work on remove rt700sdwremove drains jackdetectwork and jackbtncheckwork only when rt700-hwinit is true. That state bit is cleared by rt700updatestatus when the SoundWire slave becomes UNATTACHE...

CVE-2026-93183 drm/lima: call drm_mm_init() with a valid allocation range

In the Linux kernel, the following vulnerability has been resolved: drm/lima: call drmmminit with a valid allocation range limavmcreate is currently run before vastart and vaend are set up, meaning they are both 0. limavmcreate runs drmmminit with them as arguments for the allocator, and if...

CVE-2026-93183

CVE-2026-93183 affects the Linux kernel 's DRM Lima GPU driver (drivers/gpu/drm). The root cause is an ordering bug: lima_vm_create() is invoked before va_start and va_end are initialized, so both are zero when passed to drm_mm_init() . When DRM_DEBUG_MM is enabled, the DRM_MM_BUG_ON check fires,...

CVE-2026-93173

CVE-2026-93173 affects the Linux kernel BPF LSM subsystem. When a non-sleepable BPF program is freed via __bpf_prog_put_rcu() (a call_rcu() callback), it invokes security_bpf_prog_free(), which in turn calls bpf_prog_free in softirq context. If a sleepable LSM program is attached to the sleepable...

CVE-2026-93173 bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks

In the Linux kernel, the following vulnerability has been resolved: bpf,lsm: Drop bpfprogfree from sleepablelsmhooks bpfprogputrcu is the callrcu callback for non-sleepable programs. securitybpfprogfree called from there fires bpfprogfree in softirq; if a sleepable LSM prog is attached to that...

EUVD-2026-82281

In the Linux kernel, the following vulnerability has been resolved: bpf,lsm: Drop bpfprogfree from sleepablelsmhooks bpfprogputrcu is the callrcu callback for non-sleepable programs. securitybpfprogfree called from there fires bpfprogfree in softirq; if a sleepable LSM prog is attached to that...

CVE-2026-93044 bpf: Disallow interpreter fallback for arena-related insns

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

CVE-2026-93043 bpf: Disallow interpreter fallback for gotox insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for gotox insn The interpreter does not recognize the BPFJMP|BPFJA|BPFX insn, which is used for insnarray map. Thereafter, it would hit the BUGON in bpfprogrun at run time. 2.563726 BPF...

CVE-2026-90418 nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfscopydirtypages on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfscopydirtypages, which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved...

CVE-2026-90418 nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfscopydirtypages on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfscopydirtypages, which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved...

EUVD-2026-82079

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfscopydirtypages on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfscopydirtypages, which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved...

CVE-2026-90418

CVE-2026-90418 affects the Linux kernel's nilfs2 filesystem in the function nilfs_copy_dirty_pages() , which copies dirty DAT file folios/pages to a shadow page cache. The root cause is that the 'dirty' flag of a folio/page can be cleared asynchronously after the filesystem detects metadata corru...

EUVD-2026-81999

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: keep console clock enabled for atomic writes pl011consolewriteatomic runs from nbcon atomic context, where sleeping is not allowed. It calls clkenable, which takes the common-clk enablelock. Under PREEMPTRT th...