CVE-2026-90191

A flaw was found in the Linux kernel's mailbox: riscv-sbi-mpxy component. This vulnerability arises from insufficient validation of the SBI System Binary Interface return value, which dictates the number of bytes copied from shared memory into the RPMI RISC-V Platform Management Interface...

CVE-2026-90189

A flaw was found in the Linux kernel's nullblk component. A race condition can occur when the configfs subsystem is registered before default devices are created. This allows a local attacker, by performing a specific sequence of operations, to trigger a Use-After-Free UAF vulnerability. This cou...

CVE-2026-90185

A flaw was found in the Linux kernel's nullblk module. This vulnerability occurs because concurrent operations on configfs attributes are not properly synchronized. A local user could exploit this timing issue to modify data during device setup, leading to an out-of-bounds memory access. This cou...

CVE-2026-90181

A flaw was found in the Linux kernel's ublk universal block driver. A local attacker could trigger an xarray allocation failure during the teardown of a shared memory zero-copy SHMEMZC buffer. This issue causes the teardown process to enter an infinite retry loop, preventing forward progress and...

CVE-2026-90180

A flaw was found in the Linux kernel's mtip32xx block device driver. A local user with access to an already open block device could exploit a synchronization issue between ioctl handlers and device removal. This could lead to a use-after-free vulnerability, where the system attempts to access...

CVE-2026-90179

A flaw was found in the Linux kernel's AppArmor security module. When AppArmor is configured in complain mode and a local user attempts to use the changehat function for a non-existent security profile, a deadlock can occur. This happens because both the changehat function and the process of...

CVE-2026-90177

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This vulnerability arises because the atomic Read-Modify-Write RMW verification process does not consistently check pointer types across all execution paths. Specifically, it only records the instruction pointer type when...

CVE-2026-90174

A flaw was found in ksmbd in the Linux kernel. A remote attacker can send a specially crafted login response with an oversized hash size during the authentication process. This can lead to a slab-out-of-bounds read in the ksmbdallocuser function, potentially resulting in information disclosure or...

CVE-2026-90173

A flaw was found in the Linux kernel's SMB Direct smbdirect component. This vulnerability occurs because the system attempts to access memory that has already been freed when handling network communication. A remote attacker could exploit this timing issue, potentially leading to system instabili...

CVE-2026-90172

A flaw was found in the Linux kernel's smbdirect module, which handles high-performance data transfer using Remote Direct Memory Access RDMA. During an RDMA connection attempt, if the connection acceptance fails, the system incorrectly deallocates memory resources before all related operations ar...

CVE-2026-90170

A flaw was found in ksmbd, a component of the Linux kernel. This vulnerability occurs because the ipcvalidatemsg function reads length fields from an Inter-Process Communication IPC response buffer before verifying if the buffer is large enough. A local attacker, by providing a specially crafted...

CVE-2026-90171

A flaw was found in the SMB Direct smbdirect component of the Linux kernel. This vulnerability arises from an improper handling of child sockets during the shutdown process, where memory is released prematurely while still in use. A remote attacker could potentially exploit this timing issue to...

CVE-2026-90166

A flaw was found in the ksmbd Server Message Block server component of the Linux kernel. A remote attacker could exploit a null-pointer dereference vulnerability within the ksmbdipctreeconnectrequest function. This issue arises when the system attempts to access a memory location that has not bee...

CVE-2026-90164

A flaw was found in the Linux kernel's ksmbd server component. During the server's initialization process, an error in setting up internal process entries or counters is not handled correctly. This oversight can result in the system attempting to access a null pointer, which may lead to a system...

CVE-2026-90163

A flaw was found in the Linux kernel's ksmbd SMB server component. When the ksmbd module fails to initialize, certain resources, such as the proc tree and per-CPU counters, are not properly deallocated. This resource leak can be exploited by a local user, potentially leading to a Denial of Servic...

CVE-2026-90162

A flaw was found in ksmbd, a kernel module for SMB3 protocol support in the Linux kernel. A race condition exists in the smb2lock function, where a lock object can be freed while still being referenced, known as a Use-After-Free, and then freed again, known as a Double-Free. This occurs when...

CVE-2026-90161

A flaw was found in the Linux kernel's erofs filesystem. A local attacker could craft a malicious erofs image containing invalid interlaced ztailpacking pclusters. When this image is processed, it could lead to an out-of-bounds read from kernel memory. This vulnerability may allow an attacker to...

CVE-2026-90159

A flaw was found in the Linux kernel. Specifically, a concurrency vulnerability exists within the Berkeley Packet Filter BPF subsystem when handling cgroup UNIX getname hooks. This issue arises because certain BPF functions, bpfsetsockopt and bpfgetsockopt, are called without first acquiring a...

CVE-2026-90158

A flaw was found in the Linux kernel's m68k nfcon module. A deadlock can occur when the showconsactive function calls the .device method while holding the consolelistlock, and the consoleisregistered function attempts to acquire the same lock. This contention for the lock can lead to a system...

CVE-2026-90157

A flaw was found in the Linux kernel. A local attacker could exploit a vulnerability in the BPF Berkeley Packet Filter cgroup getsockopt hook. By providing a negative length value, a malicious BPF program could cause the kernel's memory copy function to process an invalid size. This could lead to...