The vulnerabilities in the net/bluetooth/eir.c and net/bluetooth/mgmt.c modules of Linux kernel allow a hacker to cause a service failure.

The vulnerability in the net/bluetooth/eir.c and net/bluetooth/mgmt.c modules of Linux kernel systems relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

CVE-2026-90049

CVE-2026-90049 affects the Linux kernel in the skb_zerocopy() function (net/skbuff). When skb_orphan_frags() fails, the helper calls skb_tx_error() on the source skb it does not own, prematurely completing the zerocopy uarg and clearing the SKBFL_SHARED_FRAG page-ownership flag. On Open vSwitch's...

CVE-2026-90046

CVE-2026-90046 affects the Linux kernel's mm/page_alloc subsystem. The root cause is an unsafe use of spin_trylock() in an NMI context on uniprocessor (UP) builds, specifically on the free path of free_pages_nolock() . A prior commit fixed the alloc side but missed this free-side case. If BPF pro...

CVE-2026-90047

CVE-2026-90047 affects the Linux kernel DRM/XE driver (Intel GPU). The function get_flat_ccs_offset() computes the boundary of flat CCS (compression) storage and rounds it up to 128 KiB instead of rounding down to the allocator's page size. This publishes a small region of CCS-owned memory into t...

CVE-2026-90045

CVE-2026-90045 affects the Linux kernel USB gadget ffs (FunctionFS) subsystem. The root cause is that io_data stores a pointer to the submitting task's mm_struct without holding a reference while asynchronous requests remain pending. If the task exits before completion handling finishes, this res...

CVE-2026-90044

CVE-2026-90044 is a Use-After-Free vulnerability in the Linux kernel USB gadget FunctionFS (f_fs) subsystem. In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed while the kiocb cancel function rema...

CVE-2026-90042

CVE-2026-90042 affects the Ceph filesystem client in the Linux kernel. The fscrypt subsystem's scatterlist crypto API requires buffers to reside in the linear mapping region, but the Ceph messenger client uses kvmalloc() , which can return vmalloc()-allocated buffers under memory fragmentation. C...

CVE-2026-90039

This Linux kernel vulnerability affects the NFSD subsystem. Writing to /proc/fs/nfsd/unlock_filesystem or sending the NFSD_CMD_UNLOCK_FILESYSTEM/NFSD_CMD_UNLOCK_EXPORT netlink commands walks NFSv4 client hash tables, but the existing guard (nn->nfsd_serv) is set before nn->conf_id_hashtbl i...

CVE-2026-90037

CVE-2026-90037 is a use-after-free in the Linux kernel NFSD (NFS Server Daemon) subsystem. An nfs4_openowner retained on nn->close_lru after its final CLOSE holds only a raw pointer to its nfs4_client. When the laundromat reaps timed-out entries and calls nfs4_put_stid(), a concurrent force_ex...

CVE-2026-90035

CVE-2026-90035 affects the Linux kernel AMD display driver (drm/amd/display ). The root cause is a division by zero in the get_estimated_bw() function, which divides by link->dpia_bw_alloc_config.bw_granularity—a value zeroed by reset_bw_alloc_struct() and only populated after DP_TUNNELING_BW_...

CVE-2026-90036

CVE-2026-90036 is a use-after-free in the Linux kernel's NFSD subsystem, occurring during blocked-lock reaping. A bare lock owner holds only a raw pointer to its nfs4_client without a reference keeping the client alive. When the per-net laundromat reaps such a lock, a concurrent force_expire_clie...

CVE-2026-90034

CVE-2026-90034 affects the Linux kernel's usb_mdc800 driver (USB Image MDC800). The root cause is the use of kmalloc() instead of kzalloc() for the irq_urb_buffer and download_urb_buffer allocations in usb_mdc800_init(). Because the memory is not zero-initialized, a shorter-than-expected message ...

CVE-2026-90032

CVE-2026-90032 is a use-after-free in the Linux kernel's usbtv media driver. The root cause is a lifecycle mismatch: an open ALSA PCM file can outlive a USB disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path can then drop the V4L2 device reference and free...

CVE-2026-90033

CVE-2026-90033 is an out-of-bounds write in the Linux kernel 's ALSA usb-audio subsystem, specifically in the snd_usbmidi_us122l_output() function. The root cause is that the function uses a fixed transfer count of 2 on speeds below high-speed without checking ep->max_transfer. When a device (...

CVE-2026-90029

CVE-2026-90029 is a use-after-free vulnerability in the Linux kernel 's USB storage realtek_cr driver, triggered on device disconnect . The root cause is that realtek_cr_destructor() calls timer_delete() before the chip containing the timer is freed, allowing the timer callback to rearm itself ag...

CVE-2026-90030

CVE-2026-90030 affects the Linux kernel DWC3 USB driver . The forceRM bit of the DEPCMD register controls how the EndTransfer command stops an active transfer. On DWC_usb31 v2.00a and v2.10a controllers , setting forceRM=1 caused a transfer aborted via the ep_dequeue path to remain active after E...

CVE-2026-90028

CVE-2026-90028 affects the Linux kernel USB Type-C driver for the hd3ss3220 controller. The root cause is that regulator_is_enabled() reports the aggregate regulator state rather than whether this particular consumer holds an enable reference. When another consumer enables VBUS first, the driver ...

CVE-2026-90027

CVE-2026-90027 affects the Qualcomm PMIC Type-C controller driver (usb: typec: qcom-pmic-typec) in the Linux kernel. The root cause is a use-after-free on pmic_typec_port: port_stop() returns before tcpm_unregister_port() destroys the TCPM worker thread. Flushing that worker during unregister can...

CVE-2026-90026

CVE-2026-90026 is a use-after-free vulnerability in the Linux kernel 's qcom-pmic USB Type-C PHY driver. The root cause is a race condition: pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ handler schedules the work just before disable_irq(), the work executes after remove() ...

CVE-2026-90025

CVE-2026-90025 is an out-of-bounds array index in the Linux kernel's UCSI DisplayPort driver . The driver uses the GET_CURRENT_CAM response from the PPM to index into a port altmode array of size UCSI_MAX_ALTMODES. While the code checks that the value is not 0xff, it does not verify it is below U...