CVE-2026-90244

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...

CVE-2026-90245

In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wra...

CVE-2026-90243

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copiedcontextteardown zeroes the 128-bit context entry with contextclearentry while the Present bit is still set, and only then issues the context-cache and...

CVE-2026-90242

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice enables IOPF for the new domain but never disables it for the old one. deviceblocktranslation, called at the start of the function, tears down...

CVE-2026-90241

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intelpasidsetupsmcontext walks a PCI device’s DMA aliases via pciforeachdmaalias and programs a scalable-mode context entry for each RID. For a device with a...

CVE-2026-90240

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

CVE-2026-90238

In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: fix self-deadlock in isp4sdpwronandinit error path isp4sdpwronandinit holds opsmutex via guardmutex and, on any init failure, jumps to errdeinit and calls isp4sdpwroffanddeinit. That helper takes the same...

CVE-2026-90239

In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: release partial allocations in isp4ifallocfwgpumem isp4ifallocfwgpumem allocates several GPU memory pools in sequence. If one of them fails, it jumps to errornomemory and returns -ENOMEM without releasing the...

CVE-2026-90237

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

CVE-2026-90235

In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE xprtsock replaces and restores sk-skdataready and sk-skwritespace on live sockets with plain stores, and xsudpdosetbuffersize invokes sk-skwritespace via ...

CVE-2026-90236

In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...

CVE-2026-90234

In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to record When an NFS server grants a delegation in an OPEN reply, nfsinodesetdelegation records it on the client. However, three of its error flows return without sending DELEGRETURN. A...

CVE-2026-90232

In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amtdeviceevent tries to unregister its upper AMT device, but it has two problems. 1. amtlookupupperdev looks up an upper device in the lower device's netn...

CVE-2026-90233

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pools are created lazily from nvmeinithctxcommon once the admin tag set is allocated, but they are only destroyed in nvmeremove via...

CVE-2026-90231

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...

CVE-2026-90230

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90229

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-90228

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...

CVE-2026-90226

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfcllcpgetsockopt casts optval to u32 user for putuser, so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing mintu32, len, sizeofu32 only...

CVE-2026-90227

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...