59418 matches found
CVE-2026-90345
This vulnerability affects the brcmfmac Wi-Fi driver in the Linux kernel . Certain P2P action frame code paths incorrectly assume that the P2P device virtual interface (vif) is always present. This assumption breaks when userspace sends non-P2P public action frames through the primary interface, ...
CVE-2026-90345 wifi: brcmfmac: fix P2P action frame handling without device vif
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary...
CVE-2026-90311
CVE-2026-90311 affects the Linux kernel thermal hwmon subsystem. When a thermal zone holding a hwmon class device is removed (e.g., via unbinding the ACPI thermal driver), the removal can get stuck because another thermal zone of the same type has sysfs attributes registered under that hwmon devi...
CVE-2026-90311 thermal: hwmon: Remove hwmon class device along with its parent
In the Linux kernel, the following vulnerability has been resolved: thermal: hwmon: Remove hwmon class device along with its parent The current code creates one hwmon device per thermal zone type and that device is registered under the first thermal zone of the given type. That turns out to be...
CVE-2026-90249 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...
CVE-2026-90249 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...
CVE-2026-90227 nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...
CVE-2026-90223 nfc: llcp: bound SNL TLV parsing to the skb and add length checks
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...
CVE-2026-90223
CVE-2026-90223 affects the Linux kernel NFC LLCP subsystem . The function nfc_llcp_recv_snl() walked the Service Name List (SNL) TLV list using an offset/length pair derived from skb->len without bounding reads to the actual buffer. This caused out-of-bounds reads when a short frame triggered ...
CVE-2026-90215
CVE-2026-90215 is a reference-count leak in the Linux kernel's MTD UBI (Unsorted Block Images) subsystem. The function ubi_detach_mtd_dev() obtains a device reference via ubi_get_device() before checking whether the UBI device is busy; on the busy return path it drops ubi->ref_count but leaves...
EUVD-2026-81808
In the Linux kernel, the following vulnerability has been resolved: mtd: ubi: Release device reference on busy detach ubidetachmtddev obtains a device reference through ubigetdevice before checking whether the UBI device is busy. The busy return path drops ubi-refcount but leaves the device...
CVE-2026-90215 mtd: ubi: Release device reference on busy detach
In the Linux kernel, the following vulnerability has been resolved: mtd: ubi: Release device reference on busy detach ubidetachmtddev obtains a device reference through ubigetdevice before checking whether the UBI device is busy. The busy return path drops ubi-refcount but leaves the device...
CVE-2026-90180 block: mtip32xx: synchronize ioctls with device removal
In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVEPENDING before entering mtiphwioctl. Removal can set that bit immediately afterwards and free dd-port in mtiphwexit while an ioctl still...
EUVD-2026-81773
In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVEPENDING before entering mtiphwioctl. Removal can set that bit immediately afterwards and free dd-port in mtiphwexit while an ioctl still...
CVE-2026-90150 pnfs/blocklayout: Fix device leaks on parse failure
In the Linux kernel, the following vulnerability has been resolved: pnfs/blocklayout: Fix device leaks on parse failure blparseconcat and blparsestripe allocate a child device array and then parse each child in turn. If parsing a child fails, the failed child is not counted in nrchildren and the...
EUVD-2026-81743
In the Linux kernel, the following vulnerability has been resolved: pnfs/blocklayout: Fix device leaks on parse failure blparseconcat and blparsestripe allocate a child device array and then parse each child in turn. If parsing a child fails, the failed child is not counted in nrchildren and the...
CVE-2026-90150 pnfs/blocklayout: Fix device leaks on parse failure
In the Linux kernel, the following vulnerability has been resolved: pnfs/blocklayout: Fix device leaks on parse failure blparseconcat and blparsestripe allocate a child device array and then parse each child in turn. If parsing a child fails, the failed child is not counted in nrchildren and the...
CVE-2026-90150
CVE-2026-90150 affects the Linux kernel in the pnfs/blocklayout NFS subsystem. The root cause is a device leak on parse failure : bl_parse_concat() and bl_parse_stripe() allocate a child device array, but if a child fails to parse it is not counted in nr_children, leaving a children array that bl...
kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()
A flaw was found in the Linux kernel's ioti USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the getmanufinfo function. This occurs because the driver does not properly validate the size of data read from the...
