CVE-2026-92501

CVE-2026-92501 is a race condition in the Linux kernel's ext4 filesystem, affecting the direct I/O (DIO) to buffered write fallback path in ext4_dio_write_iter(). On no-extent inodes (e.g., ext3), DIO writes to holes cause a fallback to buffered I/O. An unprotected window exists between ext4_buff...

CVE-2026-90430

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241vintfinitlvcmdq stores the freshly allocated vcmdq pointer to the vintf-lvcmdqs array, before tegra241vcmdqallocsmmucmdq builds the vcmdq-cmdq. Th...

CVE-2026-90429

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the...

EUVD-2026-82051

In the Linux kernel, the following vulnerability has been resolved: md/bitmap: resume array on backlogstore error path backlogstore suspends the array before checking whether a write-mostly device exists. If no such device exists, the error path only unlocks reconfigmutex and leaves the array...

CVE-2026-90390 md/bitmap: resume array on backlog_store() error path

In the Linux kernel, the following vulnerability has been resolved: md/bitmap: resume array on backlogstore error path backlogstore suspends the array before checking whether a write-mostly device exists. If no such device exists, the error path only unlocks reconfigmutex and leaves the array...

CVE-2026-90315

CVE-2026-90315 affects the Linux kernel's PCI/sysfs subsystem. The legacy I/O and memory handlers (pci_write_legacy_io() , pci_mmap_legacy_mem() , pci_mmap_legacy_io() ) fail to check security_locked_down(LOCKDOWN_PCI_ACCESS) , leaving the legacy_io and legacy_mem sysfs files unprotected during k...

CVE-2026-90315 PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers Currently, the legacy I/O and memory sysfs handlers do not check securitylockeddownLOCKDOWNPCIACCESS, leaving the legacyio and legacymem files unprotected when the...

EUVD-2026-81868

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover raid1takeover sets conf-arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier sees it stuck at 1...

CVE-2026-90275 md/raid1: don't set array_frozen in raid1_takeover()

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover raid1takeover sets conf-arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier sees it stuck at 1...

CVE-2026-90275 md/raid1: don't set array_frozen in raid1_takeover()

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover raid1takeover sets conf-arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier sees it stuck at 1...

CVE-2026-90227

This is a local privilege escalation vulnerability in the Linux kernel's nvme/ioctl subsystem. The root cause is that NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed() , unlike the IO_CMD and IO64_CMD ioctl paths. As a result, unprivileged local callers can issue I/O on a partition device or wr...

CVE-2026-90227 nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

CVE-2026-79752

CakePHP , a rapid development framework for PHP, is affected by an SQL injection vulnerability in src/Database/FunctionsBuilder.php. The methods FunctionsBuilder::cast , ::extract , ::datePart , and ::dateAdd accept user-controlled dataType, part, or unit values and incorporate them into generate...

PT-2026-94809

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ext4 file system when handling Direct I/O DIO writes to holes on no-extent inodes. When a DIO write fails and falls back to buffered I/O, an unprotected...

PT-2026-94936

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Universal Disk Format UDF implementation where an I/O error during the writing of the Logical Volume Integrity Descriptor LVID buffer to a block device causes the...

PT-2026-94575

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme/ioctl component where the NVME IOCTL SUBMIT IO endpoint does not utilize the nvme cmd allowed function. This allows unprivileged users to perform I/O operatio...

CVE-2026-90227: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

CVE-2026-92501: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write fallback generic/746 started failing intermittently on ext3 no-extent inodes. The test triggers 'Page cache invalidation failure on direct I/O' warnings and subsequent fsync returns...

PT-2026-94717

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the mt76 wifi driver. The functions mt76 mmio write copy and mt76 mmio read copy iterate up to an aligned length of four bytes. When the length is...

PT-2026-94623

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the md/raid1 component where the raid1 takeover function incorrectly sets the array frozen variable to 1 on a newly allocated r1conf. Because this value is never...