AZL-102582 CVE-2026-90185 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

CVE-2026-90184

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

DEBIAN-CVE-2026-90184

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

AZL-102302 CVE-2026-90184 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

DEBIAN-CVE-2026-90185

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

EUVD-2026-82230

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

CVE-2026-93122 usb: gadget: uac: validate rate list length before storing

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

CVE-2026-93122

CVE-2026-93122 is an out-of-bounds write in the Linux kernel's USB gadget UAC drivers (f_uac1.c, f_uac2.c). The UAC1/UAC2 configfs rate-list attributes parse a comma-separated sampling-rate list into fixed-size arrays of UAC_MAX_RATES (10) entries without validating the token count, so an 11th en...

CVE-2026-93122 usb: gadget: uac: validate rate list length before storing

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

CVE-2026-93120 usb: gadget: configfs: fix out-of-bounds read of qw_sign

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

EUVD-2026-82228

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

CVE-2026-93120

CVE-2026-93120 affects the Linux kernel 's USB gadget configfs subsystem. The function os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN (a byte count of 14) as the input length to utf16s_to_utf8s(), which expects a count of UTF-16 code units. Since the qw_sign[] array holds only 7 code units (...

CVE-2026-93120 usb: gadget: configfs: fix out-of-bounds read of qw_sign

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

CVE-2026-93056

This vulnerability affects the Linux kernel 's USB gadget f_uac1_legacy driver. The UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for the fn_play, fn_cap, and fn_cntl string options, but its store function contains an inverted null check on the kstrndup() return value. As a result...

CVE-2026-93056 usb: gadget: f_uac1_legacy: remove broken string configfs attributes

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

EUVD-2026-82166

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

CVE-2026-93056 usb: gadget: f_uac1_legacy: remove broken string configfs attributes

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

EUVD-2026-81799

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix maxqid race between configfs and controller allocation The function nvmetsubsysattrqidmaxstore can race against nvmetallocctrl when a subsystem's maxqid limit is modified. Suppose maxqid is currently 64. If...

CVE-2026-90206

CVE-2026-90206 is a race condition in the Linux kernel's nvmet (NVM Express Target) subsystem. The function nvmet_alloc_ctrl() allocates queue memory based on the subsystem's current max_qid , but a concurrent write via configfs can increase max_qid before the new controller is added to the subsy...

CVE-2026-90206 nvmet: fix max_qid race between configfs and controller allocation

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix maxqid race between configfs and controller allocation The function nvmetsubsysattrqidmaxstore can race against nvmetallocctrl when a subsystem's maxqid limit is modified. Suppose maxqid is currently 64. If...