CVE-2026-90094

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

SUSE CVE-2026-89803

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event before the fence context nouveauchanneldel tears the fence context down first and only drops the channel-kill subscription later, in the middle of the nvif object teardown: if...

CVE-2026-93151 nvmet-rdma: fix response resource leak on queue teardown

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...

CVE-2026-93096 cxl/features: Serialize multi-part Get/Set Feature transfers

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...

EUVD-2026-82204

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...

CVE-2026-90383 misc: sgi-gru: remove interrupt-context page-table walks

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

CVE-2026-90383

CVE-2026-90383 affects the Linux kernel's SGI GRU (General Register Unit) driver. The GRU TLB miss handler walks a process's page tables in interrupt context without holding page-table locks or a reference to the mapped page, and uses a kernel page-table accessor on user page tables, supporting o...

CVE-2026-90381 wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each...

CVE-2026-90381 wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each...

EUVD-2026-82042

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each...

CVE-2026-90381

CVE-2026-90381 affects the mt76 WiFi driver in the Linux kernel. The vulnerability resides in mt76_switch_vif_chanctx() : when channel switches occur on different radios within a short timeframe, channel contexts with different bands can be carried for each ieee80211_vif_chanctx_switch structure,...

CVE-2026-90338 serial: amba-pl011: keep console clock enabled for atomic writes

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: keep console clock enabled for atomic writes pl011consolewriteatomic runs from nbcon atomic context, where sleeping is not allowed. It calls clkenable, which takes the common-clk enablelock. Under PREEMPTRT th...

CVE-2026-90338

CVE-2026-90338 affects the Linux kernel AMBA PL011 serial console driver. The root cause is that pl011_console_write_atomic() calls clk_enable(), which acquires the common-clock enable_lock. Under PREEMPT_RT , this lock can sleep on contention, but atomic (nbcon) context forbids sleeping, trigger...

CVE-2026-90331 HID: asus: refactor the two workqueues and init sequence

In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid-asus driver: - unchecked size in asusrawevent - unclean teardown of asusprobe on failure - possible use-after-free in asuspro...

CVE-2026-90241 iommu/vt-d: Tear down scalable-mode context on probe failure

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intelpasidsetupsmcontext walks a PCI device’s DMA aliases via pciforeachdmaalias and programs a scalable-mode context entry for each RID. For a device with a...

CVE-2026-90240 iommu/vt-d: Flush context cache with correct SID when tearing down aliases

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

CVE-2026-90240

CVE-2026-90240 is a Linux kernel vulnerability in the Intel VT-d IOMMU driver. When tearing down DMA aliases, the functions domain_context_clear_one() and device_pasid_table_teardown() issued a context-cache invalidation using the device's own requester ID rather than the alias's bus/devfn . This...

CVE-2026-90240 iommu/vt-d: Flush context cache with correct SID when tearing down aliases

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

EUVD-2026-81833

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

EUVD-2026-81716

In the Linux kernel, the following vulnerability has been resolved: irqchip/ast2700-intc: Avoid allocating in the irqdomain activate callback The interrupt core calls the irqdomainactivate callback from setupirq with desc-lock held and interrupts disabled. Both aspeedintc1irqdomainactivate and...