EUVD-2026-82160

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-93050 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-93050 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-93050

CVE-2026-93050 affects the Linux kernel in the ipack/ipoctal driver. Three distinct memory-safety issues occur when an iPack device is removed while a tty session is still active: (1) a use-after-free of struct ipoctal because the remove callback frees it via kfree() while tty operations may stil...

EUVD-2026-82090

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the...

CVE-2026-90429 iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the...

CVE-2026-90429 iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the...

CVE-2026-90294 IB/isert: delay the final Login Response until the session is registered

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

CVE-2026-90282

CVE-2026-90282 affects the QCOM QMP USB legacy PHY driver in the Linux kernel. The root cause is a NULL pointer dereference of qmp->phy when the runtime suspend callback executes in a narrow window between pm_runtime_enable() and pm_runtime_forbid(), before the PHY pointer is initialized. The ...

CVE-2026-90282 phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because...

EUVD-2026-81875

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because...

CVE-2026-90282 phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because...

CVE-2026-90280 phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...

CVE-2026-90281 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phycreate only enables runtime PM on the PHY device if it is already enabled on this parent...

CVE-2026-90281 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phycreate only enables runtime PM on the PHY device if it is already enabled on this parent...

EUVD-2026-81873

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...

CVE-2026-90250

CVE-2026-90250 is a null pointer dereference vulnerability in the Linux kernel's BPF/cgroup subsystem . The issue occurs when a BPF program using BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE replaces an empty prog via link_update. The root cause is that __cgroup_bpf_replace fails to allocate and assign the...

CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

EUVD-2026-81843

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...