CVE-2026-90166 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90166

CVE-2026-90166 affects the Linux kernel's SMB server (ksmbd) . The vulnerability is a null pointer dereference in ksmbd_ipc_tree_connect_request(), triggered when kstrdup() in ksmbd_share_config_get() fails and returns NULL for share->name, which is then passed to strlen() without a null check...

EUVD-2026-81737

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dplldeviceops during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpllpinonpinregister, the dpll object stays alive with an empty...

CVE-2026-90144 dpll: fix NULL deref in dpll_device_ops() during teardown race

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dplldeviceops during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpllpinonpinregister, the dpll object stays alive with an empty...

CVE-2026-90144

CVE-2026-90144 is a NULL pointer dereference in the Linux kernel's DPLL subsystem (drivers/dpll/dpll_core.c). The race occurs when the last owner of a DPLL device unregisters while a foreign driver (e.g., ice ) still holds a pin via dpll_pin_on_pin_register(). A pin notification queued before the...

CVE-2026-90144 dpll: fix NULL deref in dpll_device_ops() during teardown race

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dplldeviceops during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpllpinonpinregister, the dpll object stays alive with an empty...

CVE-2026-90102 NFSv4/pnfs: key the data server cache on the NFS version

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

CVE-2026-90102 NFSv4/pnfs: key the data server cache on the NFS version

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

EUVD-2026-81952

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

CVE-2026-90091 Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

CVE-2026-90085

CVE-2026-90085 affects the octeontx2-af driver in the Linux kernel . The function rvu_dbg_nix_tm_tree_display() dereferences pfvf->sq_ctx without verifying that the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tm_tree for a NIX logical function whose transmit queues a...

CVE-2026-90085 octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix NULL deref in NIX TM tree debugfs read path rvudbgnixtmtreedisplay dereferences pfvf-sqctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tmtree for a NIX LF...

EUVD-2026-81946

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix NULL deref in NIX TM tree debugfs read path rvudbgnixtmtreedisplay dereferences pfvf-sqctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tmtree for a NIX LF...

CVE-2026-90085 octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix NULL deref in NIX TM tree debugfs read path rvudbgnixtmtreedisplay dereferences pfvf-sqctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tmtree for a NIX LF...

CVE-2026-90080 octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix NULL deref of afxdpzcqidx on rep setup afxdpzcqidx tracks receive queues using AFXDP zero-copy and is allocated during PF/VF probe. Representors and other non-AFXDP paths leave the pointer NULL, but several call...

EUVD-2026-81941

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix NULL deref of afxdpzcqidx on rep setup afxdpzcqidx tracks receive queues using AFXDP zero-copy and is allocated during PF/VF probe. Representors and other non-AFXDP paths leave the pointer NULL, but several call...

CVE-2026-90166: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90280: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...

Linux Distros Unpatched Vulnerability : CVE-2026-89774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close...

CVE-2026-90186: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...