EUVD-2026-82141

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

CVE-2026-92520 bpf: Zero queue and stack outputs on lock failure

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

CVE-2026-92520

CVE-2026-92520 affects the Linux kernel 's BPF subsystem, specifically the queue and stack pop/peek helpers . The verifier expects these helpers to initialize their output buffer, and the empty-map error path does clear it. However, a failed lock acquisition returns -EBUSY without writing the buf...

CVE-2026-92520 bpf: Zero queue and stack outputs on lock failure

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

CVE-2026-92504 thermal: intel: int3400: clean up ODVP on probe failures

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int3400: clean up ODVP on probe failures evaluateodvp creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. The current unwind path only calls cleanupodvp from the late sys...

CVE-2026-92504

CVE-2026-92504 is a resource-leak flaw in the Linux kernel 's Intel INT3400 thermal driver . The evaluate_odvp() function creates per-ODVP sysfs files before later probe resources are registered, but the unwind path only called cleanup_odvp() from the late sysfs failure path. Failures after evalu...

EUVD-2026-82085

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra241cmdqvinitstructures allocates VINTF0 with kzallocobj, inits it, and preallocates its logical VCMDQs. Two of its error paths leak. When tegra241cmdqvinitvintf...

CVE-2026-90424 iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra241cmdqvinitstructures allocates VINTF0 with kzallocobj, inits it, and preallocates its logical VCMDQs. Two of its error paths leak. When tegra241cmdqvinitvintf...

CVE-2026-90424 iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra241cmdqvinitstructures allocates VINTF0 with kzallocobj, inits it, and preallocates its logical VCMDQs. Two of its error paths leak. When tegra241cmdqvinitvintf...

CVE-2026-90424

This Linux kernel vulnerability affects the Tegra241 CMDQV IOMMU driver (iommu/tegra241-cmdqv). The root cause is a memory leak of the VINTF0 structure on two initialization-failure paths in tegra241_cmdqv_init_structures(). In the first path, a failure in tegra241_cmdqv_init_vintf() returns befo...

EUVD-2026-82073

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...

CVE-2026-90412 nvmet: fix return status of RMI log page on allocation failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...

CVE-2026-90412 nvmet: fix return status of RMI log page on allocation failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...

CVE-2026-90412

CVE-2026-90412 affects the Linux kernel nvmet (NVM Express target) subsystem. The function nvmet_execute_get_log_page_rmi() fails to update the status variable when kzalloc() for the log buffer fails, leaving it at NVME_SC_SUCCESS from an earlier nvmet_req_find_ns() call. As a result, the NVMe ho...

CVE-2026-90402

CVE-2026-90402 is a Linux kernel flaw in the MHI host controller driver (bus: mhi: host). The function mhi_register_controller() registers the controller device before attempting to create the optional trigger_edl sysfs file. When sysfs_create_file() fails, the error path only calls put_device() ...

CVE-2026-90388

CVE-2026-90388 is a Linux kernel vulnerability in the iommu/dma subsystem. The non-blocking, non-coherent DMA allocation path calls dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success. The affected code incorrectly relied on cpu_addr to detect allocation fai...

CVE-2026-90388 iommu/dma: Check atomic pool allocation result directly

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page and fills cpuaddr only on success. Do not rely on cpuaddr to detect...

EUVD-2026-82025

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Unregister cpufreq notifier on init failure acpiprocessordriverinit registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driverregister or...

CVE-2026-90364 ACPI: processor: Unregister cpufreq notifier on init failure

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Unregister cpufreq notifier on init failure acpiprocessordriverinit registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driverregister or...

CVE-2026-90364

CVE-2026-90364 affects the Linux kernel ACPI processor driver. In acpi_processor_driver_init(), the cpufreq policy notifier is registered before the ACPI processor driver and CPU hotplug state are set up. If driver_register() or cpuhp_setup_state() fails, the error path unregisters the ACPI proce...