CVE-2026-90140

This Linux kernel vulnerability affects the cuse (Character device in Userspace) module. Since commit 053fc4f755ad, fuse_conn_put() releases the fuse_conn via call_rcu() rather than synchronously. Because fc->release points to cuse_fc_release() in the cuse module, removing the module (rmmod cu...

CVE-2026-90130

CVE-2026-90130 is a Linux kernel vulnerability in the vdpa_sim module. When kthread_run_worker() fails during device creation, vdpasim_create() leaves vdpasim->worker as an ERR_PTR . The subsequent error path releases the partially initialized simulator, and vdpasim_free() unconditionally pass...

CVE-2026-90130 vdpa_sim: fix cleanup after worker creation failure

In the Linux kernel, the following vulnerability has been resolved: vdpasim: fix cleanup after worker creation failure vdpasimcreate leaves vdpasim-worker as an ERRPTR when kthreadrunworker fails. The error path then drops the device reference, which releases the partially initialized simulator...

EUVD-2026-81723

In the Linux kernel, the following vulnerability has been resolved: vdpasim: fix cleanup after worker creation failure vdpasimcreate leaves vdpasim-worker as an ERRPTR when kthreadrunworker fails. The error path then drops the device reference, which releases the partially initialized simulator...

CVE-2026-90130 vdpa_sim: fix cleanup after worker creation failure

In the Linux kernel, the following vulnerability has been resolved: vdpasim: fix cleanup after worker creation failure vdpasimcreate leaves vdpasim-worker as an ERRPTR when kthreadrunworker fails. The error path then drops the device reference, which releases the partially initialized simulator...

EUVD-2026-81708

In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in xskrcv In the xskrcv multi-buffer path, xskbuffalloc is called in a loop without checking its return value. xskbuffcanalloc only counts fill queue entries without validating their addresses, s...

CVE-2026-90115 xsk: fix NULL pointer dereference in __xsk_rcv()

In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in xskrcv In the xskrcv multi-buffer path, xskbuffalloc is called in a loop without checking its return value. xskbuffcanalloc only counts fill queue entries without validating their addresses, s...

CVE-2026-90082 net: mana: Cap MSI-X vectors to the device MSI-X table size

In the Linux kernel, the following vulnerability has been resolved: net: mana: Cap MSI-X vectors to the device MSI-X table size managdquerymaxresources sizes gc-nummsixusable from resp.maxmsix and the CPU count, but never from the device MSI-X table. On a 1792 vCPU M-series VM that yields 1793...

CVE-2026-90082 net: mana: Cap MSI-X vectors to the device MSI-X table size

In the Linux kernel, the following vulnerability has been resolved: net: mana: Cap MSI-X vectors to the device MSI-X table size managdquerymaxresources sizes gc-nummsixusable from resp.maxmsix and the CPU count, but never from the device MSI-X table. On a 1792 vCPU M-series VM that yields 1793...

CVE-2026-90082

This CVE affects the Linux kernel mana network driver (Microsoft Azure Network Adapter). The root cause is an out-of-bounds access during MSI-X vector setup: mana_gd_query_max_resources() sizes the usable vector count from the reported maximum and CPU count but never caps it to the actual device ...

EUVD-2026-81943

In the Linux kernel, the following vulnerability has been resolved: net: mana: Cap MSI-X vectors to the device MSI-X table size managdquerymaxresources sizes gc-nummsixusable from resp.maxmsix and the CPU count, but never from the device MSI-X table. On a 1792 vCPU M-series VM that yields 1793...

CVE-2026-90064 drm/xe: Reject page faults from non-fault-mode scratch VMs

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Reject page faults from non-fault-mode scratch VMs Having scratch enabled does not make a VM capable of handling recoverable page faults. Allowing scratch VMs through the ASID lookup also admits dma-fence mode VMs. If suc...

PT-2026-94412

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/xe component where the system fails to reject page faults from non-fault-mode scratch VMs. Allowing scratch VMs through the ASID Address Space Identifier looku...

PT-2026-94479

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A data race exists in the NTFS driver when handling resident iomap reads. The function ntfs read iomap begin resident traverses the Master File Table MFT record via ntfs attr lookup and...

PT-2026-94690

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the BPF subsystem when the arena vm fault function fails to acquire the arena-spinlock. The function returns VM FAULT RETRY, which triggers the do user addr fault pa...

PT-2026-94430

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mana network driver where the mana gd query max resources function calculates the gc-num msix usable value based on the CPU count and resp.max msix, but fails to...

PT-2026-94521

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the smbdirect component of the Linux kernel. The function smbdirect connection destroy qp uses ib destroy cq to tear down completion queues CQs...

CVE-2026-93135: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

CVE-2026-90348: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to it are not permitted...

CVE-2026-90269: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...