CVE-2026-90383

CVE-2026-90383 affects the Linux kernel's SGI GRU (General Register Unit) driver. The GRU TLB miss handler walks a process's page tables in interrupt context without holding page-table locks or a reference to the mapped page, and uses a kernel page-table accessor on user page tables, supporting o...

EUVD-2026-81864

In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable se...

CVE-2026-90271

This vulnerability affects the Linux kernel's arm_mpam (Memory Partitioning and Monitoring) driver. The root cause is a NULL pointer dereference that occurs when a user unbinds an MSC (Memory System Component) after mpam_disable() has been called in response to an error interrupt, which sets the ...

CVE-2026-90124 irqchip/renesas-rzg2l: Fix loss of interrupt

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

EUVD-2026-81717

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

CVE-2026-90124

This vulnerability affects the Linux kernel 's irqchip/renesas-rzg2l driver. The functions rzg2l_clear_irq_int() and rzg2l_clear_tint_int() perform a racy read-modify-write on the ISCR/TSCR status registers, which are write-0-to-clear per bit. If another interrupt's status bit is set between the ...

CVE-2026-90124 irqchip/renesas-rzg2l: Fix loss of interrupt

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

PT-2026-94472

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the rzg2l clear irq int and rzg2l clear tint int functions. These functions perform a read-modify-write operation on the ISCR and TSCR status registers to clea...

CVE-2026-90124: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

CVE-2026-93091: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Quiesce notifications before teardown scminotificationexit clears and releases the notification instance, but transport callbacks can still deliver incoming notifications until the TX/RX channels are freed...

CVE-2026-90410: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: davinci: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestthreadedirq. During removal, spibitbangstop only unregisters th...

PT-2026-94664

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/omap dsi component where the interrupt service routine ISR table was being copied. This behavior allows for a Use-After-Free UAF condition—a scenario where a...

CVE-2026-90271: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable se...

PT-2026-94822

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/erdma component. The CEQ interrupt handler schedules eqc-tasklet, which executes the erdma ceq completion handler function to read the...

PT-2026-94469

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the irqchip/gic-v5 component where the Interrupt Routing System IRS affinity setup publishes an IRS pointer and IAFFID state in the per-CPU data before the remaining I...

CVE-2026-90433: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

CVE-2026-90208: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/samsungpwm: Switch to rawspinlockt type Samsung PWM timer might be used as a clock source on some legacy systems. When PREEMPTRT is enabled on ARM, regular spinlock is converted to a sleeping lock mutex-based,...

CVE-2026-90383: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

AZL-101457 CVE-2026-89863 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending obtains the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the firmwar...

CVE-2026-89863

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending obtains the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the firmwar...