tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...

CVE-2026-90338 serial: amba-pl011: keep console clock enabled for atomic writes

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: keep console clock enabled for atomic writes pl011consolewriteatomic runs from nbcon atomic context, where sleeping is not allowed. It calls clkenable, which takes the common-clk enablelock. Under PREEMPTRT th...

EUVD-2026-81840

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

CVE-2026-90247 bpf: Fix mmap_lock leak in irq_work path

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

CVE-2026-90193 mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

CVE-2026-90193

This CVE affects the qcom-cpucp mailbox driver in the Linux kernel under PREEMPT_RT configurations. The root cause is a lock re-entrancy deadlock : qcom_cpucp_mbox_irq_fn() invokes mbox_chan_received_data() while holding chan->lock. Under PREEMPT_RT, spin_lock_irqsave() is converted to an rt_s...

EUVD-2026-81786

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

CVE-2026-90190 null_blk: use DEFINE_MUTEX for the file-scope mutex

In the Linux kernel, the following vulnerability has been resolved: nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsystem to userspace. A racing mkdir into /sys/kernel/config/nullb/ can...

CVE-2026-90176 ksmbd: Do not skip lock checks for single-byte ranges

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

CVE-2026-90176

This vulnerability affects the Linux kernel's ksmbd (in-kernel SMB/CIFS server) component. The function check_lock_range() uses inclusive ranges , so start == end represents a valid single-byte range. However, a shortcut incorrectly treats this case as an empty range, skipping mandatory byte-rang...

EUVD-2026-81769

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

CVE-2026-90176 ksmbd: Do not skip lock checks for single-byte ranges

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

EUVD-2026-81752

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfg,setsockopt in cgroup UNIX getname hooks bpfsetsockopt and bpfgetsockopt call sockownedbyme for full sockets, so these helpers expect the socket lock to be held. BPFCGROUPUNIXGETPEERNAME and...

CVE-2026-90156 ksmbd: safely discard unregistered deferred locks

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

EUVD-2026-81736

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

CVE-2026-90143 net: kcm: Hold RCU read lock while running BPF parser

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

CVE-2026-90143 net: kcm: Hold RCU read lock while running BPF parser

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

CVE-2026-90143

CVE-2026-90143 affects the Linux kernel in the KCM (Kernel Connection Multiplexer) subsystem. The root cause is that kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu()—which prevents CPU migration—but fails to establish an RCU read-side critical section . As a result, BPF map operations i...

CVE-2026-90098 net: sparx5: fix sleep in atomic context in MAC table access

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...