CVE-2026-93044: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

CVE-2026-90096: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fuse: invalidate the correct range after OAPPEND direct write fusedirectwriteiter captures pos before genericwritechecks, which moves kipos to EOF for OAPPEND writes: fusedirectwriteiter pos = iocb-kipos; / 0 user-supplied /...

CVE-2026-90076: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fqinit computes quantum = 2 pschedmtu and initialquantum = 10 pschedmtu with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU...

CVE-2026-93054: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After deviceadd, the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, uioregisterdevice unwinds the device but leaves idev-info...

CVE-2026-92518: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIGCFICLANG is enabled, prog-bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an...

CVE-2026-90345: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary...

CVE-2026-92505: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix undefined behavior in devidwrite debugfs function When foreachpcisegment loop completes without finding a matching segment, the pciseg pointer is not NULL but points to an invalid memory location the list head...

CVE-2026-90305: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ARM: 9483/1: select HAVEPOSIXCPUTIMERSTASKWORK Commit c6e61c06d606 "ARM: 9463/1: Allow to enable RT" enabled PREEMPTRT on ARM but did not select HAVEPOSIXCPUTIMERSTASKWORK. This leaves CONFIGPOSIXCPUTIMERSTASKWORK disabled, so CP...

CVE-2026-90145: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: hinic3: Fix skb linearization mismatch and drop skb when skbchecksumhelp failed Previously, hinic3sendoneskb cached the skb fragment count before calling hinic3txoffload. If hinic3txcsum falls back to skbchecksumhelp for...

CVE-2026-90140: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...

CVE-2026-90141: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ipvsftpgetaddrport accumulates decimal digits into a u16 hport and into unsigned char p without checking for overflow. A crafted FTP PASV/EPSV response with an over-lo...

CVE-2026-90136: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Reject negative power cap writes in hwmon hsmphwmonwrite takes the user-supplied hwmon value as a signed long and assigns "val / MICROWATTPERMILLIWATT" to msg.args0, which is a u32. MICROWATTPERMILLIWATT is...

CVE-2026-90128: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr-head only on success. On the error path, the cleanup...

CVE-2026-90123: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: irqchip/ast2700-intc: Avoid allocating in the irqdomain activate callback The interrupt core calls the irqdomainactivate callback from setupirq with desc-lock held and interrupts disabled. Both aspeedintc1irqdomainactivate and...

CVE-2026-90121: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Clear per-CPU IRS data on teardown IRS affinity setup publishes an IRS pointer and IAFFID state in the per-CPU data before the remaining IRS initialization can fail. The error path then frees the IRS data without...

CVE-2026-90149: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session...

CVE-2026-90119: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup sndice1712probe performs multiple initialization steps after sndcardnew, but directly returns on failures from later steps without releasing the ALSA card,...

CVE-2026-90118: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-90116: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown sndmtpavoutputtimer rearms chip-timer while holding chip-spinlock and accesses the card-private mtpav state. sndmtpavfree currently takes the same lock and calls timerdelet...

CVE-2026-90114: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...