EUVD-2026-81712

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup sndice1712probe performs multiple initialization steps after sndcardnew, but directly returns on failures from later steps without releasing the ALSA card,...

CVE-2026-90118 ntfs: fix off-by-one page overflow in ntfs_decompress()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-90119 ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup sndice1712probe performs multiple initialization steps after sndcardnew, but directly returns on failures from later steps without releasing the ALSA card,...

CVE-2026-90118 ntfs: fix off-by-one page overflow in ntfs_decompress()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-90119 ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup sndice1712probe performs multiple initialization steps after sndcardnew, but directly returns on failures from later steps without releasing the ALSA card,...

CVE-2026-90119

CVE-2026-90119 affects the Linux kernel 's ALSA ice1712 driver. In snd_ice1712_probe(), multiple initialization steps run after snd_card_new(); if any later step fails, the function returns without releasing the ALSA card, causing a resource leak . The fix replaces snd_card_new() with snd_devm_ca...

CVE-2026-90118

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

EUVD-2026-81710

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate usaofs before preserving the update sequence number When ntfsmftrecordalloc reuses a free mft record it reads the old update sequence number straight from the on-disk record: usn = le16 u8 m + le16tocpum-usaofs; He...

CVE-2026-90116 ALSA: mtpav: shut down output timer before card teardown

In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown sndmtpavoutputtimer rearms chip-timer while holding chip-spinlock and accesses the card-private mtpav state. sndmtpavfree currently takes the same lock and calls timerdelet...

EUVD-2026-81709

In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown sndmtpavoutputtimer rearms chip-timer while holding chip-spinlock and accesses the card-private mtpav state. sndmtpavfree currently takes the same lock and calls timerdelet...

CVE-2026-90116

In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown sndmtpavoutputtimer rearms chip-timer while holding chip-spinlock and accesses the card-private mtpav state. sndmtpavfree currently takes the same lock and calls timerdelet...

CVE-2026-90117

CVE-2026-90117 affects the Linux kernel's NTFS filesystem driver . In ntfs_mft_record_alloc(), when reusing a free MFT record, the usa_ofs field is read directly from a raw $MFT page-cache folio without validation. Because MST fixup and record checking operate on private copies, usa_ofs remains a...

CVE-2026-90116 ALSA: mtpav: shut down output timer before card teardown

In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown sndmtpavoutputtimer rearms chip-timer while holding chip-spinlock and accesses the card-private mtpav state. sndmtpavfree currently takes the same lock and calls timerdelet...

CVE-2026-90117 ntfs: validate usa_ofs before preserving the update sequence number

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate usaofs before preserving the update sequence number When ntfsmftrecordalloc reuses a free mft record it reads the old update sequence number straight from the on-disk record: usn = le16 u8 m + le16tocpum-usaofs; He...

CVE-2026-90117

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate usaofs before preserving the update sequence number When ntfsmftrecordalloc reuses a free mft record it reads the old update sequence number straight from the on-disk record: usn = le16 u8 m + le16tocpum-usaofs; He...

CVE-2026-90115

CVE-2026-90115 affects the Linux kernel XDP subsystem (net/xdp/xsk.c). In the __xsk_rcv() multi-buffer path, xsk_buff_alloc() is called in a loop without checking its return value. Since xsk_buff_can_alloc() only counts fill queue entries without validating their addresses, it can succeed while x...

EUVD-2026-81708

In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in xskrcv In the xskrcv multi-buffer path, xskbuffalloc is called in a loop without checking its return value. xskbuffcanalloc only counts fill queue entries without validating their addresses, s...

CVE-2026-90115 xsk: fix NULL pointer dereference in __xsk_rcv()

In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in xskrcv In the xskrcv multi-buffer path, xskbuffalloc is called in a loop without checking its return value. xskbuffcanalloc only counts fill queue entries without validating their addresses, s...

CVE-2026-90115

In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in xskrcv In the xskrcv multi-buffer path, xskbuffalloc is called in a loop without checking its return value. xskbuffcanalloc only counts fill queue entries without validating their addresses, s...

CVE-2026-90113 netdevsim: update queue NAPI association on queue reset

In the Linux kernel, the following vulnerability has been resolved: netdevsim: update queue NAPI association on queue reset In netdevsim, receive queues struct nsimrq embed their own struct napistruct. When queue reset is performed e.g. via queuereset debugfs, nsimqueuestart swaps in a newly...