CVE-2026-90195 riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

CVE-2026-90195

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

EUVD-2026-81788

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

EUVD-2026-81787

In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on deviceadd failures When deviceadd fails after acpidevicesetname has allocated an instance ID and a new acpidevicebusid has been linked into acpibusidlist, the rollback path only removes wakeuplis...

CVE-2026-90194

CVE-2026-90194 affects the Linux kernel ACPI subsystem , specifically the device scan path. When device_add() fails after acpi_device_set_name() has allocated an instance ID and linked a new acpi_device_bus_id into acpi_bus_id_list, the original rollback path only removed the wakeup list entry an...

CVE-2026-90195 riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

CVE-2026-90194 ACPI: scan: fix bus ID cleanup on device_add() failures

In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on deviceadd failures When deviceadd fails after acpidevicesetname has allocated an instance ID and a new acpidevicebusid has been linked into acpibusidlist, the rollback path only removes wakeuplis...

CVE-2026-90193 mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

CVE-2026-90193

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

CVE-2026-90193

This CVE affects the qcom-cpucp mailbox driver in the Linux kernel under PREEMPT_RT configurations. The root cause is a lock re-entrancy deadlock : qcom_cpucp_mbox_irq_fn() invokes mbox_chan_received_data() while holding chan->lock. Under PREEMPT_RT, spin_lock_irqsave() is converted to an rt_s...

EUVD-2026-81785

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90192 mailbox: qcom-cpucp: handle NULL data in send_data callback

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90191 mailbox: riscv-sbi-mpxy: validate RPMI notification lengths

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

EUVD-2026-81784

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90192 mailbox: qcom-cpucp: handle NULL data in send_data callback

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90191

CVE-2026-90191 affects the Linux kernel mailbox driver for RISC-V SBI Mpxy (RPMI notification handling). The SBI return value, which determines how many bytes are copied from shared memory into the RPMI notification buffer, is not validated against the negotiated shared-memory size before the cop...

CVE-2026-90191

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90191 mailbox: riscv-sbi-mpxy: validate RPMI notification lengths

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90192

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

EUVD-2026-81783

In the Linux kernel, the following vulnerability has been resolved: nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsystem to userspace. A racing mkdir into /sys/kernel/config/nullb/ can...