CVE-2026-90177 bpf: Check pointer type for all atomic RMW paths

In the Linux kernel, the following vulnerability has been resolved: bpf: Check pointer type for all atomic RMW paths Atomic RMW verification records an instruction pointer type only when the current destination is PTRTOARENA. A second path can therefore reach the same instruction with an ordinary...

CVE-2026-90178 hwmon: (coretemp) Fix core_data leak on CPUs without PTS

In the Linux kernel, the following vulnerability has been resolved: hwmon: coretemp Fix coredata leak on CPUs without PTS pdata-coredata is allocated in inittempdata when the first core tempdata of a package is created, but it is only released from destroytempdata, and only in the branch that...

EUVD-2026-81769

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

CVE-2026-90176

This vulnerability affects the Linux kernel's ksmbd (in-kernel SMB/CIFS server) component. The function check_lock_range() uses inclusive ranges , so start == end represents a valid single-byte range. However, a shortcut incorrectly treats this case as an empty range, skipping mandatory byte-rang...

CVE-2026-90176 ksmbd: Do not skip lock checks for single-byte ranges

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

CVE-2026-90176

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

EUVD-2026-81768

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of ksmbdipcloginrequestext returned buffer Free it unconditionally after ksmbdallocuser calls. kmemleak splat: unreferenced object 0xffff888103b83540 size 192: comm "pool-0", pid 16970, jiffies 4377290937 he...

CVE-2026-90174

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbdallocuser ksmbdallocuser copies resp-hashsz bytes out of the mountd IPC login response with user-passkeysz = resp-hashsz; user-passkey = kmallocresp-hashsz, KSMBDDEFAULTGFP; if...

CVE-2026-90174

CVE-2026-90174 affects the ksmbd (in-kernel SMB server) component of the Linux kernel . The flaw is a slab-out-of-bounds read in ksmbd_alloc_user(): the field resp->hash_sz is an unvalidated __u16 (up to 65535), while the on-stack resp->hash[] buffer is only KSMBD_REQ_MAX_HASH_SZ bytes. Bec...

CVE-2026-90175 smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of ksmbdipcloginrequestext returned buffer Free it unconditionally after ksmbdallocuser calls. kmemleak splat: unreferenced object 0xffff888103b83540 size 192: comm "pool-0", pid 16970, jiffies 4377290937 he...

EUVD-2026-81767

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbdallocuser ksmbdallocuser copies resp-hashsz bytes out of the mountd IPC login response with user-passkeysz = resp-hashsz; user-passkey = kmallocresp-hashsz, KSMBDDEFAULTGFP; if...

CVE-2026-90175 smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of ksmbdipcloginrequestext returned buffer Free it unconditionally after ksmbdallocuser calls. kmemleak splat: unreferenced object 0xffff888103b83540 size 192: comm "pool-0", pid 16970, jiffies 4377290937 he...

CVE-2026-90174 ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbdallocuser ksmbdallocuser copies resp-hashsz bytes out of the mountd IPC login response with user-passkeysz = resp-hashsz; user-passkey = kmallocresp-hashsz, KSMBDDEFAULTGFP; if...

CVE-2026-90175

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of ksmbdipcloginrequestext returned buffer Free it unconditionally after ksmbdallocuser calls. kmemleak splat: unreferenced object 0xffff888103b83540 size 192: comm "pool-0", pid 16970, jiffies 4377290937 he...

CVE-2026-90174 ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbdallocuser ksmbdallocuser copies resp-hashsz bytes out of the mountd IPC login response with user-passkeysz = resp-hashsz; user-passkey = kmallocresp-hashsz, KSMBDDEFAULTGFP; if...

CVE-2026-90173

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: free completion queues with ibfreecq smbdirectconnectiondestroyqp creates the send and receive completion queues with iballoccqany, which for IBPOLLWORKQUEUE arms an internal completion handler that runs...

EUVD-2026-81766

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: free completion queues with ibfreecq smbdirectconnectiondestroyqp creates the send and receive completion queues with iballoccqany, which for IBPOLLWORKQUEUE arms an internal completion handler that runs...

CVE-2026-90173 smb: smbdirect: free completion queues with ib_free_cq()

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: free completion queues with ibfreecq smbdirectconnectiondestroyqp creates the send and receive completion queues with iballoccqany, which for IBPOLLWORKQUEUE arms an internal completion handler that runs...

CVE-2026-90173

A slab-use-after-free vulnerability in the Linux kernel's smbdirect driver (SMB over RDMA) is triggered when smbdirect_connection_destroy_qp() tears down completion queues with ib_destroy_cq() instead of ib_free_cq(). Because ib_destroy_cq() does not cancel the internal workqueue poll handler, a ...

CVE-2026-90172 smb: smbdirect: destroy QP before mem pools on accept failure

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdmaacceptfailed error path of smbdirectacceptconnectrequest, the receive io posted just above is owned by the QP recvio is set to NULL after a successful post...