CVE-2026-90223

CVE-2026-90223 affects the Linux kernel NFC LLCP subsystem . The function nfc_llcp_recv_snl() walked the Service Name List (SNL) TLV list using an offset/length pair derived from skb->len without bounding reads to the actual buffer. This caused out-of-bounds reads when a short frame triggered ...

CVE-2026-90221

CVE-2026-90221 affects the Linux kernel's NFC NCI (NFC Controller Interface) subsystem. The functions nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() parse the CORE_INIT_RSP packet without validating that the socket buffer (skb) contains sufficient data. A malformed response—injec...

CVE-2026-90222

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

CVE-2026-90221 nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

EUVD-2026-81815

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

CVE-2026-90222 nfc: pn533: hold a reference to the request skb during send_frame

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

EUVD-2026-81814

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

CVE-2026-90222 nfc: pn533: hold a reference to the request skb during send_frame

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

CVE-2026-90221

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

CVE-2026-90222

CVE-2026-90222 is a use-after-free race condition in the Linux kernel's NFC PN533 driver (nfc/pn533). When __pn533_send_async() publishes a command and invokes send_frame(), an incoming I2C frame can trigger command completion, which frees the request skb via consume_skb(). On the I2C transport, ...

CVE-2026-90221 nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

CVE-2026-90220 ALSA: seq: Don't leak the extension cell pointer in the bounce payload

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90220

CVE-2026-90220 is a kernel pointer leak in the Linux kernel's ALSA: seq subsystem. The function bounce_error_event() embeds a failed event into the bounce payload by pointing data.ext.ptr at it. For queued variable-length events, this pointer holds the kernel address of the first extension cell (...

EUVD-2026-81813

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90220

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90218 RDMA/cma: Fix WARNING in res_to_rt

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix WARNING in restort syzbot reported a WARNON!res-dev in restort triggered via addrhandler during asynchronous address resolution: " WARNING: drivers/infiniband/core/restrack.c:138 at restort+0x1c4/0x230 CPU1:...

CVE-2026-90219 RDMA/cxgb4: Free debugfs on registration failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

EUVD-2026-81811

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix WARNING in restort syzbot reported a WARNON!res-dev in restort triggered via addrhandler during asynchronous address resolution: " WARNING: drivers/infiniband/core/restrack.c:138 at restort+0x1c4/0x230 CPU1:...

CVE-2026-90219

This vulnerability affects the Linux kernel 's RDMA/cxgb4 driver. The root cause is a debugfs dentry leak : c4iw_alloc() creates a per-device debugfs tree via setup_debugfs(), but the tree was only removed in c4iw_remove(), not in c4iw_dealloc(). When RDMA device registration fails, the err_deall...

CVE-2026-90218 RDMA/cma: Fix WARNING in res_to_rt

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix WARNING in restort syzbot reported a WARNON!res-dev in restort triggered via addrhandler during asynchronous address resolution: " WARNING: drivers/infiniband/core/restrack.c:138 at restort+0x1c4/0x230 CPU1:...