CVE-2026-90296

CVE-2026-90296 affects the Linux kernel's cpufreq/imx6q driver. The root cause is a devres allocation leak : imx6_soc_volt was allocated via devm_kcalloc() against the CPU device (get_cpu_device(0)), which is never unbound, so its devres list is never freed. Each driver rebind (probe) therefore a...

CVE-2026-90295 cpufreq: imx6q: fix out-of-bounds write when probed more than once

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix out-of-bounds write when probed more than once imx6socvolt is allocated fresh on every probe, sized to the number of ARM OPPs: imx6socvolt = devmkcalloccpudev, num, sizeofimx6socvolt, GFPKERNEL; but it is fill...

CVE-2026-90296 cpufreq: imx6q: fix devres accumulation across driver rebind

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6socvolt is allocated with devmkcalloccpudev, ..., where cpudev is the CPU device from getcpudevice0. That device is never unbound, so its devres list is never...

CVE-2026-90295

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix out-of-bounds write when probed more than once imx6socvolt is allocated fresh on every probe, sized to the number of ARM OPPs: imx6socvolt = devmkcalloccpudev, num, sizeofimx6socvolt, GFPKERNEL; but it is fill...

CVE-2026-90296

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6socvolt is allocated with devmkcalloccpudev, ..., where cpudev is the CPU device from getcpudevice0. That device is never unbound, so its devres list is never...

CVE-2026-90293 IB/isert: post the full-feature receive buffers after session registration

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

CVE-2026-90294

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

CVE-2026-90294 IB/isert: delay the final Login Response until the session is registered

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

EUVD-2026-81886

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

EUVD-2026-81887

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

CVE-2026-90293 IB/isert: post the full-feature receive buffers after session registration

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

CVE-2026-90293

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

CVE-2026-90294 IB/isert: delay the final Login Response until the session is registered

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

CVE-2026-90294

CVE-2026-90294 is a NULL pointer dereference in the Linux kernel's iSCSI over RDMA target (iSER) module. The root cause is a race condition: isert_put_login_tx() transmits the final Login Response before __transport_register_session() completes, so an initiator that immediately issues a SCSI comm...

CVE-2026-90292

CVE-2026-90292 is a use-after-free in the Linux kernel's RDMA/siw subsystem, specifically in siw_accept() . When a QP supplied by userspace is already in the RTS state, the error cleanup path incorrectly drops a reference from the incoming CEP rather than the existing qp->cep, potentially free...

EUVD-2026-81885

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...

CVE-2026-90292 RDMA/siw: Fix use-after-free in siw_accept()

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...

CVE-2026-90292

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...

CVE-2026-90292 RDMA/siw: Fix use-after-free in siw_accept()

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...

EUVD-2026-81884

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...