CVE-2026-90117

A flaw was found in the Linux kernel's NTFS filesystem driver. When reusing a free Master File Table MFT record, the driver fails to properly validate an offset value from the on-disk record. A local attacker could exploit this by creating a specially crafted file, leading to a use-after-free err...

CVE-2026-90116

A flaw was found in the ALSA mtpav driver of the Linux kernel. A race condition exists where the output timer callback can continue to access card-private state after the card has been torn down. This occurs because the timer deletion mechanism does not wait for a running callback to finish,...

CVE-2026-90115

A flaw was found in the Linux kernel's AFXDP xsk socket multi-buffer receive path. This vulnerability allows for a NULL pointer dereference in the xskrcv function due to improper handling of buffer allocation failures. An attacker could exploit this flaw to cause a system crash, leading to a Deni...

CVE-2026-90114

A flaw was found in the Linux kernel's networking bridge component. When processing specially crafted VLAN Virtual Local Area Network tunnel ranges, a logic error can occur where descending VLAN and tunnel IDs are incorrectly handled. This can lead to an unpredictable return value, potentially...

CVE-2026-90113

A flaw was found in the netdevsim component of the Linux kernel. When a network queue is reset, the system fails to correctly update the association with its NAPI New API structure. This can allow a local attacker, by performing a queue reset and then initiating a queue dump via Netlink, to trigg...

CVE-2026-90112

A flaw was found in the qlcnic driver in the Linux kernel. This vulnerability occurs due to insufficient validation of unified ROM sections when processing firmware files. A local attacker could provide a specially crafted or truncated firmware image, leading the driver to read beyond its allocat...

CVE-2026-90110

A flaw was found in the Linux kernel's inetpeer rate limiting system. An off-path attacker could exploit a deterministic Red-Black tree traversal mechanism to predict the tree's structure and force the eviction of specific network peer entries. This manipulation allows the attacker to reset...

CVE-2026-90106

A flaw was found in the Linux kernel's bridge ARP/ND Address Resolution Protocol/Neighbor Discovery proxy. When the neighbor hardware address HA is read directly, it can result in torn or partial reads if the neighbor entry is simultaneously being updated. This data inconsistency could lead to...

CVE-2026-90105

A flaw was found in the Linux kernel's vxlan implementation. When arp/neighreduce attempts to read the neighbor hardware address neigh ha directly while it is being updated, it can result in partial reads. This data inconsistency can lead to unreliable network operations and potentially disrupt...

CVE-2026-90104

A flaw was found in the Linux kernel's NFSv4.1 implementation. When decoding callback sequence arguments, an uninitialized pointer in the referringcalllist can be passed to the kfree function. This memory corruption vulnerability could allow a remote attacker to cause a denial of service by...

CVE-2026-90103

A flaw was found in the Linux kernel's NFSv4.2 Network File System version 4.2 component. A malicious or specially crafted data server can exploit an issue in the LAYOUTSTATS handling, where the send buffer can be exhausted due to an undersized allocation. This can lead to a permanent lock being...

CVE-2026-90102

A flaw was found in the Linux kernel's NFSv4/pnfs component. The data server cache is incorrectly keyed only on the multipath address set, without considering the NFS version. This oversight allows different NFS versions to share the same internal data structure when two device IDs on one address...

CVE-2026-90101

A flaw was found in the Linux kernel's Broadcom NetXtreme-C/E bnxten network adapter driver. The driver incorrectly calls the hardware monitoring event handler function hwmonnotifyevent with an incorrect parameter. This improper function call can lead to undefined behavior and may result in a...

CVE-2026-90100

A flaw was found in the Linux kernel's Precision Time Protocol PTP netc driver. An issue with period calculation can lead to a value being truncated to zero. This truncated value can then cause a divide-by-zero error in the netctimersetperoutalarm function, resulting in a system crash and a Denia...

CVE-2026-90099

A flaw was found in the Linux kernel's network scheduler. An unprivileged user can exploit a memory accounting vulnerability in the traffic control tc classifier. By creating a large number of filters, an attacker can cause the kernel to pin memory outside of memory cgroup memcg limits, leading t...

CVE-2026-90098

A flaw was found in the Linux kernel's net: sparx5 driver. The sparx5setrxmode function attempts to acquire a mutex and poll a register while operating in an atomic context, which is not allowed. This improper operation can lead to a "sleep in atomic context" bug, causing system instability or a...

CVE-2026-90096

A flaw was found in the Linux kernel's FUSE Filesystem in Userspace component. When performing direct writes with the OAPPEND flag, the fusedirectwriteiter function incorrectly invalidates the page cache. This can lead to data inconsistency, where concurrent readers may access stale data from the...

CVE-2026-90094

A flaw was found in the Linux kernel, affecting the arm64 architecture's process context switching. When a user enables the Memory Tagging Extension MTE store-only tag check mode, the associated security setting SCTLREL1.TCSO0 is not properly reset during a task switch. This oversight allows the...

CVE-2026-90093

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. This vulnerability allows for a Use-After-Free UAF condition when handling getsockopt and setsockopt operations. An attacker could exploit this by causing the system to attempt to access...

CVE-2026-90092

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol implementation. A race condition can occur when a new connection is established while a parent L2CAP channel is being torn down, due to inconsistent locking. This can lead to a Use-After-Free UAF...