CVE-2026-92479

A flaw was found in the Linux kernel's Universal Flash Storage UFS host controller driver. When an invalid completion queue entry CQE tag is reported, the driver attempts to dereference a NULL pointer, which can lead to a system crash. This vulnerability could allow a local attacker to cause a...

CVE-2026-92478

A flaw was found in the Linux kernel. The Universal Flash Storage UFS core component does not properly validate connected lane counts. This could allow a local attacker to provide specially crafted input, leading to out-of-range memory access when processing Universal Flash Storage UFS commands...

CVE-2026-92477

A flaw was found in the Linux kernel, specifically within the scsi: ufs: debugfs component. The ufssavederrwrite function copies user-provided input into a stack buffer without ensuring sufficient space for a string terminator. If the input completely fills the buffer, it overwrites the terminato...

CVE-2026-92476

A flaw was found in the Linux kernel's crypto: keembay driver. This vulnerability occurs because a critical component, irqcompletion, is not fully prepared before the system starts processing interrupts. If an interrupt happens during this brief window, it can attempt to use an uninitialized...

CVE-2026-90435

A flaw was found in the Linux kernel's RDMA/mlx5 component. A local attacker could exploit an integer overflow vulnerability when processing user-supplied buffer size values. This flaw occurs because large user inputs can cause an integer overflow during buffer size calculation, leading to a...

CVE-2026-90433

A flaw was found in the Linux kernel's spi: oc-tiny driver. This vulnerability arises from a timing issue where the system attempts to free memory associated with a Serial Peripheral Interface SPI controller before ensuring that all related interrupt handling has ceased. This can lead to a...

CVE-2026-90432

A flaw was found in the Linux kernel's schedext component, specifically within its hardlockup handler. An unnecessary deferral of abort operations could prevent the system from properly recovering from a CPU hardlockup, where a CPU becomes unresponsive. This could lead to system unresponsiveness ...

CVE-2026-90431

A flaw was found in the Linux kernel's remoteproc component. A race condition exists between the crash handling and removal functions due to a lack of synchronization. This could allow a local attacker to trigger a use-after-free vulnerability. Successful exploitation of this flaw may lead to...

CVE-2026-90429

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv component. A synchronization issue exists between the error Interrupt Service Routine ISR and the Virtual Interrupt Function VINTF de-initialization process. A concurrent error could lead to the ISR attempting to access a VINTF that is...

CVE-2026-90426

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv component. During the teardown process of Virtual Interrupt Functions VINTFs, the error interrupt IRQ is freed after the VINTFs are torn down. This incorrect order can lead to a scenario where an error occurring in this window causes the...

CVE-2026-90425

A flaw was found in the Linux kernel, specifically within the IOMMU Input/Output Memory Management Unit Tegra241 command queue driver. This vulnerability arises from improper handling of virtual Stream IDs vSID when a device has either multiple or no physical Stream IDs. A malicious guest operati...

CVE-2026-90423

A flaw was found in the Linux kernel's RDMA/rxe component. An error in the On-Demand Paging ODP initialization path can lead to a Use-After-Free UAF vulnerability. During error handling, memory is prematurely released, but a pointer to it is not properly cleared. This allows subsequent operations...

CVE-2026-90420

A flaw was found in the nilfs2 component of the Linux kernel. When the nilfs2 filesystem encounters an I/O error and is subsequently remounted as read-only, a cleaner input/output control ioctl operation can enter an infinite loop. This condition causes the affected task to hang indefinitely,...

CVE-2026-90421

A flaw was found in the Linux kernel's Peripheral Component Interconnect PCI subsystem. This Use-After-Free UAF vulnerability arises when a PCI device probe operation occurs concurrently with the removal of a dynamic ID. This timing issue could allow a local attacker to cause a system crash,...

CVE-2026-90418

A flaw was found in nilfs2, a file system in the Linux kernel. This vulnerability occurs when a dirty page unexpectedly loses its dirty status during a copy operation, particularly after the filesystem detects metadata corruption and transitions to read-only mode. An attacker could potentially...

CVE-2026-90419

A flaw was found in the nilfs2 filesystem implementation within the Linux kernel. This vulnerability occurs due to insufficient validation of super-root inode metadata size before parsing. A local attacker could craft a malicious filesystem image that, when processed, causes an out-of-bounds read...

CVE-2026-90416

A flaw was found in the Linux kernel's RDMA/mlx5 component. The getparam function, used for debugging congestion parameters, incorrectly formats a 32-bit unsigned integer as a signed integer. This can lead to a stack out-of-bounds read when a large value is processed, potentially causing unexpect...

CVE-2026-90413

A flaw was found in the Linux kernel's IB/isert component. A remote attacker can exploit this vulnerability by sending a specially crafted login Protocol Data Unit PDU that declares a larger data segment length than the actual data received. This discrepancy causes an out-of-bounds read during...

CVE-2026-90412

A flaw was found in the nvmet component of the Linux kernel. When processing an RMI log page, if memory allocation for the log buffer fails, the system incorrectly reports a successful operation to the host. This can lead to the host believing data was transferred when it was not, potentially...

CVE-2026-90410

A flaw was found in the Linux kernel's Serial Peripheral Interface SPI davinci component. A timing issue exists during the deallocation of the SPI controller, where its memory can be freed before the associated interrupt handler is fully drained. This can lead to a use-after-free vulnerability,...