CVE-2026-90234

CVE-2026-90234 is a Linux kernel NFS client vulnerability in nfs_inode_set_delegation(). Three error paths in this function return without sending DELEGRETURN , silently dropping a delegation the server still believes the client holds. When the server later recalls that delegation, the client res...

EUVD-2026-81826

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pools are created lazily from nvmeinithctxcommon once the admin tag set is allocated, but they are only destroyed in nvmeremove via...

EUVD-2026-81825

In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amtdeviceevent tries to unregister its upper AMT device, but it has two problems. 1. amtlookupupperdev looks up an upper device in the lower device's netn...

CVE-2026-90233 nvme-pci: release descriptor pools on probe failure

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pools are created lazily from nvmeinithctxcommon once the admin tag set is allocated, but they are only destroyed in nvmeremove via...

CVE-2026-90232

In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amtdeviceevent tries to unregister its upper AMT device, but it has two problems. 1. amtlookupupperdev looks up an upper device in the lower device's netn...

CVE-2026-90233 nvme-pci: release descriptor pools on probe failure

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pools are created lazily from nvmeinithctxcommon once the admin tag set is allocated, but they are only destroyed in nvmeremove via...

CVE-2026-90233

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pools are created lazily from nvmeinithctxcommon once the admin tag set is allocated, but they are only destroyed in nvmeremove via...

CVE-2026-90232

CVE-2026-90232 affects the AMT (Advanced Multi Tenancy) network driver in the Linux kernel. When an AMT upper device is created on a lower device in a different network namespace (cross-netns), removing that lower device causes amt_device_event() to fail: it only searches for upper devices in the...

CVE-2026-90232 amt: Don't support cross-netns setup.

In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amtdeviceevent tries to unregister its upper AMT device, but it has two problems. 1. amtlookupupperdev looks up an upper device in the lower device's netn...

CVE-2026-90232 amt: Don't support cross-netns setup.

In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amtdeviceevent tries to unregister its upper AMT device, but it has two problems. 1. amtlookupupperdev looks up an upper device in the lower device's netn...

CVE-2026-90231 apparmor: fix unconfined user namespace restriction forced stack

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...

CVE-2026-90231

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...

CVE-2026-90231

CVE-2026-90231 is a flaw in the Linux kernel's AppArmor subsystem. When a task is already confined by a profile stack , the unprivileged user-namespace transition restriction on the unconfined profile is not correctly enforced. This allows a confinement escape if two transitions through an unconf...

EUVD-2026-81824

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...

EUVD-2026-81822

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-90230 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90230 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90230

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90229

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-90229

CVE-2026-90229 affects the nvme-apple platform driver in the Linux kernel. The admin queue is allocated via blk_mq_alloc_queue() but never destroyed on controller removal: blk_mq_exit_queue() and blk_sync_queue() are never called, leaving the timeout timer and work armed on a freed queue. This ca...