CVE-2026-90413

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares...

CVE-2026-90424

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra241cmdqvinitstructures allocates VINTF0 with kzallocobj, inits it, and preallocates its logical VCMDQs. Two of its error paths leak. When tegra241cmdqvinitvintf...

CVE-2026-90262

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...

CVE-2026-90291

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...

CVE-2026-90207

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

CVE-2026-90245

In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wra...

CVE-2026-90269

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

CVE-2026-90383

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

CVE-2026-90389

In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave token in mddev-noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter...

CVE-2026-90398

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix stride mismatch in macphycapsparse Currently, in ath11kwmitlvmacphycapsparse, kcalloc sizes the macphycaps buffer as totphyid len, where len is clamped to minfirmwarelen, sizeofstruct wmimacphycapabilities. The...

CVE-2026-90401

In the Linux kernel, the following vulnerability has been resolved: md: remove REQNOWAIT support from raid1/10/456 REQNOWAIT support in md personalities that can block internally is fundamentally incomplete. While reads can avoid some blocking paths, write requests can still encounter cases where...

CVE-2026-90404

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosecdebugfs: Unregister panic notifier crosecdebugfsprobe registers notifierpanic with the EC panic notifier chain. The remove path tears down debugfs and the console log, but leaves the notifier registered. A...

CVE-2026-90407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

CVE-2026-90397

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...

CVE-2026-90403

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path in rtlpciprobe, the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtlinitrfkill, ieee80211registerhw,...

CVE-2026-93061

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-90382

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a...

CVE-2026-90126

In the Linux kernel, the following vulnerability has been resolved: rtc: pcf8563: fix clock provider leak on unbind pcf8563clkoutregisterclk registers the CLKOUT clock provider with ofclkaddprovider, but nothing ever unwinds it: there is no ofclkdelprovider call and the driver has no remove...

CVE-2026-90347

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

CVE-2026-90348

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to it are not permitted...