CVE-2026-90201

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix UAF in pagepoolreleasenetmemdma on xacmpxchg race This bug was discovered while testing the hns3 driver under channel reconfiguration ethtool -L / ethtool -G with iperf3 traffic on arm64. The race is...

CVE-2026-90159

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfg,setsockopt in cgroup UNIX getname hooks bpfsetsockopt and bpfgetsockopt call sockownedbyme for full sockets, so these helpers expect the socket lock to be held. BPFCGROUPUNIXGETPEERNAME and...

CVE-2026-90175

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of ksmbdipcloginrequestext returned buffer Free it unconditionally after ksmbdallocuser calls. kmemleak splat: unreferenced object 0xffff888103b83540 size 192: comm "pool-0", pid 16970, jiffies 4377290937 he...

CVE-2026-90178

In the Linux kernel, the following vulnerability has been resolved: hwmon: coretemp Fix coredata leak on CPUs without PTS pdata-coredata is allocated in inittempdata when the first core tempdata of a package is created, but it is only released from destroytempdata, and only in the branch that...

CVE-2026-90284

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: do not queue completed sysfs fallback requests fwloadsysfsfallback calls deviceadd before adding the fwpriv to pendingfwhead. deviceadd publishes the fallback loading interface, so a userspace helper which discove...

CVE-2026-90290

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error Sashiko AI has reported that if swsuspmtesavetags for some reason fails we return from swsusparchsuspend with DAIF being masked - that is not what we'd expect. Restore the saved DAIF...

CVE-2026-90219

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

UBUNTU-CVE-2026-90128

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr-head only on success. On the error path, the cleanup...

UBUNTU-CVE-2026-93062

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

UBUNTU-CVE-2026-90223

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...

CVE-2026-92505

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix undefined behavior in devidwrite debugfs function When foreachpcisegment loop completes without finding a matching segment, the pciseg pointer is not NULL but points to an invalid memory location the list head...

CVE-2026-92516

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpfresspinlock Sashiko pointed out correctly that the case statement for BPFRESSPINLOCK incorrectly checks offset for BPFSPINLOCK. Fix it by checking resspinlockoff instead...

CVE-2026-90410

In the Linux kernel, the following vulnerability has been resolved: spi: davinci: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestthreadedirq. During removal, spibitbangstop only unregisters th...

CVE-2026-90222

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

CVE-2026-90393

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF in bpfnetnslinkupdateprog In bpfnetnslinkupdateprog, the checks for oldprog and prog type are currently performed locklessly before acquiring netnsbpfmutex. This creates a race condition that can lead to a...

CVE-2026-92477

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: debugfs: Reserve space for a string terminator ufssavederrwrite copies user input into a zero-initialized stack buffer and passes it to kstrtoint. A write that fills the entire buffer overwrites its only terminator...

UBUNTU-CVE-2026-90372

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915mcugetstanss If a peer's VHT/HE MCS map has no supported spatial stream all fields 0x3, the loop exits with nss == 0 and the function returned u8-1 255, which was then written into...

UBUNTU-CVE-2026-90112

In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions...

UBUNTU-CVE-2026-90152

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix session leak in ksmbdsessionregister See the procedure below: smb2sesssetup ksmbdsmb2sessioncreate sessioncreate atomicset&sess-refcnt, 2 hashaddsessionstable, &sess-hlist, sess-id ksmbdsessionregister...

UBUNTU-CVE-2026-90391

In the Linux kernel, the following vulnerability has been resolved: lib/testhmm: fail dmirrorfault when the mirrored mm is gone dmirrorfault is called from the dmirrorread and dmirrorwrite retry loops after dmirrordoread or dmirrordowrite finds a missing device page table entry. If the mirrored m...