CVE-2026-90221

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

CVE-2026-90375

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations mt76txqueueskb overrides the wcid passed by the driver with sta-drvpriv, so the wcid might incorrectly be changed after TX, causing wcid-nonaqlpackets to be counted on th...

CVE-2026-90194

In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on deviceadd failures When deviceadd fails after acpidevicesetname has allocated an instance ID and a new acpidevicebusid has been linked into acpibusidlist, the rollback path only removes wakeuplis...

CVE-2026-90092

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...

CVE-2026-90390

In the Linux kernel, the following vulnerability has been resolved: md/bitmap: resume array on backlogstore error path backlogstore suspends the array before checking whether a write-mostly device exists. If no such device exists, the error path only unlocks reconfigmutex and leaves the array...

CVE-2026-90130

In the Linux kernel, the following vulnerability has been resolved: vdpasim: fix cleanup after worker creation failure vdpasimcreate leaves vdpasim-worker as an ERRPTR when kthreadrunworker fails. The error path then drops the device reference, which releases the partially initialized simulator...

CVE-2026-90392

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...

CVE-2026-90158

In the Linux kernel, the following vulnerability has been resolved: m68k: nfcon: Do not call consoleisregistered in nfcondevice Since 7c2af0f634f1 "tty: ttyio: use consolelistlock for list synchronization" showconsactive calls the .device method under the consolelistlock, but consoleisregistered...

CVE-2026-90243

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copiedcontextteardown zeroes the 128-bit context entry with contextclearentry while the Present bit is still set, and only then issues the context-cache and...

CVE-2026-92511

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroycquser When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-90151

In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4allocclient allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the...

CVE-2026-90143

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

CVE-2026-93050

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-90196

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

CVE-2026-90189

In the Linux kernel, the following vulnerability has been resolved: nullblk: register configfs subsystem after creating default devices In nullinit, configfsregistersubsystem currently runs before registerblkdev, so when nullblk is built as a module, a racing mkdir + poweron from userspace can...

CVE-2026-90395

In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier and power supply, but does not wait for queued or running work befor...

CVE-2026-90228

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...

CVE-2026-90166

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-92490

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unrequest devices if driver registration fails scmidriverregister requests protocol devices before registering the driver. If driverregister fails, those requests remain in the global IDR and retain pointers to...

CVE-2026-90274

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of nrseqstate - 1 According to IHI006H Embedded Trace Macrocell Architecture Specification0, TRCSEQEVR is implemented only when TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0...