PT-2026-94520

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the smbdirect component of the Linux kernel where memory pools are destroyed before the Queue Pair QP during an accept failure. In the rdma accept failed error path of...

CVE-2026-90207: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

CVE-2026-90066: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: samples/ftrace: Fix kthreadstop on ERRPTR in ftrace-direct-multi-modify ftracedirectmultiinit assigns kthreadrun's return value to simpletsk without an ISERR check. When kthreadrun fails it returns ERRPTR-ENOMEM, but init still...

CVE-2026-90192: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90426: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241cmdqvremove tears each VINTF down first, then calls freeirq. Tearing a VINTF down frees vintf0 and clears cmdqv-vintfs0. An error in that window makes...

PT-2026-94889

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm scmi firmware where transport setup may enable callbacks before the setup routine returns. Specifically, mailbox chan setup registers the mailbox client via mb...

CVE-2026-90400: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-92500: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the live inode state ext4hasinlinedatainode and ext4testinodestateinode, EXT4STATEMAYINLINEDATA in the writeend handlers, use the fsdata parameter...

CVE-2026-93073: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

PT-2026-94808

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ext4 file system when handling inline data writes. A concurrent thread, such as ext4 page mkwrite, can convert inline data to an extent between the write...

PT-2026-94911

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the mlxbf-pmc driver when it is force-bound to a device that lacks an ACPI companion object. This happens because the mlxbf pmc probe function passes...

PT-2026-94619

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the arm mpam module when a user unbinds a Memory System Component MSC after an error interrupt has triggered the mpam disable function. This happens...

PT-2026-94512

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB server where ksmbd server init calls ksmbd proc init before creating other server subsystems. If a procfs or percpu counter allocation failure occurs, ksmbd pr...

CVE-2026-90397: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...

CVE-2026-90115: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in xskrcv In the xskrcv multi-buffer path, xskbuffalloc is called in a loop without checking its return value. xskbuffcanalloc only counts fill queue entries without validating their addresses, s...

CVE-2026-90293: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

PT-2026-94777

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommu/tegra241-cmdqv component where the error interrupt service routine ISR is not properly synchronized with VINTF initialization and deinitialization. The...

PT-2026-94748

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the md module where md start sync checks for spare configuration changes before acquiring the reconfig mutex. Because the rdev state can change before the mute...

PT-2026-94848

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Multiple issues occur in the ipoctal component when a device is removed while a tty session remains active. These include a Use-After-Free UAF of struct ipoctal because the remove callba...

PT-2026-94514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null-pointer dereference occurs in the ksmbd ipc tree connect request function. This happens when ksmbd share config get fails during a kstrdup operation for share-name and the KSMBD...