CVE-2026-90335

CVE-2026-90335 is a NULL-pointer dereference in the Linux kernel's TTY subsystem (serial core). When TTY device registration fails before a cdev is allocated, the serial core retains the port for use by setserial. On later removal, the NULL cdev slot is passed to cdev_del(), triggering the derefe...

CVE-2026-90297

CVE-2026-90297 is a null pointer dereference (kernel oops) in the Linux kernel's drm/sun4i driver (Allwinner). The function sun4i_crtc_init() returns plain NULL when layer initialization fails, while its other error paths return an error pointer. Its sole caller, sun4i_tcon_bind(), checks the res...

EUVD-2026-81890

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

EUVD-2026-81887

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

EUVD-2026-81886

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

CVE-2026-90294 IB/isert: delay the final Login Response until the session is registered

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

CVE-2026-90293

CVE-2026-90293 is a NULL pointer dereference in the Linux kernel's IB/isert (iSCSI target over RDMA) component. The function isert_put_login_tx() posts full-feature receive buffers before __transport_register_session() completes, so an iSCSI initiator that sends a SCSI command before receiving th...

CVE-2026-90294

CVE-2026-90294 is a NULL pointer dereference in the Linux kernel's iSCSI over RDMA target (iSER) module. The root cause is a race condition: isert_put_login_tx() transmits the final Login Response before __transport_register_session() completes, so an initiator that immediately issues a SCSI comm...

CVE-2026-90282

CVE-2026-90282 affects the QCOM QMP USB legacy PHY driver in the Linux kernel. The root cause is a NULL pointer dereference of qmp->phy when the runtime suspend callback executes in a narrow window between pm_runtime_enable() and pm_runtime_forbid(), before the PHY pointer is initialized. The ...

EUVD-2026-81875

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because...

EUVD-2026-81873

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...

CVE-2026-90281

CVE-2026-90281 affects the Linux kernel driver phy: qcom: snps-femto-v2 . The root cause is a NULL pointer dereference that can occur during early runtime suspend: runtime PM callbacks dereference the hsphy instance before it is fully initialized, because phy_create() enables runtime PM on the PH...

EUVD-2026-81874

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phycreate only enables runtime PM on the PHY device if it is already enabled on this parent...

CVE-2026-90280

CVE-2026-90280 is a NULL pointer dereference in the Linux kernel 's Qualcomm QMP USB PHY driver (phy: qcom: qmp-usb). A small timing window exists where the runtime suspend callback executes after pm_runtime_enable() but before pm_runtime_forbid(), causing a crash because the qmp->phy pointer ...

EUVD-2026-81864

In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable se...

CVE-2026-90271

This vulnerability affects the Linux kernel's arm_mpam (Memory Partitioning and Monitoring) driver. The root cause is a NULL pointer dereference that occurs when a user unbinds an MSC (Memory System Component) after mpam_disable() has been called in response to an error interrupt, which sets the ...

EUVD-2026-81843

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90250

CVE-2026-90250 is a null pointer dereference vulnerability in the Linux kernel's BPF/cgroup subsystem . The issue occurs when a BPF program using BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE replaces an empty prog via link_update. The root cause is that __cgroup_bpf_replace fails to allocate and assign the...

CVE-2026-90228

This Linux kernel vulnerability is a NULL pointer dereference in the nvmet (NVMe-over-Fabrics target) subsystem, specifically in nvmet_execute_identify_ns_zns(). When a host sends an Identify command with CNS 05h and CSI 02h (ZNS) to a file-backed namespace , the function calls bdev_is_zoned() on...

CVE-2026-90228 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...