EUVD-2026-81749

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

CVE-2026-90156 ksmbd: safely discard unregistered deferred locks

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

CVE-2026-90156 ksmbd: safely discard unregistered deferred locks

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

CVE-2026-90149 NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session...

CVE-2026-90149

CVE-2026-90149 is a NULL pointer dereference in the Linux kernel's NFSv4/flexfiles subsystem. When a flexfiles mount uses an NFSv4.0 data server , two code paths incorrectly assume a session exists: nfs4_init_ds_session() dereferences clp->cl_session->session_state, and ff_layout_async_hand...

EUVD-2026-81742

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session...

CVE-2026-90148

CVE-2026-90148 affects the Linux kernel's NFSv4 subsystem. When nfs4_add_lease() races with a delegation return, it passes a potentially NULL priv argument to nfs4_delete_lease(), which eventually leads to a NULL pointer dereference in generic_setlease(). This can cause a kernel crash (panic). Th...

EUVD-2026-81741

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4deletelease in nfs4addlease When nfs4addlease races with a delegation return, it calls nfs4deletelease to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a...

EUVD-2026-81737

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dplldeviceops during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpllpinonpinregister, the dpll object stays alive with an empty...

CVE-2026-90144

CVE-2026-90144 is a NULL pointer dereference in the Linux kernel's DPLL subsystem (drivers/dpll/dpll_core.c). The race occurs when the last owner of a DPLL device unregisters while a foreign driver (e.g., ice ) still holds a pin via dpll_pin_on_pin_register(). A pin notification queued before the...

CVE-2026-90139

This vulnerability affects the Linux kernel FUSE (Filesystem in Userspace) module. The root cause is a NULL pointer dereference in fuse_fill_super_submount(): when fuse_iget() fails to allocate an inode (e.g., under memory pressure), the resulting NULL is passed unchecked to get_fuse_inode(), cau...

EUVD-2026-81732

In the Linux kernel, the following vulnerability has been resolved: fuse: check for NULL root inode in fusefillsupersubmount fuseiget can return NULL when its inode allocation fails, but fusefillsupersubmount passed the result straight to getfuseinode and decremented fi-nlookup without checking i...

CVE-2026-90115

CVE-2026-90115 affects the Linux kernel XDP subsystem (net/xdp/xsk.c). In the __xsk_rcv() multi-buffer path, xsk_buff_alloc() is called in a loop without checking its return value. Since xsk_buff_can_alloc() only counts fill queue entries without validating their addresses, it can succeed while x...

EUVD-2026-81708

In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in xskrcv In the xskrcv multi-buffer path, xskbuffalloc is called in a loop without checking its return value. xskbuffcanalloc only counts fill queue entries without validating their addresses, s...

CVE-2026-90103

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

CVE-2026-90102

CVE-2026-90102 is a Linux kernel vulnerability in the NFSv4/pnfs flexfiles layout driver. The per-net data server cache in nfs4_pnfs_ds_add() keyed entries only on the multipath address set, ignoring the NFS version. When one address legitimately serves both NFSv3 and NFSv4 , two deviceids alias ...

CVE-2026-90102 NFSv4/pnfs: key the data server cache on the NFS version

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

EUVD-2026-81695

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

CVE-2026-90091 Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

EUVD-2026-81952

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...