EUVD-2026-81843

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90250

CVE-2026-90250 is a null pointer dereference vulnerability in the Linux kernel's BPF/cgroup subsystem . The issue occurs when a BPF program using BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE replaces an empty prog via link_update. The root cause is that __cgroup_bpf_replace fails to allocate and assign the...

CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90228

This Linux kernel vulnerability is a NULL pointer dereference in the nvmet (NVMe-over-Fabrics target) subsystem, specifically in nvmet_execute_identify_ns_zns(). When a host sends an Identify command with CNS 05h and CSI 02h (ZNS) to a file-backed namespace , the function calls bdev_is_zoned() on...

CVE-2026-90228 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...

EUVD-2026-81821

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...

EUVD-2026-81800

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

CVE-2026-90207

CVE-2026-90207 is a race condition in the Linux kernel ALSA seq midi subsystem (snd_seq_midi). During input teardown, snd_midi_input_event() can still execute while a rawmidi substream is closing, causing the trigger state to become out-of-step. After rawmidi_release_priv() sets rfile->rmidi t...

CVE-2026-90207 ALSA: seq: midi: Serialize input teardown with event_input

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

CVE-2026-90207 ALSA: seq: midi: Serialize input teardown with event_input

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

CVE-2026-90202

This vulnerability affects the mpt3sas SCSI driver in the Linux kernel . The root cause is in _base_release_memory_pools(), which unconditionally frees every ioc->pcie_sg_lookup[] entry, including entries that were never allocated by the setup loop after a partial failure. This leads to a "bad...

EUVD-2026-81795

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warni...

CVE-2026-90202 scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warni...

EUVD-2026-81785

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90192 mailbox: qcom-cpucp: handle NULL data in send_data callback

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90192

CVE-2026-90192 affects the Linux kernel 's Qualcomm qcom-cpucp mailbox driver. The root cause is a NULL pointer dereference in qcom_cpucp_mbox_send_data(), which blindly dereferenced the data pointer when mailbox_clear_channel() invoked mbox_send_message() with NULL data to signal an RX channel c...

EUVD-2026-81779

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90186 null_blk: reject per-device queue resize for shared tag set

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90186

CVE-2026-90186 affects the Linux kernel null_blk driver. When the module is loaded with shared_tags enabled, a per-device resize of submit_queues or poll_queues via configfs calls blk_mq_update_nr_hw_queues() on the shared tag set, shrinking hardware queue contexts. The resulting NULL hardware co...

CVE-2026-90184

CVE-2026-90184 is a race condition in the Linux kernel's null_blk block device driver. Configfs attribute store methods (e.g., for zoned) run concurrently with null_add_dev() without holding a lock, allowing device configuration to change mid-setup. This can lead to a failed device setup (-EIO vi...