CVE-2026-90400 md: recheck spare changes before starting sync

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90385

This Linux kernel vulnerability affects the md/raid1 module. When a new rdev is added to an existing RAID1 array with serialize_policy enabled, the condition in mddev_create_serial_pool() skips initialization of rdev->serial. The wait_for_serialization() function then dereferences an uninitial...

CVE-2026-90335 tty: skip cdev_del() when no cdev is registered

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

EUVD-2026-81996

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

CVE-2026-90335 tty: skip cdev_del() when no cdev is registered

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

CVE-2026-90335

CVE-2026-90335 is a NULL-pointer dereference in the Linux kernel's TTY subsystem (serial core). When TTY device registration fails before a cdev is allocated, the serial core retains the port for use by setserial. On later removal, the NULL cdev slot is passed to cdev_del(), triggering the derefe...

CVE-2026-90297 drm/sun4i: crtc: Propagate layer initialization error

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

CVE-2026-90297 drm/sun4i: crtc: Propagate layer initialization error

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

EUVD-2026-81886

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

EUVD-2026-81887

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

CVE-2026-90294 IB/isert: delay the final Login Response until the session is registered

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

CVE-2026-90293

CVE-2026-90293 is a NULL pointer dereference in the Linux kernel's IB/isert (iSCSI target over RDMA) component. The function isert_put_login_tx() posts full-feature receive buffers before __transport_register_session() completes, so an iSCSI initiator that sends a SCSI command before receiving th...

CVE-2026-90271 arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt

In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable se...

EUVD-2026-81864

In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable se...

CVE-2026-90271

This vulnerability affects the Linux kernel's arm_mpam (Memory Partitioning and Monitoring) driver. The root cause is a NULL pointer dereference that occurs when a user unbinds an MSC (Memory System Component) after mpam_disable() has been called in response to an error interrupt, which sets the ...

CVE-2026-90271 arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt

In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable se...

CVE-2026-90228

This Linux kernel vulnerability is a NULL pointer dereference in the nvmet (NVMe-over-Fabrics target) subsystem, specifically in nvmet_execute_identify_ns_zns(). When a host sends an Identify command with CNS 05h and CSI 02h (ZNS) to a file-backed namespace , the function calls bdev_is_zoned() on...

CVE-2026-90228 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...

EUVD-2026-81821

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...

EUVD-2026-81800

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...