DEBIAN-CVE-2026-89809

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89809

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89807

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

DEBIAN-CVE-2026-89798

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...

CVE-2026-89798

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...

CVE-2026-90024 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

CVE-2026-90024

CVE-2026-90024 affects the Linux kernel USB gadget MIDI 2.0 function (drivers/usb/gadget/function/f_midi2.c). When the block direction is set to SNDRV_UMP_DIR_INPUT via configfs, the midi1_ep_out endpoint initialization is skipped during the gadget bind phase, leaving usb_ep->card as NULL . La...

CVE-2026-90024 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

EUVD-2026-80632

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

CVE-2026-90023

CVE-2026-90023 is a null pointer dereference in the Linux kernel USB gadget f_mass_storage driver, specifically in fsg_common_set_num_buffers(). The root cause is that the earlier removal of fsg_num_buffers_validate() relied on Kconfig limits (2–256) for the buffer count n, but a user can write p...

CVE-2026-90023 usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...

EUVD-2026-80631

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...

CVE-2026-90023 usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...

CVE-2026-90020 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...

CVE-2026-90019 usb: gadget: fix null pointer dereference in usb_put_function_instance()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocinst error path. However, fd is not allocated until later in...

CVE-2026-90019

CVE-2026-90019 affects the Linux kernel USB gadget subsystem. In the UVC function implementation, usb_put_function_instance() dereferences fi->fd to retrieve the module reference in the uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance(), so...

EUVD-2026-80627

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocinst error path. However, fd is not allocated until later in...

CVE-2026-90019 usb: gadget: fix null pointer dereference in usb_put_function_instance()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocinst error path. However, fd is not allocated until later in...

CVE-2026-90020 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...

CVE-2026-90020

CVE-2026-90020 affects the Linux kernel USB gadget subsystem. The vulnerability is a race condition in gadget_dev_ioctl(): the function reads dev->gadget before acquiring dev->lock, but checks dev->state only after acquiring the lock. A concurrent bind can change the device state between...