CVE-2026-90385 md/raid1: create serial pool adding rdev to array with serialize_policy=1

In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to array with serializepolicy=1 The following bug has been observed with kernel 7.1.3 after adding a new rdev to an existing RAID1 array with serializepolicy enabled: Oops: 0002 1 CPU: 0...

EUVD-2026-82046

In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to array with serializepolicy=1 The following bug has been observed with kernel 7.1.3 after adding a new rdev to an existing RAID1 array with serializepolicy enabled: Oops: 0002 1 CPU: 0...

CVE-2026-90297 drm/sun4i: crtc: Propagate layer initialization error

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

EUVD-2026-81890

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

CVE-2026-90297

CVE-2026-90297 is a null pointer dereference (kernel oops) in the Linux kernel's drm/sun4i driver (Allwinner). The function sun4i_crtc_init() returns plain NULL when layer initialization fails, while its other error paths return an error pointer. Its sole caller, sun4i_tcon_bind(), checks the res...

CVE-2026-90297 drm/sun4i: crtc: Propagate layer initialization error

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

CVE-2026-90293 IB/isert: post the full-feature receive buffers after session registration

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

CVE-2026-90293

CVE-2026-90293 is a NULL pointer dereference in the Linux kernel's IB/isert (iSCSI target over RDMA) component. The function isert_put_login_tx() posts full-feature receive buffers before __transport_register_session() completes, so an iSCSI initiator that sends a SCSI command before receiving th...

CVE-2026-90293 IB/isert: post the full-feature receive buffers after session registration

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

EUVD-2026-81886

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

CVE-2026-90229

CVE-2026-90229 affects the nvme-apple platform driver in the Linux kernel. The admin queue is allocated via blk_mq_alloc_queue() but never destroyed on controller removal: blk_mq_exit_queue() and blk_sync_queue() are never called, leaving the timeout timer and work armed on a freed queue. This ca...

EUVD-2026-81821

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...

CVE-2026-90212 arm64/efi: Avoid voluntary preemption with efi_mm installed

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

CVE-2026-90212 arm64/efi: Avoid voluntary preemption with efi_mm installed

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

CVE-2026-90212

CVE-2026-90212 affects the Linux kernel on arm64 systems that enable software PAN (CONFIG_ARM64_SW_TTBR0_PAN=y) and use EFI runtime services. The fpsimd context management code called from __efi_fpsimd_begin() can voluntarily preempt, causing the code to return to the EFI runtime service call wit...

EUVD-2026-81742

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session...

CVE-2026-90149 NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session...

CVE-2026-90149 NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session...

CVE-2026-90140 cuse: wait for pending RCU callbacks on module exit

In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...

EUVD-2026-81733

In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...