EUVD-2026-82216

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93108

CVE-2026-93108 affects the Linux kernel 's RDMA/ipoib subsystem. During module teardown, RCU callbacks may still be executing when ib_ipoib is unloaded, because IPoIB reclamation completions can be signaled from inside an RCU callback. Additionally, a client registration failure can remove alread...

CVE-2026-93108 RDMA/ipoib: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93108 RDMA/ipoib: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-90392 bpf: Fix potential UAF when reading bpf link info

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...

EUVD-2026-82053

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...

CVE-2026-90392

CVE-2026-90392 is a Use-After-Free (UAF) vulnerability in the Linux kernel's BPF subsystem. In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, the link->prog pointer is accessed without holding any locks. If the program is concurrently replaced via bpf_link_update, the old program can be fre...

CVE-2026-90373 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-90373

A race condition in the Linux kernel mt76 mt7915 WiFi driver allowed mt7915_remove_interface() to clear the wcid mask bit without holding the mutex and before clearing the RCU wcid pointer. On DBDC (dual-band dual-concurrent) configurations, the two wiphys share one mt76_dev, so this raced with a...

CVE-2026-90317 bpf: Invalidate RCU pointers after final spin unlock

In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpfspinunlock ends that protection, but the verifier leaves the pointer valid...

CVE-2026-90317

CVE-2026-90317 is a use-after-free in the Linux kernel BPF subsystem. In a sleepable BPF program , a spin lock can be the sole RCU protection for a kernel pointer (kptr). The final bpf_spin_unlock() ends that protection, yet the verifier leaves the pointer marked valid, allowing another CPU to fr...

EUVD-2026-81884

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...

CVE-2026-90291

CVE-2026-90291 is a use-after-free in the Linux kernel's module/dups subsystem, specifically in the lifetime handling of kmod_dup_req instances. The root cause is that the code relied on RCU to protect concurrent access, but kmod_dup_request_exists_wait() may hold a reference across a blocking wa...

CVE-2026-90291 module/dups: Fix use-after-free in kmod_dup_req lifetime handling

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...

CVE-2026-90291 module/dups: Fix use-after-free in kmod_dup_req lifetime handling

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...

EUVD-2026-81736

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

CVE-2026-90143

CVE-2026-90143 affects the Linux kernel in the KCM (Kernel Connection Multiplexer) subsystem. The root cause is that kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu()—which prevents CPU migration—but fails to establish an RCU read-side critical section . As a result, BPF map operations i...

CVE-2026-90143 net: kcm: Hold RCU read lock while running BPF parser

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

CVE-2026-90143 net: kcm: Hold RCU read lock while running BPF parser

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

CVE-2026-90140 cuse: wait for pending RCU callbacks on module exit

In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...