CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

CVE-2026-90246

AppArmor in the Linux kernel contains an integer overflow in the verify_tags() bounds check during policy blob validation. The 32-bit addition i + cnt wraps when an attacker-supplied count is near U32_MAX , bypassing the guard and causing an out-of-bounds read past a kcalloc allocation in the set...

CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

EUVD-2026-81839

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

EUVD-2026-81823

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90230 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90230 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90230

CVE-2026-90230 is a heap out-of-bounds read in the Linux kernel's NVMe target (nvmet) authentication path. The function nvmet_auth_negotiate() indexes a fixed idlist[60] array using host-supplied halen/dhlen fields (both u8, max 255) without validating the transfer length, allowing a malicious or...

EUVD-2026-81820

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

CVE-2026-90223 nfc: llcp: bound SNL TLV parsing to the skb and add length checks

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...

EUVD-2026-81816

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...

CVE-2026-90223

CVE-2026-90223 affects the Linux kernel NFC LLCP subsystem . The function nfc_llcp_recv_snl() walked the Service Name List (SNL) TLV list using an offset/length pair derived from skb->len without bounding reads to the actual buffer. This caused out-of-bounds reads when a short frame triggered ...

CVE-2026-90223 nfc: llcp: bound SNL TLV parsing to the skb and add length checks

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...

CVE-2026-90191 mailbox: riscv-sbi-mpxy: validate RPMI notification lengths

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90174

CVE-2026-90174 affects the ksmbd (in-kernel SMB server) component of the Linux kernel . The flaw is a slab-out-of-bounds read in ksmbd_alloc_user(): the field resp->hash_sz is an unvalidated __u16 (up to 65535), while the on-stack resp->hash[] buffer is only KSMBD_REQ_MAX_HASH_SZ bytes. Bec...

CVE-2026-90170 ksmbd: validate ipc response length before dereferencing its fields

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...

EUVD-2026-81763

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...

EUVD-2026-81754

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...