CVE-2026-90230 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90230

CVE-2026-90230 is a heap out-of-bounds read in the Linux kernel's NVMe target (nvmet) authentication path. The function nvmet_auth_negotiate() indexes a fixed idlist[60] array using host-supplied halen/dhlen fields (both u8, max 255) without validating the transfer length, allowing a malicious or...

CVE-2026-90230 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

EUVD-2026-81820

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

CVE-2026-90223 nfc: llcp: bound SNL TLV parsing to the skb and add length checks

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...

EUVD-2026-81816

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...

CVE-2026-90223

CVE-2026-90223 affects the Linux kernel NFC LLCP subsystem . The function nfc_llcp_recv_snl() walked the Service Name List (SNL) TLV list using an offset/length pair derived from skb->len without bounding reads to the actual buffer. This caused out-of-bounds reads when a short frame triggered ...

CVE-2026-90223 nfc: llcp: bound SNL TLV parsing to the skb and add length checks

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...

CVE-2026-90191 mailbox: riscv-sbi-mpxy: validate RPMI notification lengths

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90174

CVE-2026-90174 affects the ksmbd (in-kernel SMB server) component of the Linux kernel . The flaw is a slab-out-of-bounds read in ksmbd_alloc_user(): the field resp->hash_sz is an unvalidated __u16 (up to 65535), while the on-stack resp->hash[] buffer is only KSMBD_REQ_MAX_HASH_SZ bytes. Bec...

EUVD-2026-81763

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...

CVE-2026-90170 ksmbd: validate ipc response length before dereferencing its fields

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...

CVE-2026-90161 erofs: fix interlaced ztailpacking pclusters

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

CVE-2026-90161 erofs: fix interlaced ztailpacking pclusters

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

CVE-2026-90161

CVE-2026-90161 affects the erofs filesystem driver in the Linux kernel. The root cause is that ztailpacking interlaced pclusters should never be valid, yet crafted images can contain them with non-block-aligned on-disk sizes, leading to an out-of-bounds read from a kmap'd page and copying irrelev...

EUVD-2026-81754

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

CVE-2026-90145

CVE-2026-90145 affects the hinic3 network driver in the Linux kernel . The root cause is that hinic3_send_one_skb() cached the skb fragment count before calling hinic3_tx_offload(). When hinic3_tx_csum() falls back to skb_checksum_help() for unsupported tunnel packets, the skb may be linearized, ...

CVE-2026-90145 hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed

In the Linux kernel, the following vulnerability has been resolved: hinic3: Fix skb linearization mismatch and drop skb when skbchecksumhelp failed Previously, hinic3sendoneskb cached the skb fragment count before calling hinic3txoffload. If hinic3txcsum falls back to skbchecksumhelp for...

CVE-2026-90143 net: kcm: Hold RCU read lock while running BPF parser

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

CVE-2026-90143

CVE-2026-90143 affects the Linux kernel in the KCM (Kernel Connection Multiplexer) subsystem. The root cause is that kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu()—which prevents CPU migration—but fails to establish an RCU read-side critical section . As a result, BPF map operations i...