MK4001MTD-USB-Bridge

MK4001MTD USB Bridge RP2040 Pico firmware that bridges a Toshiba MK4001MTD 0.85" SDIO microdrive as a USB Mass Storage device. The MK4001MTD is a 4 GB Microdrive originally used in the Nokia N91 music phone and some other devices, like MP3 players or USB drives, back when flash storage was still...

CVE-2026-90090

A flaw was found in the Linux kernel's Bluetooth MTK SDIO Secure Digital Input Output driver. The btmtksdiotxpacket function, which handles data transmission, incorrectly calculates the transfer size. This leads to an out-of-bounds read of uninitialized memory, which is then sent to the Bluetooth...

CVE-2026-98208

A flaw was found in the Linux kernel's SDIO UART driver. When registering a new device port while all available port slots are occupied, the driver fails to release an allocated transmit buffer during error handling. A local user could exploit this flaw by repeatedly triggering failed device...

ROS-20261007-73-0346

The vulnerability of the vub300disconnect function in the drivers/mmc/host/vub300.c module of the MMC/SD/SDIO card driver for the Linux operating system is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the...

DEBIAN-CVE-2026-98189

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...

AZL-106122 CVE-2026-98189 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...

CVE-2026-98213 mmc: core: Cancel SDIO IRQ work before freeing host

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdiosignalirq schedules host-sdioirqwork from its interrupt handler. That work is only cancelled on the suspend path mmcsdiosuspend, not on the...

CVE-2026-98213

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdiosignalirq schedules host-sdioirqwork from its interrupt handler. That work is only cancelled on the suspend path mmcsdiosuspend, not on the...

EUVD-2026-93117

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...

PT-2026-106542

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A flaw exists in the mmc core where a host controller using sdio signal irq schedules host-sdio irq work from its interrupt handler. This work is cancelled during the suspend path via mmc...

PT-2026-106537

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A memory leak occurs in the sdio uart add port function when the sdio uart table is full. The function allocates the transmit fifo before securing a slot in the table; if all UART NR slots...

CVE-2026-90378

A flaw was found in the Linux kernel's mt76 wireless driver, specifically in the mt792x SDIO TX path. When the txprepareskb function fails to prepare a socket buffer skb for transmission, the skb is not properly released. This memory leak can lead to resource exhaustion, potentially causing a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76: mt7921: Drop TXRXNOTIFY on non-MMIO buses PKTTYPETXRXNOTIFY is an event exclusive to MMIO operations. However, mt7921rxcheck and mt7921queuerxskb dispatch this event to mt7921mactxfree on every bus. mt7921mactxfree...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: Do not assume adequate headroom for SDIO headers The function mt7921usbsdiotxprepareskb calls mt7921usbsdiowritetxwi and mt7921skbaddusbsdiohdr. Both functions blindly assume that adequate headroom will be available...

SUSE CVE-2026-90378

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

CVE-2026-90378

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

AZL-102897 CVE-2026-90378 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

CVE-2026-90090

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdiotxpacket rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is: err = sdiowritesbbdev-func,...

CVE-2026-90378

CVE-2026-90378 affects the Linux kernel 's mt76/mt792x WiFi driver in its SDIO TX path . The root cause is a memory leak : when tx_prepare_skb() returns an error, the socket buffer (skb) is not freed. This can be triggered when zero-length frames (such as WNM NULL frames) are dropped to prevent p...

EUVD-2026-82039

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...