CVE-2026-90259

A flaw was found in btrfs qgroup. An incorrect length calculation in the qgroupfreereserveddata function can lead to a much larger length being used than intended. This error in calculation may result in improper data handling, potentially causing system instability or data corruption. Mitigation...

CVE-2026-90245

A flaw was found in the Linux kernel's fbdev kyro driver. This vulnerability arises from the calculation of overlay viewport end coordinates using 32-bit unsigned arithmetic. Large input values can cause these calculations to wrap around, resulting in incorrect coordinates being passed to the...

CVE-2026-90240

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit / VT-d Virtualization Technology for Directed I/O component. When tearing down Direct Memory Access DMA aliases of a device, the system fails to flush the context cache with the correct Source ID SID. This oversight...

CVE-2026-90235

A flaw was found in the xprtsock component of the Linux kernel's sunrpc implementation. This concurrency vulnerability arises from improper synchronization when updating and reading shared socket callback pointers. As a result, a processor might use an outdated reference to a callback function...

CVE-2026-90304

A flaw was found in the Linux kernel. When unhandled user faults are triggered, specifically by user programs executing the bkpt instruction with CONFIGPERFEVENTS=n disabled, the system attempts to send a signal with interrupts disabled. This can lead to system instability or a denial of service...

CVE-2026-90290

A flaw was found in the Linux kernel's hibernate functionality for arm64 architectures. When the system attempts to save memory tags during hibernation, a failure in this process can prevent the proper restoration of the Disable Asynchronous Interrupts and Fast interrupts DAIF state. This leaves...

CVE-2026-90332

A flaw was found in the Linux kernel's PCI dwc endpoint driver. This vulnerability occurs when the driver unmaps an Inbound Address Translation Unit iATU entry without ensuring that all pending Message Signaled Interrupts MSI writes have been flushed. This can lead to MSI writes being dropped or...

CVE-2026-90216

A flaw was found in the Linux kernel's Unsorted Block Images UBI subsystem. The ubiinitattach function, responsible for rolling back module initialization failures, incorrectly assumes that the parameter index matches the UBI device number. This can lead to a successfully attached device being...

CVE-2026-90190

A flaw was found in the nullblk module of the Linux kernel. A race condition occurs during initialization where a mutex is accessed before it is properly set up. A local attacker, by creating a directory in /sys/kernel/config/nullb/ at a specific time, could trigger this race condition. This coul...

CVE-2026-90147

A flaw was found in the Linux kernel's clock management subsystem. The devmclkgetoptionalenabledwithrate function registers its cleanup action prematurely, before successfully setting the clock rate. If the rate setting fails, the system attempts to disable and unprepare a clock that was never...

CVE-2026-90204

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 component. A local attacker could exploit a vulnerability where a corrupted filesystem metadata entry, specifically an append-DIO dinode, contains an out-of-range orphan slot value. The OCFS2 dinode validator fails to...

CVE-2026-90218

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA Connection Manager Assistant CMA component. During asynchronous address resolution, a programming error could lead to a warning assertion in the restort function. This occurs when a device acquisition fails, but the resource ...

CVE-2026-90185

A flaw was found in the Linux kernel's nullblk module. This vulnerability occurs because concurrent operations on configfs attributes are not properly synchronized. A local user could exploit this timing issue to modify data during device setup, leading to an out-of-bounds memory access. This cou...

CVE-2026-90052

A flaw was found in the Linux kernel's dm-integrity component. This vulnerability arises from an incorrect checksum calculation during the discard operation, specifically when the tag size is smaller than the digest size. This can lead to a buffer overflow, where data is written beyond the...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable

A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...