CVE-2026-90009 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-90009 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

EUVD-2026-80617

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-90009

CVE-2026-90009 is a TOCTOU (time-of-check to time-of-use) race condition in the Linux kernel's scsi: bsg subsystem, specifically in scsi_bsg_uring_cmd() during io_uring passthrough command setup. The function reads bsg_uring_cmd fields from a shared mmap'd SQE; a local attacker with low privilege...

EUVD-2026-80609

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-90001 HID: bpf: serialize device reference release in struct_ops destroy path

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-89917

A race condition in the Linux kernel's KVM arm64 hypervisor exists between the VNCR TLB invalidation path (which runs under the MMU lock) and vcpu_put() 's VNCR unmapping (which does not). The TOCTOU pattern on the TLB path checks vncr_tlb::cpu before unmapping, while this_cpu_reset_vncr_fixmap()...

CVE-2026-89917 KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

EUVD-2026-80517

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

CVE-2026-89917 KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

CVE-2024-11222

GitLab CE/EE is affected by a Time-of-check Time-of-use (TOCTOU) race condition in pipeline creation, impacting versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 . Under certain conditions, a developer user could perform actions in the context of another user's merge re...

CVE-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

CVE-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

CVE-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

CVE-2026-89917: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

PT-2026-93558

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the KVM arm64 component between VNCR TLB invalidation and the vcpu put function during VNCR page unmapping. The issue arises because TLB invalidation occurs...

CVE-2024-11222: Time-of-check Time-of-use (TOCTOU) Race Condition

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

CVE-2026-90009: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

PT-2026-93650

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Time-of-Check to Time-of-Use TOCTOU issue exists in the scsi bsg uring cmd function. The function reads bsg uring cmd from a shared memory-mapped Submission Queue Entry SQE. A user can...

Linux Distros Unpatched Vulnerability : CVE-2026-90009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd...