124229 matches found
CVE-2026-90308
CVE-2026-90308 is a use-after-free race condition in the Linux kernel's RDMA/erdma subsystem. AE QP fatal events and iWARP CM paths load queue pairs from dev->qp_xa and then reference them outside the xarray lock, while erdma_destroy_qp() can concurrently free those QP resources. The fix intro...
CVE-2026-90303
CVE-2026-90303 affects the Linux kernel on ARM architecture. When CONFIG_DEBUG_USER=y and the kernel command-line option user_debug=31 are active, a user fault can trigger show_pte() without holding any lock. If another thread in the same process concurrently calls munmap() , page table pages may...
CVE-2026-90303 ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...
EUVD-2026-81964
In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...
CVE-2026-90301 ocfs2: o2hb: quiesce negotiate handlers and timeout work
In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hbregion as the private data for the NEGOTIMEOUT and NEGOAPPROVE o2net handlers as soon as makeitem creates the configfs region. The...
CVE-2026-90301
CVE-2026-90301 is a use-after-free in the Linux kernel's OCFS2 file system heartbeat subsystem (o2hb ). The struct o2hb_region is exposed to o2net negotiate handlers before the heartbeat runtime is fully initialized, and can be freed while in-flight callbacks or delayed timeout work still referen...
CVE-2026-90302
CVE-2026-90302 is a use-after-free vulnerability in the Linux kernel's OCFS2 (Oracle Cluster File System 2) subsystem. The race occurs between heartbeat callbacks and o2net teardown : when configfs local-node teardown calls o2net_stop_listening(), a concurrent node-down event can still reach o2ne...
CVE-2026-90302 ocfs2: synchronize heartbeat callbacks with o2net teardown
In the Linux kernel, the following vulnerability has been resolved: ocfs2: synchronize heartbeat callbacks with o2net teardown Patch series "ocfs2: harden heartbeat teardown races". This series fixes two OCFS2 heartbeat/o2net teardown races found by KASAN. This patch of 2: Heartbeat callbacks sta...
EUVD-2026-81963
In the Linux kernel, the following vulnerability has been resolved: ocfs2: synchronize heartbeat callbacks with o2net teardown Patch series "ocfs2: harden heartbeat teardown races". This series fixes two OCFS2 heartbeat/o2net teardown races found by KASAN. This patch of 2: Heartbeat callbacks sta...
CVE-2026-90292
CVE-2026-90292 is a use-after-free in the Linux kernel's RDMA/siw subsystem, specifically in siw_accept() . When a QP supplied by userspace is already in the RTS state, the error cleanup path incorrectly drops a reference from the incoming CEP rather than the existing qp->cep, potentially free...
CVE-2026-90292 RDMA/siw: Fix use-after-free in siw_accept()
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...
EUVD-2026-81885
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...
CVE-2026-90292 RDMA/siw: Fix use-after-free in siw_accept()
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...
EUVD-2026-81884
In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...
CVE-2026-90291
CVE-2026-90291 is a use-after-free in the Linux kernel's module/dups subsystem, specifically in the lifetime handling of kmod_dup_req instances. The root cause is that the code relied on RCU to protect concurrent access, but kmod_dup_request_exists_wait() may hold a reference across a blocking wa...
CVE-2026-90291 module/dups: Fix use-after-free in kmod_dup_req lifetime handling
In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...
CVE-2026-90291 module/dups: Fix use-after-free in kmod_dup_req lifetime handling
In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...
CVE-2026-90284
This Linux kernel vulnerability affects the firmware_loader subsystem, specifically the fw_load_sysfs_fallback() function. A race condition exists because device_add() publishes the sysfs loading interface before the firmware request is added to pending_fw_head. A userspace helper discovering the...
CVE-2026-90284 firmware_loader: do not queue completed sysfs fallback requests
In the Linux kernel, the following vulnerability has been resolved: firmwareloader: do not queue completed sysfs fallback requests fwloadsysfsfallback calls deviceadd before adding the fwpriv to pendingfwhead. deviceadd publishes the fallback loading interface, so a userspace helper which discove...
EUVD-2026-81877
In the Linux kernel, the following vulnerability has been resolved: firmwareloader: do not queue completed sysfs fallback requests fwloadsysfsfallback calls deviceadd before adding the fwpriv to pendingfwhead. deviceadd publishes the fallback loading interface, so a userspace helper which discove...