47816 matches found
CVE-2026-90314
In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...
CVE-2026-90310
CVE-2026-90310 affects the Linux kernel 's xen/xenbus driver. A race condition exists where the xenstore watch thread (xenwatch ) can trigger xenbus_dev_changed() before the otherend_id field is initialized during device probe (e.g., on module load). The still-zeroed otherend_id is then misinterp...
EUVD-2026-81894
In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hbregion as the private data for the NEGOTIMEOUT and NEGOAPPROVE o2net handlers as soon as makeitem creates the configfs region. The...
CVE-2026-90293 IB/isert: post the full-feature receive buffers after session registration
In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...
CVE-2026-90293 IB/isert: post the full-feature receive buffers after session registration
In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...
CVE-2026-90286 drm/amdgpu/gfx6: Use PFP on the compute queues too
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...
CVE-2026-90285 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...
EUVD-2026-81878
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...
CVE-2026-90285 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...
CVE-2026-90285
This Linux kernel vulnerability affects the scsi qla2xxx driver. In qla2x00_sysfs_read_vpd(), a redundant second call to ha->isp_ops->read_optrom() is made after releasing optrom_mutex , unlike the first call which holds the mutex. This exposes the flash read to concurrent optrom operations...
CVE-2026-90284
This Linux kernel vulnerability affects the firmware_loader subsystem, specifically the fw_load_sysfs_fallback() function. A race condition exists because device_add() publishes the sysfs loading interface before the firmware request is added to pending_fw_head. A userspace helper discovering the...
EUVD-2026-81857
In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...
CVE-2026-90264
CVE-2026-90264 is a race condition in the Linux kernel's btrfs filesystem that can cause a kernel BUG/panic . The bug occurs when a direct IO finishes short: the file's isize is reverted, which skips the ordered extent (OE) wait during subsequent buffered writeback. This allows a new OE to be ins...
CVE-2026-90264 btrfs: always wait for ordered extents to avoid OE races
In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...
CVE-2026-90264 btrfs: always wait for ordered extents to avoid OE races
In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...
CVE-2026-90248 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix teardown of an adopted proto on insert-race loss In tcnewtfilter the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique. When the caller loses the race another request inserted a proto a...
EUVD-2026-81841
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix teardown of an adopted proto on insert-race loss In tcnewtfilter the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique. When the caller loses the race another request inserted a proto a...
CVE-2026-90248 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix teardown of an adopted proto on insert-race loss In tcnewtfilter the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique. When the caller loses the race another request inserted a proto a...
EUVD-2026-81837
In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...