CVE-2026-90400: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

PT-2026-94650

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the OCFS2 heartbeat and o2net teardown process. When a local-node teardown occurs via o2net stop listening, heartbeat callbacks may remain registered. If a...

CVE-2026-90185: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

CVE-2026-90190: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsystem to userspace. A racing mkdir into /sys/kernel/config/nullb/ can...

CVE-2026-90285: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...

CVE-2026-93138: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpfgetbtfvmlinux bpfgetbtfvmlinux lazily parses the vmlinux BTF under the bpfverifierlock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing...

PT-2026-94708

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the regulator core where schedule delayed work utilizes system wq, a non-freezable workqueue. This allows the regulator init complete work function to execute...

CVE-2026-92501: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write fallback generic/746 started failing intermittently on ext3 no-extent inodes. The test triggers 'Page cache invalidation failure on direct I/O' warnings and subsequent fsync returns...

CVE-2026-93150: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Make nrdeadlinetasks an atomict The nrdeadlinetasks variable in the cpuset structure was introduced by commit 6c24849f5515 "sched/cpuset: Keep track of SCHEDDEADLINE task in cpusets". It is reported by sashiko 1 th...

PT-2026-94981

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASOC rt700-sdw component where the rt700 sdw remove function only drains jack detect work and jack btn check work if the rt700-hw init state bit is true. Because...

PT-2026-94405

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free read occurs in the slip receive buf function during a race condition with tty hangup. The tty ldisc hangup function calls ld-ops-hangup while holding only a read lo...

PT-2026-94728

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the mt76 rx poll complete function due to a race condition. This occurs when a Station STA has been removed, but the rx status still maintains a pointer ...

CVE-2026-90395: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier and power supply, but does not wait for queued or running work befor...

CVE-2026-90373: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-93162: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - cancel work on re-enable SR-IOV timeout The QAT reset worker queues SR-IOV reenable work using a workstruct and completion embedded in an on-stack adfsriovdevdata. If the completion wait times out, the reset worker...

CVE-2026-86861: Time-of-check Time-of-use (TOCTOU) Race Condition

pgAdmin 4's File Manager savefile endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.checkaccesspermission and then opened the file for writing with a plain open call. CVE-2026-7819 had previously hardened the separate file upload path by openi...

CVE-2026-90091: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

PT-2026-94533

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the null blk driver where configfs attribute stores are not properly serialized with a lock. This occurs because the NULLB DEVICE ATTR store does not utilize a lock,...

PT-2026-94927

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the dell-privacy platform driver for x86 architecture. The issue occurs when accessing the priv-features present variable without holding the list mutex, which...

PT-2026-94510

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the smb2 lock function of the ksmbd module. When processing an SMB2 LOCK request array, locks are published to the connection-wide conn-lock list and file-wide...