CVE-2026-90285

This Linux kernel vulnerability affects the scsi qla2xxx driver. In qla2x00_sysfs_read_vpd(), a redundant second call to ha->isp_ops->read_optrom() is made after releasing optrom_mutex , unlike the first call which holds the mutex. This exposes the flash read to concurrent optrom operations...

EUVD-2026-81878

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...

CVE-2026-90285 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...

CVE-2026-90285 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...

CVE-2026-90284

This Linux kernel vulnerability affects the firmware_loader subsystem, specifically the fw_load_sysfs_fallback() function. A race condition exists because device_add() publishes the sysfs loading interface before the firmware request is added to pending_fw_head. A userspace helper discovering the...

EUVD-2026-81857

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

CVE-2026-90264 btrfs: always wait for ordered extents to avoid OE races

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

CVE-2026-90264 btrfs: always wait for ordered extents to avoid OE races

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

CVE-2026-90264

CVE-2026-90264 is a race condition in the Linux kernel's btrfs filesystem that can cause a kernel BUG/panic . The bug occurs when a direct IO finishes short: the file's isize is reverted, which skips the ordered extent (OE) wait during subsequent buffered writeback. This allows a new OE to be ins...

CVE-2026-90248 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix teardown of an adopted proto on insert-race loss In tcnewtfilter the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique. When the caller loses the race another request inserted a proto a...

EUVD-2026-81841

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix teardown of an adopted proto on insert-race loss In tcnewtfilter the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique. When the caller loses the race another request inserted a proto a...

CVE-2026-90248 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix teardown of an adopted proto on insert-race loss In tcnewtfilter the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique. When the caller loses the race another request inserted a proto a...

CVE-2026-90244 iommu/dma: Restore locking around msi_page_list

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...

CVE-2026-90244

CVE-2026-90244 is a race condition in the Linux kernel's iommu/dma subsystem affecting the VFIO type1 legacy container . When an IOMMU publishes IOMMU_RESV_SW_MSI (e.g., ARM SMMU ), two devices sharing the same merged domain can concurrently enter iommu_dma_get_msi_page() under different group mu...

EUVD-2026-81837

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...

CVE-2026-90244 iommu/dma: Restore locking around msi_page_list

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...

CVE-2026-90243

CVE-2026-90243 is a race condition in the Linux kernel's VT-d IOMMU driver. The function copied_context_tear_down() zeroes a 128-bit context entry while the Present bit is still set , creating a window where the IOMMU hardware can fetch a torn entry —some fields zeroed while Present remains set. ...

CVE-2026-90243 iommu/vt-d: Clear Present bit before tearing down copied context entry

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copiedcontextteardown zeroes the 128-bit context entry with contextclearentry while the Present bit is still set, and only then issues the context-cache and...

EUVD-2026-81836

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copiedcontextteardown zeroes the 128-bit context entry with contextclearentry while the Present bit is still set, and only then issues the context-cache and...

CVE-2026-90224 nfc: nci: fix double completion race in nci_data_exchange_complete

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in ncidataexchangecomplete nciclosedevice and ncirxwork can both call ncidataexchangecomplete concurrently. After commit 4527025d440ce8 "nfc: nci: fix circular locking dependency in...