CVE-2026-90185

This Linux kernel vulnerability affects the null_blk driver's configfs attribute store path. The NULLB_DEVICE_ATTR _store handlers fail to take the device lock, so concurrent stores on separate file descriptors race . For apply_fn attributes (submit_queues, poll_queues), a losing store can overwr...

EUVD-2026-81777

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

CVE-2026-90184

CVE-2026-90184 is a race condition in the Linux kernel's null_blk block device driver. Configfs attribute store methods (e.g., for zoned) run concurrently with null_add_dev() without holding a lock, allowing device configuration to change mid-setup. This can lead to a failed device setup (-EIO vi...

CVE-2026-90184 null_blk: serialize configfs attribute updates with device setup

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

CVE-2026-90184 null_blk: serialize configfs attribute updates with device setup

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

CVE-2026-90168

CVE-2026-90168 affects the ksmbd SMB server component of the Linux kernel . The root cause is a lifetime mismatch: deferred CHANGE_NOTIFY work retains an async message ID after the original request work is released. Because a durable handle can outlive its connection, connection teardown can dest...

EUVD-2026-81760

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pendingbreak wakes that waiter, but without serializing the...

CVE-2026-90167 ksmbd: serialize oplock close with pending break ownership

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pendingbreak wakes that waiter, but without serializing the...

CVE-2026-90167 ksmbd: serialize oplock close with pending break ownership

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pendingbreak wakes that waiter, but without serializing the...

CVE-2026-90167

CVE-2026-90167 is a race condition in the Linux kernel's ksmbd (SMB server) component. The close operation may abort an in-flight oplock break while another breaker already holds an opinfo reference. Without proper serialization, a waiter can become a new break owner via the test_and_set_bit() fa...

EUVD-2026-81755

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2lock, mid-batch granted locks are published to connection-wide conn-locklist and file-wide fp-locklist lists immediately upon vfslockfile success, while...

EUVD-2026-81717

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

CVE-2026-90124

This vulnerability affects the Linux kernel 's irqchip/renesas-rzg2l driver. The functions rzg2l_clear_irq_int() and rzg2l_clear_tint_int() perform a racy read-modify-write on the ISCR/TSCR status registers, which are write-0-to-clear per bit. If another interrupt's status bit is set between the ...

CVE-2026-90124 irqchip/renesas-rzg2l: Fix loss of interrupt

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

CVE-2026-90124 irqchip/renesas-rzg2l: Fix loss of interrupt

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

CVE-2026-90116

CVE-2026-90116 affects the Linux kernel's ALSA mtpav driver (MTP Audio). The vulnerability is a race condition during card teardown: the timer callback snd_mtpav_output_timer() can execute on another CPU after snd_mtpav_free() releases the spinlock, accessing card-private mtpav state that is bein...

CVE-2026-90116 ALSA: mtpav: shut down output timer before card teardown

In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown sndmtpavoutputtimer rearms chip-timer while holding chip-spinlock and accesses the card-private mtpav state. sndmtpavfree currently takes the same lock and calls timerdelet...

CVE-2026-90106

CVE-2026-90106 is a Linux kernel vulnerability in the network bridge ARP/ND proxy subsystem. The root cause is that the neighbour hardware address (neigh ha) is read directly from memory, which can result in torn or partial reads if the neighbour entry is being updated concurrently. The fix repla...

CVE-2026-90105

CVE-2026-90105 is a Linux kernel vulnerability in the vxlan subsystem. The arp/neigh_reduce function reads the neighbor hardware address directly, which can lead to partial reads while the neighbor entry is concurrently being updated. The fix replaces direct reads with neigh_ha_snapshot, which ta...

CVE-2026-90105 vxlan: fix reading neigh ha

In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neighreduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address similar to...