CVE-2026-90031

CVE-2026-90031 affects the Linux kernel's ene_ub6250 USB storage driver. The root cause is a race condition on the shared us->current_urb field: the delayed scan work (via usb_stor_Bulk_max_lun()) and the probe path (via ene_get_card_type()) both access it concurrently, with only the scan path...

CVE-2026-90031 usb-storage: ene_ub6250: fix race between scan work and probe

In the Linux kernel, the following vulnerability has been resolved: usb-storage: eneub6250: fix race between scan work and probe eneub6250probe calls usbstorprobe2, which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls enegetcardtype, which sends a...

CVE-2026-90031 usb-storage: ene_ub6250: fix race between scan work and probe

In the Linux kernel, the following vulnerability has been resolved: usb-storage: eneub6250: fix race between scan work and probe eneub6250probe calls usbstorprobe2, which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls enegetcardtype, which sends a...

CVE-2026-90022 usb: gadget: f_midi2: fix use-after-free in string attribute show path

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

CVE-2026-90020 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...

CVE-2026-90020

CVE-2026-90020 affects the Linux kernel USB gadget subsystem. The vulnerability is a race condition in gadget_dev_ioctl(): the function reads dev->gadget before acquiring dev->lock, but checks dev->state only after acquiring the lock. A concurrent bind can change the device state between...

CVE-2026-90001

A race condition in the Linux kernel HID BPF subsystem allows __hid_bpf_ops_destroy_device() and hid_bpf_unreg() to double-put the struct hid_device reference, freeing the device while hid_destroy_device() is still using it. The root cause is a TOCTOU flaw: the two paths run under different lock ...

CVE-2026-90002 ftrace: Take trace_array reference before accessing its ftrace_ops

In the Linux kernel, the following vulnerability has been resolved: ftrace: Take tracearray reference before accessing its ftraceops The trace instance files setftracefilter and setftracenotrace was updated to work with specific trace instances tracearrays. The issue is that when these files are...

CVE-2026-90002

CVE-2026-90002 is a use-after-free race condition in the Linux kernel's ftrace subsystem, specifically in the trace instance files set_ftrace_filter and set_ftrace_notrace. When these files are opened, a small race window exists where a concurrent rmdir of the trace instance can free the ftrace_o...

EUVD-2026-80610

In the Linux kernel, the following vulnerability has been resolved: ftrace: Take tracearray reference before accessing its ftraceops The trace instance files setftracefilter and setftracenotrace was updated to work with specific trace instances tracearrays. The issue is that when these files are...

CVE-2026-89998 dm: fix race when loading and unloading a table

In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dmsetupmdqueue walks &md-tabledevices without...

EUVD-2026-80606

In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dmsetupmdqueue walks &md-tabledevices without...

CVE-2026-89998

This Linux kernel vulnerability affects the Device Mapper (dm) subsystem. A race condition occurs when userspace issues two concurrent table-load ioctls where one succeeds and the other fails: dm_setup_md_queue walks &md->table_devices without holding a lock, racing against dm_table_destroy → ...

CVE-2026-89998 dm: fix race when loading and unloading a table

In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dmsetupmdqueue walks &md-tabledevices without...

CVE-2026-89997 dm: fix resume-vs-remove race

In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in dmdestroy. The result is that the table is destroyed...

CVE-2026-89997

CVE-2026-89997 affects the Linux kernel device-mapper (dm) subsystem . A race condition occurs when the resume and remove ioctls are issued simultaneously: the device may be resumed after being suspended in __dm_destroy, causing the table to be destroyed without invoking the postsuspend method. S...

CVE-2026-89997 dm: fix resume-vs-remove race

In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in dmdestroy. The result is that the table is destroyed...

EUVD-2026-80605

In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in dmdestroy. The result is that the table is destroyed...

CVE-2026-89985 memcg: keep folio's objcg same as its node

In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits t...

CVE-2026-89985 memcg: keep folio's objcg same as its node

In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits t...