CVE-2026-90001

A race condition in the Linux kernel HID BPF subsystem allows __hid_bpf_ops_destroy_device() and hid_bpf_unreg() to double-put the struct hid_device reference, freeing the device while hid_destroy_device() is still using it. The root cause is a TOCTOU flaw: the two paths run under different lock ...

CVE-2026-90001 HID: bpf: serialize device reference release in struct_ops destroy path

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

EUVD-2026-80609

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-90002 ftrace: Take trace_array reference before accessing its ftrace_ops

In the Linux kernel, the following vulnerability has been resolved: ftrace: Take tracearray reference before accessing its ftraceops The trace instance files setftracefilter and setftracenotrace was updated to work with specific trace instances tracearrays. The issue is that when these files are...

CVE-2026-90001

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

EUVD-2026-80610

In the Linux kernel, the following vulnerability has been resolved: ftrace: Take tracearray reference before accessing its ftraceops The trace instance files setftracefilter and setftracenotrace was updated to work with specific trace instances tracearrays. The issue is that when these files are...

CVE-2026-90002

In the Linux kernel, the following vulnerability has been resolved: ftrace: Take tracearray reference before accessing its ftraceops The trace instance files setftracefilter and setftracenotrace was updated to work with specific trace instances tracearrays. The issue is that when these files are...

CVE-2026-89996 dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89996

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

EUVD-2026-80604

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89996 dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89996

CVE-2026-89996 affects the Linux kernel 's dma-heap subsystem. In DMA_HEAP_IOCTL_ALLOC, the file descriptor is installed into the caller's fd table via fd_install() before copy_to_user() completes. If copy_to_user() fails, the fd and its underlying dma-buf reference are leaked for the process lif...

CVE-2026-89991 bpf: Fix infinite loop in pcpu_freelist push with one possible CPU

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...

CVE-2026-89991

CVE-2026-89991 is a bug in the Linux kernel BPF subsystem affecting __pcpu_freelist_push(). When only one CPU is possible (e.g., CONFIG_SMP=n or nr_cpus=1), an NMI re-enters pcpu_freelist_push() while the interrupted context already holds that CPU's freelist lock. The fallback loop skips the curr...

CVE-2026-89991

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...

CVE-2026-89991 bpf: Fix infinite loop in pcpu_freelist push with one possible CPU

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...

EUVD-2026-80599

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...

CVE-2026-89987 mm/huge_memory: transfer the pmd dirty bit to the folio on zap

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: transfer the pmd dirty bit to the folio on zap zaphugepmdfolio propagates the pmd young bit to the folio for the file case, but not the dirty bit. The pte path does propagate it, in zappresentfolioptes and so does...

EUVD-2026-80595

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: transfer the pmd dirty bit to the folio on zap zaphugepmdfolio propagates the pmd young bit to the folio for the file case, but not the dirty bit. The pte path does propagate it, in zappresentfolioptes and so does...

CVE-2026-89987

CVE-2026-89987 affects the Linux kernel in the mm/huge_memory subsystem. The function zap_huge_pmd_folio() fails to propagate the PMD dirty bit to the folio when a PMD-mapped shmem/tmpfs page is unmapped, unlike the PTE path and PMD split path. This causes silent data loss for processes that stor...