CVE-2026-90435 RDMA/mlx5: Fix integer overflow of user QP buffer size

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

CVE-2026-90372 wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915mcugetstanss If a peer's VHT/HE MCS map has no supported spatial stream all fields 0x3, the loop exits with nss == 0 and the function returned u8-1 255, which was then written into...

CVE-2026-90341 firmware: coreboot: Validate table bounds

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboottablepopulate bounds checks limit individual entries to the mapped length. However, coreboottableprobe replaces the platform resource length with header and table siz...

CVE-2026-90274 coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of nrseqstate - 1 According to IHI006H Embedded Trace Macrocell Architecture Specification0, TRCSEQEVR is implemented only when TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0...

CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

CVE-2026-90246

AppArmor in the Linux kernel contains an integer overflow in the verify_tags() bounds check during policy blob validation. The 32-bit addition i + cnt wraps when an attacker-supplied count is near U32_MAX , bypassing the guard and causing an out-of-bounds read past a kcalloc allocation in the set...

CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

EUVD-2026-81839

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

CVE-2026-90245 fbdev: kyro: Validate overlay viewport coordinates

In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wra...

CVE-2026-90200 fs/ntfs3: fix integer overflow in MFT cluster validation

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

CVE-2026-90200

CVE-2026-90200 affects the Linux kernel NTFS3 filesystem driver (fs/ntfs3). In ntfs_init_from_boot(), the MFT cluster numbers (mlcn, mlcn2) read from the boot sector are validated via a u64 multiplication against the volume size. A sufficiently large value (e.g., near 2^62) causes the multiplicat...

EUVD-2026-81793

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

CVE-2026-90200 fs/ntfs3: fix integer overflow in MFT cluster validation

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

CVE-2026-90199

CVE-2026-90199 affects the Linux kernel's fs/ntfs3 filesystem driver in the mi_enum_attr() function. When the end virtual cluster number (evcn ) equals U64_MAX , the expression evcn + 1 wraps to zero, causing any start VCN to pass the boundary check. A malformed on-disk NTFS3 attribute with svcn ...

CVE-2026-90199 fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

CVE-2026-90196 ASoC: SOF: validate topology volume range before allocation

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

EUVD-2026-81789

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

CVE-2026-90196

CVE-2026-90196 affects the Linux kernel 's ASoC SOF (Sound Open Firmware) subsystem. SOF treats topology mixer min and max values as non-negative indices into its volume table but stores them in signed fields and allocates max + 1 entries through an int argument . An inverted range is invalid, an...

CVE-2026-90141 ipvs: fix integer overflow in ftp helper port/address parsing

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ipvsftpgetaddrport accumulates decimal digits into a u16 hport and into unsigned char p without checking for overflow. A crafted FTP PASV/EPSV response with an over-lo...

EUVD-2026-81734

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ipvsftpgetaddrport accumulates decimal digits into a u16 hport and into unsigned char p without checking for overflow. A crafted FTP PASV/EPSV response with an over-lo...