CVE-2026-97501

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction pinctrlgpiodirectioninput / pinctrlgpiodirectionoutput take the pinctrl mutex. This causes a gpiochip operations to need to sleep. Worse yet, the .cansleep...

PT-2026-97935

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/xe component where the kernel may be tainted due to an unexpected warning during driver unbind. When a device is wedged in mode 2 UPON ANY HANG NO RESET, a GSC...

Linux Distros Unpatched Vulnerability : CVE-2026-90232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amt: Don't support cross-netns setup. When a lower device is unregistered, amtdeviceevent tries to unregister its upper AMT device, but it has two problems. 1...

Linux Distros Unpatched Vulnerability : CVE-2026-90067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client...

Linux Distros Unpatched Vulnerability : CVE-2026-92485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix WARNING in bpftracinglinkrelease The trampoline could be corrupted by the blindly 'tr-flags = BPFTRAMPFTAILCALLCTX' in verifier. 1. A fexit attached to...

DEBIAN-CVE-2026-90067

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

SUSE CVE-2026-89973

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answer...

EUVD-2026-82221

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: camcc-sc8280xp: unregister CAMCCGDSCCLK With the introduction of syncstate support in the clk and pmdomain subsystems, the following warning happens when the unused clocks are shutdown in camcc-sc8280xp: 15.408367...

CVE-2026-93113

CVE-2026-93113 affects the Linux kernel clock driver camcc-sc8280xp for the Qualcomm SC8280XP SoC. With the introduction of sync_state support in the clk and pmdomain subsystems, the titan_top_gdsc power domain gets stuck in the 'on' state when unused clocks are shut down, triggering a kernel WAR...

CVE-2026-93111 bpf: Mark tracing_multi trampolines as ftrace managed

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark tracingmulti trampolines as ftrace managed Since tracingmulti link does not set ftracemanaged, it would fail to release the tracingmulti link when attaching tracingmulti link and then attaching fentry link. 3.714215...

CVE-2026-90218

CVE-2026-90218 affects the Linux kernel RDMA subsystem, specifically the rdma_restrack_add() path in drivers/infiniband/core/cma.c. During asynchronous address resolution in addr_handler(), if cma_acquire_dev_by_src_ip() fails, the resource is still unconditionally passed to rdma_restrack_add() w...

CVE-2026-90218 RDMA/cma: Fix WARNING in res_to_rt

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix WARNING in restort syzbot reported a WARNON!res-dev in restort triggered via addrhandler during asynchronous address resolution: " WARNING: drivers/infiniband/core/restrack.c:138 at restort+0x1c4/0x230 CPU1:...

CVE-2026-90190

CVE-2026-90190 affects the Linux kernel null_blk module. In null_init(), the call to mutex_init(&lock) occurs after configfs_register_subsystem(), which exposes the nullb subsystem to userspace. A racing mkdir() into /sys/kernel/config/nullb/ can reach null_find_dev_by_name() → mutex_lock(&lock) ...

CVE-2026-90190 null_blk: use DEFINE_MUTEX for the file-scope mutex

In the Linux kernel, the following vulnerability has been resolved: nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsystem to userspace. A racing mkdir into /sys/kernel/config/nullb/ can...

EUVD-2026-81783

In the Linux kernel, the following vulnerability has been resolved: nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsystem to userspace. A racing mkdir into /sys/kernel/config/nullb/ can...

EUVD-2026-81928

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

CVE-2026-90067 libceph: validate banner payload length

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

CVE-2026-90067 libceph: validate banner payload length

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

PT-2026-94538

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the null blk component, a race condition exists during initialization. The mutex init&lock function is called after configfs register subsystem, which exposes the nullb subsystem to...

PT-2026-94793

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the trampoline could be corrupted due to the incorrect assignment of tr-flags in the verifier. When a fexit is attached to a tail call reachabl...