CVE-2026-90399

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This vulnerability stems from incorrect memory handling within the macphycapsparse function. When processing certain data packets from firmware, specifically short Type-Length-Value TLV structures, the driver attempts to write more data...

CVE-2026-90398

A flaw was found in the Linux kernel ath11k Wi-Fi driver. This vulnerability occurs in the macphycapsparse function due to a mismatch between the allocated memory size and the size used for copying data. When processing certain firmware messages, the driver attempts to write information beyond th...

CVE-2026-90397

A flaw was found in the Linux kernel's Qualcomm qcom Secure Channel Manager SCM firmware component. This vulnerability allows for a NULL pointer dereference due to improper initialization of a shared memory pointer. An attacker could exploit this timing issue, potentially leading to a system cras...

CVE-2026-90394

A flaw was found in the sc2731charger driver within the Linux kernel. This vulnerability occurs because the driver fails to properly cancel scheduled work during its removal process. When the driver is unregistered, it does not ensure that pending or running tasks are terminated before its...

CVE-2026-90395

A flaw was found in the Linux kernel's isp1704charger driver. When the driver is removed, it unregisters the USB notifier and power supply without ensuring that all scheduled work has completed. This improper resource cleanup can lead to the power supply state being torn down while operations are...

CVE-2026-90393

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter component. This vulnerability arises from a race condition in the bpfnetnslinkupdateprog function, where checks are performed without proper locking. A local attacker could exploit this to trigger a Use-After-Free UAF condition,...

CVE-2026-90392

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local attacker could exploit a Use-After-Free UAF vulnerability by concurrently replacing a BPF program while its information is being read without proper locking. This could allow the attacker to achieve privilege...

CVE-2026-90388

A flaw was found in the Linux kernel's IOMMU/DMA subsystem. The non-blocking, non-coherent allocation path did not directly check the result of dmaallocfrompool for allocation failures. This oversight could lead to the use of unallocated memory for IOMMU mapping, potentially causing memory...

CVE-2026-90383

A flaw was found in the Linux kernel's SGI GRU Graphics Resource Unit TLB Translation Lookaside Buffer miss handler. This handler incorrectly walks a process's page tables without holding necessary locks or references, and uses kernel page-table accessors on user page tables. This could allow a...

CVE-2026-90382

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. When operating in monitor mode with the fcsfail filter enabled, a remote attacker could send corrupted wireless frames. These frames, if reporting an invalid length, would trigger a kernel warning. If the system is configured to panic on...

CVE-2026-90380

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. A use-after-free vulnerability occurs due to a race condition in the mt76rxpollcomplete function. This can happen when a Wi-Fi station STA is removed, but the system still attempts to access its associated wireless client ID wcid. An...

CVE-2026-90379

A flaw was found in the Linux kernel's Wi-Fi driver mt76. This vulnerability occurs when a PCIe Advanced Error Reporting AER error causes the bus to become unresponsive. The driver then attempts to read registers, receiving an invalid value that corrupts its internal memory management. This...

CVE-2026-90377

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This issue affects the Receive Reorder Offload RRO 3.0 data queuing mechanism. Incorrect handling of received data frames can cause them to stall and be reordered within the driver. This can lead to a denial of service or data integrity...

CVE-2026-90376

A flaw was found in the MediaTek mt76 Wi-Fi driver within the Linux kernel. An incorrect Multi-Link Device MLD ID in the MAC Transmit Descriptor TXD and Host Interface Transmit Packet HIF TXP can cause the firmware to enter a busy loop. This issue occurs when a third MLD link is in power saving...

CVE-2026-90375

A flaw was found in the Wi-Fi mt76 driver of the Linux kernel. This vulnerability arises from incorrect accounting of non-AQL Atheros Quality of Service packets for Multi-Link Operation MLO stations. Specifically, the mt76txqueueskb function can misattribute packet counts, leading to an inflated...

CVE-2026-90374

A flaw was found in the Linux kernel's mt76 wifi driver. This vulnerability occurs due to improper validation of the bandidx field, which is used to index an array. A malicious actor could provide a corrupt or reserved descriptor value, leading to an out-of-bounds access or a NULL pointer...

CVE-2026-90373

A flaw was found in the Linux kernel's mt76 wireless driver, specifically within the mt7915 module. The mt7915removeinterface function cleared a Wireless Client ID wcid mask bit without proper locking mechanisms and before clearing the associated RCU Read-Copy-Update pointer. This oversight creat...

CVE-2026-90372

A flaw was found in the Linux kernel's mt76 WiFi driver, affecting mt7915 devices. A remote attacker, by sending a specially crafted VHT/HE MCS map with no supported spatial streams, can trigger an integer underflow in the mt7915mcugetstanss function. This results in an incorrect value being...

CVE-2026-90371

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability is a race condition that occurs during the recycling of RXDMADC buffers. These buffers are associated with different Network Adapter Programming Interface NAPI instances, and a direct recycling method can lead to a timin...

CVE-2026-90370

A flaw was found in the kernel. Specifically, within the mt76 Wi-Fi driver's mt7996mcugetchipconfig function, a malformed firmware response containing a zero-length Type-Length-Value TLV could cause an infinite loop. This issue occurs during device initialization and can lead to a system hang,...