CVE-2026-90136

A flaw was found in the Linux kernel's AMD HSMP Host System Management Port hardware monitoring hwmon driver. A local user can trigger an issue by attempting to set a negative power cap value. Due to an incorrect conversion of this negative input, a nonsensical, extremely high power limit is sent...

CVE-2026-90202

A flaw was found in the Linux kernel's mpt3sas SCSI driver. The basereleasememorypools function attempts to free PCIe SGL Scatter-Gather List buffers that were never allocated, particularly after a partial setup failure. This can lead to a NULL pointer dereference, potentially causing a system...

CVE-2026-80898

A flaw was found in the netfs component of the Linux kernel. When a copy-to-cache append operation fails, the PGprivate2 state and its associated reference are not properly released. This oversight can lead to a resource leak, potentially causing system instability or a denial of service DoS...

CVE-2026-80897

A flaw was found in the netfs component of the Linux kernel. When netfspreparereaditerator processes readahead folios, it may fail to release these folios if an error occurs during the rollingbufferloadfromra operation. This oversight can lead to a memory leak, potentially allowing a local attack...

CVE-2026-80727

A flaw was found in the Linux kernel's x86 Machine Check Exception MCE handling. During the discovery of Corrected Machine Check Interrupts CMCI, a timer used for storm detection is modified before it is properly initialized. This improper timer setup can lead to kernel warnings and system...

CVE-2026-92493

A flaw was found in the Linux kernel's amd-pstate-ut driver. A local user can trigger a kernel NULL pointer dereference by loading the amdpstateut module on a non-AMD platform, such as an Intel system. This can lead to a system crash, resulting in a Denial of Service DoS...

CVE-2026-89894

A flaw was found in the Linux kernel's cx231xx media driver. A local attacker can exploit this vulnerability by manipulating video and Vertical Blanking Interval VBI queue operations. This allows for a heap out-of-bounds write, which could lead to arbitrary code execution or a denial of service...

CVE-2026-89777

A flaw was found in the Linux kernel's vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial o...

CVE-2026-90111

A flaw was found in the Linux kernel's IPv6 multicast routing ip6mr component. This use-after-free vulnerability occurs when a non-refcounted destination entry is improperly handled after being freed. A remote attacker could potentially exploit this by sending specially crafted IPv6 multicast...

CVE-2026-89791

A flaw was found in the Linux kernel's perf subsystem. A race condition exists between the perf mmap revival and the last munmap operation. This allows a local unprivileged user to exploit a use-after-free vulnerability, leading to local privilege escalation to root. Mitigation Mitigation for thi...

CVE-2026-90049

A flaw was found in the Linux kernel's networking subsystem. When the skbzerocopy function fails to orphan fragments, it incorrectly calls skbtxerror on the source skbuff skb. This premature completion of the zerocopy user argument and clearing of the SKBFLSHAREDFRAG flag can lead to a condition...

CVE-2026-89811

A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler MES fails to perform a necessary Translation Lookaside Buffer TLB invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access...

CVE-2026-90315

A flaw was found in the Linux kernel's PCI/sysfs legacy I/O and memory handlers. These handlers failed to enforce kernel lockdown, a security mechanism designed to prevent privileged users from performing certain low-level operations. A local root user could exploit this by writing to arbitrary I...

CVE-2026-90036

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...

CVE-2026-90008

A flaw was found in the Linux kernel's megaraidsas component. The megasasmakeprpnvme function, which constructs a list of memory pages for data transfers, fails to verify the allocated buffer's boundaries. This can result in a buffer overrun, potentially leading to a system crash Denial of Servic...

CVE-2026-93161

A flaw was found in the Linux kernel's crypto: qat module. The qatalgxtsreversekey function expands sensitive Advanced Encryption Standard AES key material on the stack. This key material is not properly cleared and can remain in the stack frame, potentially allowing a local attacker to access it...

CVE-2026-98087

A flaw was found in the Linux kernel. A local user running real-time tasks can trigger a Denial of Service DoS due to improper handling of non-migratable tasks within the task scheduler. When a task is marked to prevent migration between processor cores, the scheduler fails to skip it and...

USN-8889-1 linux-oem-7.0 vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

USN-8889-1: Linux kernel (OEM) vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

USN-8888-1: Linux kernel (Azure) vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...