CVE-2026-90335 tty: skip cdev_del() when no cdev is registered

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

EUVD-2026-81996

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

CVE-2026-90335

CVE-2026-90335 is a NULL-pointer dereference in the Linux kernel's TTY subsystem (serial core). When TTY device registration fails before a cdev is allocated, the serial core retains the port for use by setserial. On later removal, the NULL cdev slot is passed to cdev_del(), triggering the derefe...

CVE-2026-90334

In the Linux kernel, the following vulnerability has been resolved: tty: clear cdev pointer after cdevadd failure ttycdevadd drops the cdev reference when cdevadd fails, but leaves driver-cdevsindex pointing to freed memory. ttyunregisterdevice later passes that stale pointer to cdevdel, causing ...

CVE-2026-90334 tty: clear cdev pointer after cdev_add() failure

In the Linux kernel, the following vulnerability has been resolved: tty: clear cdev pointer after cdevadd failure ttycdevadd drops the cdev reference when cdevadd fails, but leaves driver-cdevsindex pointing to freed memory. ttyunregisterdevice later passes that stale pointer to cdevdel, causing ...

CVE-2026-90334

CVE-2026-90334 is a use-after-free vulnerability in the Linux kernel TTY subsystem. In tty_cdev_add() , when cdev_add() fails, the function drops the cdev reference but leaves driver->cdevs[index] pointing to freed memory. Later, tty_unregister_device() passes that stale pointer to cdev_del() ...

CVE-2026-90334 tty: clear cdev pointer after cdev_add() failure

In the Linux kernel, the following vulnerability has been resolved: tty: clear cdev pointer after cdevadd failure ttycdevadd drops the cdev reference when cdevadd fails, but leaves driver-cdevsindex pointing to freed memory. ttyunregisterdevice later passes that stale pointer to cdevdel, causing ...

EUVD-2026-81995

In the Linux kernel, the following vulnerability has been resolved: tty: clear cdev pointer after cdevadd failure ttycdevadd drops the cdev reference when cdevadd fails, but leaves driver-cdevsindex pointing to freed memory. ttyunregisterdevice later passes that stale pointer to cdevdel, causing ...

CVE-2026-90332

CVE-2026-90332 affects the Linux kernel 's PCI DesignWare (DWC) endpoint driver . When the Root Complex changes the MSI target address, dw_pcie_ep_raise_msi_irq() unmaps the existing iATU (internal Address Translation Unit) entry and reprograms it for the new address. However, unlike the already-...

EUVD-2026-81993

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush cached MSI write before unmapping the iATU The MSI-X path already flushes any posted MSI-X write before tearing down its iATU mapping. That was added by commit c22533c66cca "PCI: dwc: ep: Flush MSI-X write...

CVE-2026-90333

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

CVE-2026-90333

This CVE affects the dm-integrity target in the Linux kernel (standalone mode). The discard-block check in dm_integrity_rw_tag() treats a stored tag of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded, skipping HMAC verification. An attacker with raw write access to the backing devi...

CVE-2026-90333 dm-integrity: replace forgeable discard filler with a keyed sector marker

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

CVE-2026-90332 PCI: dwc: ep: Flush cached MSI write before unmapping the iATU

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush cached MSI write before unmapping the iATU The MSI-X path already flushes any posted MSI-X write before tearing down its iATU mapping. That was added by commit c22533c66cca "PCI: dwc: ep: Flush MSI-X write...

CVE-2026-90332 PCI: dwc: ep: Flush cached MSI write before unmapping the iATU

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush cached MSI write before unmapping the iATU The MSI-X path already flushes any posted MSI-X write before tearing down its iATU mapping. That was added by commit c22533c66cca "PCI: dwc: ep: Flush MSI-X write...

CVE-2026-90332

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush cached MSI write before unmapping the iATU The MSI-X path already flushes any posted MSI-X write before tearing down its iATU mapping. That was added by commit c22533c66cca "PCI: dwc: ep: Flush MSI-X write...

CVE-2026-90331

In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid-asus driver: - unchecked size in asusrawevent - unclean teardown of asusprobe on failure - possible use-after-free in asuspro...

CVE-2026-90331

CVE-2026-90331 affects the hid-asus driver in the Linux kernel . Multiple defects were identified: an unchecked size in asus_raw_event(), a possible use-after-free in asus_probe, unclean teardown on probe failure, sleeping calls in atomic context , and incorrect packet sizes sent to the keyboard ...

CVE-2026-90331 HID: asus: refactor the two workqueues and init sequence

In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid-asus driver: - unchecked size in asusrawevent - unclean teardown of asusprobe on failure - possible use-after-free in asuspro...

CVE-2026-90331 HID: asus: refactor the two workqueues and init sequence

In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid-asus driver: - unchecked size in asusrawevent - unclean teardown of asusprobe on failure - possible use-after-free in asuspro...