CVE-2026-90138

In the Linux kernel, the following vulnerability has been resolved: vsock: don't check the listener's skerr in vsockaccept Syzbot reported an issue which can be reproduced with these steps: r0 = socketAFVSOCK, SOCKSTREAM, 0 bindr0, VMADDRCIDANY, PORT connectr0, VMADDRCIDLOCAL, PORT - -1, EPROTO...

CVE-2026-92525

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92517

In the Linux kernel, the following vulnerability has been resolved: bpf, riscv: Fix extable handling for arena loadacquire emitatomicldst returns 1 to have buildbody skip the zext after a sub-word loadacquire. The caller does "ret = ret ?: addexceptionhandler...", which skips addexceptionhandler ...

CVE-2026-90247

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

CVE-2026-90249

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

CVE-2026-90237

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

CVE-2026-90252

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync runs. A cancelled entry is leaked, as hcicmdsynccancelentry...

CVE-2026-90161

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

CVE-2026-90244

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...

CVE-2026-90238

In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: fix self-deadlock in isp4sdpwronandinit error path isp4sdpwronandinit holds opsmutex via guardmutex and, on any init failure, jumps to errdeinit and calls isp4sdpwroffanddeinit. That helper takes the same...

CVE-2026-90171

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: release pending child sockets outside the handler lock smbdirectsocketdestroy releases the listener's pending/ready child sockets while still holding the listener's handler lock, the &idpriv-handlermutex taken via...

CVE-2026-92509

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counterrelease When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end ...

CVE-2026-90258

In the Linux kernel, the following vulnerability has been resolved: pinctrl: airoha: add missed IRQ resource helpers Without hooking .irqrequestresources, gpiolib cannot set GPIODFLAGUSEDASIRQ. This breaks pin direction locking and can allow userspace or another driver to reconfigure an active IR...

CVE-2026-90259

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...

CVE-2026-92478

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFSMAXLANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated...

CVE-2026-93041

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dwedmaabortinterrupt drops vc.lock before changing request and status. issuepending can acquire the lock in that small window, observe the old busy state, and skip starting queued...

CVE-2026-90148

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4deletelease in nfs4addlease When nfs4addlease races with a delegation return, it calls nfs4deletelease to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a...

CVE-2026-90405

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: fix some error handling bugs in probe There are a few issues here: 1 After we assign: chan = dmarequestchan&pdev-dev, "tx"; Then the error paths need to clean up before returning. The first error path does a...

CVE-2026-90220

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90286

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...