CVE-2026-90011

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds MAXKEYVALUEPAIRS, but the test is '' and login-reqbuf is allocated with exactly...

CVE-2026-90009

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-90008

In the Linux kernel, the following vulnerability has been resolved: scsi: megaraidsas: Limit NVMe request size to the PRP chain frame megasasmakeprpnvme builds a command's PRP list in cmd-sgframe, a DMA pool buffer of instance-maxchainframesz bytes, spending one entry per NVMe page of the transfe...

CVE-2026-90007

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers with freeirq when requestirq fails. The rollback loop uses the failing index i for every iteration instead of th...

CVE-2026-90006

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: handle damonstop failure damonsamplemtierstop assumes its damonstop call will always successfully stops the two DAMON contexts. Hence it deallocates the two DAMON contexts after the damonstop call. However, i...

CVE-2026-90005

In the Linux kernel, the following vulnerability has been resolved: samples/damon/wsse: handle damonstart failure Patch series "samples/damon: handle damonstart,stop failures". All DAMON sample modules are not correctly handling failures from damonstart. Among those, mtier also has an additional...

CVE-2026-90004

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: handle region split failure in applyminnrregions damonapplyminnrregions repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes...

CVE-2026-90003

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-after-free during requeue PI On PREEMPTRT, FUTEXCMPREQUEUEPI can trigger a KASAN report slab-out-of-bounds in futexrequeuepicomplete invocation of rcuwaitwakeup. The futexq used by futexwaitrequeuepi is...

CVE-2026-90001

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-90002

In the Linux kernel, the following vulnerability has been resolved: ftrace: Take tracearray reference before accessing its ftraceops The trace instance files setftracefilter and setftracenotrace was updated to work with specific trace instances tracearrays. The issue is that when these files are...

CVE-2026-90000

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-89999

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

CVE-2026-89998

In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dmsetupmdqueue walks &md-tabledevices without...

CVE-2026-89997

In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in dmdestroy. The result is that the table is destroyed...

CVE-2026-89996

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89994

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsledmaengine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no...

CVE-2026-89995

In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dmadirectallocfrompool Commit 5b138c534fda "dma-direct: factor out a dmadirectallocfrompool helper" changed dmadirectallocfrompool to return the CPU address from dmaallocfrompool. That fits...

CVE-2026-89993

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...

CVE-2026-89991

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...

CVE-2026-89992

In the Linux kernel, the following vulnerability has been resolved: cpuidle: dtidlegenpd: kfree the original name allocation dtidlepdalloc kasprintfs the full node path, then points pd-name at kbasename of that string. dtidlepdfree kfrees pd-name, which is no longer the start of the allocation...