CVE-2026-90406

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: handle runtime PM resume failure in core deinit Check the return value of pmruntimeresumeandget in iriscoredeinit. If runtime PM resume fails, skip hardware power-off operations but still perform software...

CVE-2026-90373

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-90374

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

CVE-2026-92503

In the Linux kernel, the following vulnerability has been resolved: ext4: fix ABBA deadlock in ext4xattrinodecachefind Syzbot/stress-ng reported an ABBA deadlock in ext4 when exercising concurrent xattr workloads using the eainode mount/format option. The deadlock occurs between the running...

CVE-2026-90141

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ipvsftpgetaddrport accumulates decimal digits into a u16 hport and into unsigned char p without checking for overflow. A crafted FTP PASV/EPSV response with an over-lo...

CVE-2026-90148

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4deletelease in nfs4addlease When nfs4addlease races with a delegation return, it calls nfs4deletelease to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a...

CVE-2026-90154

In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...

CVE-2026-90164

In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems. ksmbdprocinit tears down partial state on a procfs or percpucounter...

CVE-2026-90181

In the Linux kernel, the following vulnerability has been resolved: ublk: avoid teardown retry loop on xarray allocation failure ublkshmemremoveranges removes matching maple tree ranges in batches, but first stores each range into a temporary xarray so that the pages can be unpinned after droppin...

CVE-2026-90190

In the Linux kernel, the following vulnerability has been resolved: nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsystem to userspace. A racing mkdir into /sys/kernel/config/nullb/ can...

CVE-2026-90112

In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions...

CVE-2026-90122

In the Linux kernel, the following vulnerability has been resolved: clk: visconti: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize onl...

CVE-2026-90138

In the Linux kernel, the following vulnerability has been resolved: vsock: don't check the listener's skerr in vsockaccept Syzbot reported an issue which can be reproduced with these steps: r0 = socketAFVSOCK, SOCKSTREAM, 0 bindr0, VMADDRCIDANY, PORT connectr0, VMADDRCIDLOCAL, PORT - -1, EPROTO...

CVE-2026-90380

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76rxpollcomplete A use-after-free issue occurs in mt76rxpollcomplete due to a race condition. The STA has already been removed, but the rxstatus still had a pointer to the wcid in the...

CVE-2026-90346

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: clean up color-change beacon data on errors nl80211colorchange calls nl80211parsebeacon for the beaconnext template, which can allocate params.beaconnext.mbssidies and .rnries. A parsing failure returned directly...

CVE-2026-90342

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock deadlock on arena lock failure Reported by the Sashiko AI review. arenavmfault returns VMFAULTRETRY when it can't take arena-spinlock, but it never took mmaplock. The fault path assumes a VMFAULTRETRY handler...

CVE-2026-90350

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

CVE-2026-90357

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev-twtlist before sending the agreement to the firmware, but the error path leaves it linked while flowidmask is never set. The flow slot...

CVE-2026-90258

In the Linux kernel, the following vulnerability has been resolved: pinctrl: airoha: add missed IRQ resource helpers Without hooking .irqrequestresources, gpiolib cannot set GPIODFLAGUSEDASIRQ. This breaks pin direction locking and can allow userspace or another driver to reconfigure an active IR...

CVE-2026-90211

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPFPROBEATOMIC and gets an exception table entry, but bpfjitprobeatomicpre on...