CVE-2026-90192

CVE-2026-90192 affects the Linux kernel 's Qualcomm qcom-cpucp mailbox driver. The root cause is a NULL pointer dereference in qcom_cpucp_mbox_send_data(), which blindly dereferenced the data pointer when mailbox_clear_channel() invoked mbox_send_message() with NULL data to signal an RX channel c...

EUVD-2026-81779

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90186

CVE-2026-90186 affects the Linux kernel null_blk driver. When the module is loaded with shared_tags enabled, a per-device resize of submit_queues or poll_queues via configfs calls blk_mq_update_nr_hw_queues() on the shared tag set, shrinking hardware queue contexts. The resulting NULL hardware co...

CVE-2026-90184

CVE-2026-90184 is a race condition in the Linux kernel's null_blk block device driver. Configfs attribute store methods (e.g., for zoned) run concurrently with null_add_dev() without holding a lock, allowing device configuration to change mid-setup. This can lead to a failed device setup (-EIO vi...

EUVD-2026-81777

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

EUVD-2026-81765

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdmaacceptfailed error path of smbdirectacceptconnectrequest, the receive io posted just above is owned by the QP recvio is set to NULL after a successful post...

CVE-2026-90172

This vulnerability affects the Linux kernel smbdirect RDMA subsystem. In smbdirect_accept_connect_request(), the rdma_accept_failed error path destroyed memory pools and the recv_io slab cache before draining the QP, leaving a recv_io object still outstanding on the QP. This triggers a slab cache...

CVE-2026-90166

CVE-2026-90166 affects the Linux kernel's SMB server (ksmbd) . The vulnerability is a null pointer dereference in ksmbd_ipc_tree_connect_request(), triggered when kstrdup() in ksmbd_share_config_get() fails and returns NULL for share->name, which is then passed to strlen() without a null check...

EUVD-2026-81759

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90164

CVE-2026-90164 affects the ksmbd (SMB server) subsystem in the Linux kernel . The root cause is that ksmbd_proc_init() returns void after a procfs or percpu_counter allocation failure, causing ksmbd_server_init() to continue with NULL per-CPU counters. On SMP systems , this leads to a NULL pointe...

EUVD-2026-81757

In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems. ksmbdprocinit tears down partial state on a procfs or percpucounter...

CVE-2026-90156

CVE-2026-90156 affects the ksmbd (SMB server) module in the Linux kernel . The vulnerability is a NULL pointer dereference in the lock rollback path: when vfs_lock_file() defers a lock, smb2_lock() places its ksmbd_lock on the rollback list before allocating and registering the asynchronous work....

EUVD-2026-81749

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

CVE-2026-90149

CVE-2026-90149 is a NULL pointer dereference in the Linux kernel 's NFSv4/flexfiles subsystem. The flexfiles layout accepts NFSv4.0 data servers, but two code paths incorrectly assume the data server client has a session object (clp->cl_session). Unlike NFSv4.1+, an NFSv4.0 client has no sessi...

EUVD-2026-81742

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session...

CVE-2026-90148

CVE-2026-90148 affects the Linux kernel's NFSv4 subsystem. When nfs4_add_lease() races with a delegation return, it passes a potentially NULL priv argument to nfs4_delete_lease(), which eventually leads to a NULL pointer dereference in generic_setlease(). This can cause a kernel crash (panic). Th...

EUVD-2026-81741

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4deletelease in nfs4addlease When nfs4addlease races with a delegation return, it calls nfs4deletelease to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a...

EUVD-2026-81737

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dplldeviceops during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpllpinonpinregister, the dpll object stays alive with an empty...

CVE-2026-90144

CVE-2026-90144 is a NULL pointer dereference in the Linux kernel's DPLL subsystem (drivers/dpll/dpll_core.c). The race occurs when the last owner of a DPLL device unregisters while a foreign driver (e.g., ice ) still holds a pin via dpll_pin_on_pin_register(). A pin notification queued before the...

CVE-2026-90139

This vulnerability affects the Linux kernel FUSE (Filesystem in Userspace) module. The root cause is a NULL pointer dereference in fuse_fill_super_submount(): when fuse_iget() fails to allocate an inode (e.g., under memory pressure), the resulting NULL is passed unchecked to get_fuse_inode(), cau...