CVE-2026-90834

The user-mode syscall verifiers for the 16-bit "wide data" UART API in drivers/serial/uarthandlers.c validated the wrong driver operation. zvrfyuartpolloutu16, zvrfyuarttxu16 and zvrfyuartrxenableu16 each ran KSYSCALLDRIVERUART against the 8-bit op pollout, tx, rxenable rather than the 16-bit op...

CVE-2026-90834

The user-mode syscall verifiers for the 16-bit "wide data" UART API in drivers/serial/uarthandlers.c validated the wrong driver operation. zvrfyuartpolloutu16, zvrfyuarttxu16 and zvrfyuartrxenableu16 each ran KSYSCALLDRIVERUART against the 8-bit op pollout, tx, rxenable rather than the 16-bit op...

CVE-2026-90834 UART wide-data syscall verifiers check the 8-bit driver op, allowing a user-mode thread to trigger a NULL function-pointer call in kernel mode

The user-mode syscall verifiers for the 16-bit "wide data" UART API in drivers/serial/uarthandlers.c validated the wrong driver operation. zvrfyuartpolloutu16, zvrfyuarttxu16 and zvrfyuartrxenableu16 each ran KSYSCALLDRIVERUART against the 8-bit op pollout, tx, rxenable rather than the 16-bit op...

CVE-2026-90834 UART wide-data syscall verifiers check the 8-bit driver op, allowing a user-mode thread to trigger a NULL function-pointer call in kernel mode

The user-mode syscall verifiers for the 16-bit "wide data" UART API in drivers/serial/uarthandlers.c validated the wrong driver operation. zvrfyuartpolloutu16, zvrfyuarttxu16 and zvrfyuartrxenableu16 each ran KSYSCALLDRIVERUART against the 8-bit op pollout, tx, rxenable rather than the 16-bit op...

CVE-2026-90834

In the Zephyr RTOS , a vulnerability exists in the user-mode syscall verifiers for the 16-bit ("wide data") UART API located in drivers/serial/uart_handlers.c. The verifiers z_vrfy_uart_poll_out_u16(), z_vrfy_uart_tx_u16(), and z_vrfy_uart_rx_enable_u16() incorrectly validate 8-bit operations ins...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc (crlsa-2026_49870)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202649870 advisory. kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 Bug Fixes and Enhancements: Possible regression with...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcpconnrequest bsc1235944 bsc1269731. CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync...

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225. CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull bsc1255531...

SUSE-SU-2026:4282-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-40277: drm/vmwgfx: Validate command header size against bsc1254894. - CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225. -...

SUSE CVE-2026-89798

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...

PT-2026-93439

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the rpcrdma module during notification registration. The function rpcrdma rn register inserts the rn object into the rd xa xarray using xa alloc before assigni...

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1269731. CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225...

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1235944 CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc125522...

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1269731. CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225...

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1235944 CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc125522...

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1235944 CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc125522...

PT-2026-82118

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the regmap sdw mbq poll busy function where the system attempts to call the readable reg callback without verifying if it is set. Because this callback is optional,...

CVE-2026-74738: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

CVE-2026-72342 net/mlx5e: Fix HV VHCA stats agent registration race

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats agent registration race mlx5ehvvhcastatscreate registers the stats agent through mlx5hvvhcaagentcreate. The helper publishes the agent in hvvhca-agentstype under agentslock and immediately schedules a...

CVE-2026-72092: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...