EUVD-2026-81779

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90186 null_blk: reject per-device queue resize for shared tag set

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90186

CVE-2026-90186 affects the Linux kernel null_blk driver. When the module is loaded with shared_tags enabled, a per-device resize of submit_queues or poll_queues via configfs calls blk_mq_update_nr_hw_queues() on the shared tag set, shrinking hardware queue contexts. The resulting NULL hardware co...

CVE-2026-90186 null_blk: reject per-device queue resize for shared tag set

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90172

CVE-2026-90172 affects the SMB Direct (smbdirect) RDMA module in the Linux kernel . On the rdma_accept_failed error path of smbdirect_accept_connect_request(), memory pools and the recv_io slab cache were destroyed before the QP was drained via ib_drain_qp(). This left an outstanding recv_io obje...

CVE-2026-90172 smb: smbdirect: destroy QP before mem pools on accept failure

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdmaacceptfailed error path of smbdirectacceptconnectrequest, the receive io posted just above is owned by the QP recvio is set to NULL after a successful post...

EUVD-2026-81765

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdmaacceptfailed error path of smbdirectacceptconnectrequest, the receive io posted just above is owned by the QP recvio is set to NULL after a successful post...

CVE-2026-90166 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

EUVD-2026-81759

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90164

CVE-2026-90164 affects the ksmbd (SMB server) subsystem in the Linux kernel . The root cause is that ksmbd_proc_init() returns void after a procfs or percpu_counter allocation failure, causing ksmbd_server_init() to continue with NULL per-CPU counters. On SMP systems , this leads to a NULL pointe...

CVE-2026-90164 smb/server: abort initialization when proc setup fails

In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems. ksmbdprocinit tears down partial state on a procfs or percpucounter...

EUVD-2026-81757

In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems. ksmbdprocinit tears down partial state on a procfs or percpucounter...

CVE-2026-90164 smb/server: abort initialization when proc setup fails

In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems. ksmbdprocinit tears down partial state on a procfs or percpucounter...

CVE-2026-90156

CVE-2026-90156 affects the ksmbd (SMB server) module in the Linux kernel . The vulnerability is a NULL pointer dereference in the lock rollback path: when vfs_lock_file() defers a lock, smb2_lock() places its ksmbd_lock on the rollback list before allocating and registering the asynchronous work....

CVE-2026-90156 ksmbd: safely discard unregistered deferred locks

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

CVE-2026-90148 NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4deletelease in nfs4addlease When nfs4addlease races with a delegation return, it calls nfs4deletelease to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a...

EUVD-2026-81741

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4deletelease in nfs4addlease When nfs4addlease races with a delegation return, it calls nfs4deletelease to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a...

CVE-2026-90148 NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix incorrect argument passed to nfs4deletelease in nfs4addlease When nfs4addlease races with a delegation return, it calls nfs4deletelease to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a...

EUVD-2026-81732

In the Linux kernel, the following vulnerability has been resolved: fuse: check for NULL root inode in fusefillsupersubmount fuseiget can return NULL when its inode allocation fails, but fusefillsupersubmount passed the result straight to getfuseinode and decremented fi-nlookup without checking i...

CVE-2026-90139

This vulnerability affects the Linux kernel FUSE (Filesystem in Userspace) module. The root cause is a NULL pointer dereference in fuse_fill_super_submount(): when fuse_iget() fails to allocate an inode (e.g., under memory pressure), the resulting NULL is passed unchecked to get_fuse_inode(), cau...