EUVD-2026-81952

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

CVE-2026-90091 Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

CVE-2026-90091 Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

CVE-2026-90085

CVE-2026-90085 affects the octeontx2-af driver in the Linux kernel . The function rvu_dbg_nix_tm_tree_display() dereferences pfvf->sq_ctx without verifying that the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tm_tree for a NIX logical function whose transmit queues a...

CVE-2026-90085 octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix NULL deref in NIX TM tree debugfs read path rvudbgnixtmtreedisplay dereferences pfvf-sqctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tmtree for a NIX LF...

CVE-2026-90085 octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix NULL deref in NIX TM tree debugfs read path rvudbgnixtmtreedisplay dereferences pfvf-sqctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tmtree for a NIX LF...

EUVD-2026-81946

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix NULL deref in NIX TM tree debugfs read path rvudbgnixtmtreedisplay dereferences pfvf-sqctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tmtree for a NIX LF...

CVE-2026-90084

CVE-2026-90084 affects the octeontx2-vf driver in the Linux kernel . A race condition exists in the probe/remove path: the VF workqueue was initialized after register_netdev(), meaning ndo_set_rx_mode could queue work on a NULL workqueue before initialization completed. The fix reorders the initi...

EUVD-2026-81941

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix NULL deref of afxdpzcqidx on rep setup afxdpzcqidx tracks receive queues using AFXDP zero-copy and is allocated during PF/VF probe. Representors and other non-AFXDP paths leave the pointer NULL, but several call...

CVE-2026-90080

In the Linux kernel , the octeontx2-pf driver (Mellanox OcteonTX2) contains a NULL pointer dereference on the af_xdp_zc_qidx bitmap. This pointer is allocated during PF/VF probe but remains NULL for representors and other non-AF_XDP paths. Several call sites invoked test_bit() on it unconditional...

CVE-2026-90080 octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix NULL deref of afxdpzcqidx on rep setup afxdpzcqidx tracks receive queues using AFXDP zero-copy and is allocated during PF/VF probe. Representors and other non-AFXDP paths leave the pointer NULL, but several call...

CVE-2026-90080 octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix NULL deref of afxdpzcqidx on rep setup afxdpzcqidx tracks receive queues using AFXDP zero-copy and is allocated during PF/VF probe. Representors and other non-AFXDP paths leave the pointer NULL, but several call...

CVE-2026-90066

CVE-2026-90066 affects the Linux kernel 's samples/ftrace module (ftrace-direct-multi-modify). The root cause is a missing IS_ERR() check on the return value of kthread_run() in ftrace_direct_multi_init(). When kthread_run() fails (e.g., returning ERR_PTR(-ENOMEM)), the module loads with simple_t...

EUVD-2026-81927

In the Linux kernel, the following vulnerability has been resolved: samples/ftrace: Fix kthreadstop on ERRPTR in ftrace-direct-multi-modify ftracedirectmultiinit assigns kthreadrun's return value to simpletsk without an ISERR check. When kthreadrun fails it returns ERRPTR-ENOMEM, but init still...

CVE-2026-90066 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

In the Linux kernel, the following vulnerability has been resolved: samples/ftrace: Fix kthreadstop on ERRPTR in ftrace-direct-multi-modify ftracedirectmultiinit assigns kthreadrun's return value to simpletsk without an ISERR check. When kthreadrun fails it returns ERRPTR-ENOMEM, but init still...

CVE-2026-90066 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

In the Linux kernel, the following vulnerability has been resolved: samples/ftrace: Fix kthreadstop on ERRPTR in ftrace-direct-multi-modify ftracedirectmultiinit assigns kthreadrun's return value to simpletsk without an ISERR check. When kthreadrun fails it returns ERRPTR-ENOMEM, but init still...

EUVD-2026-81921

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that...

CVE-2026-90060

CVE-2026-90060 affects the ALSA control subsystem in the Linux kernel . The kcontrol LED state layer naively assumes all associated kcontrol elements are readable, but a write-only element with no get callback (which can even be created by a user element) can trigger a NULL pointer dereference in...

CVE-2026-90060 ALSA: control: Don't add invalid kcontrols to LED layer

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that...

CVE-2026-90060 ALSA: control: Don't add invalid kcontrols to LED layer

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that...