CVE-2026-90303

CVE-2026-90303 affects the Linux kernel on ARM architecture. When CONFIG_DEBUG_USER=y and the kernel command-line option user_debug=31 are active, a user fault can trigger show_pte() without holding any lock. If another thread in the same process concurrently calls munmap() , page table pages may...

EUVD-2026-81862

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

CVE-2026-90269 bpf: Reject load-acquire from pointers requiring fault protection

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

CVE-2026-90269

CVE-2026-90269 affects the Linux kernel BPF subsystem. The verifier fails to rewrite BPF_LOAD_ACQ (load-acquire) into a BPF_PROBE_MEM load, unlike a regular BPF_LDX . As a result, the JIT emits a plain load with no exception-table entry, so a page fault on that load panics the kernel instead of b...

CVE-2026-90269 bpf: Reject load-acquire from pointers requiring fault protection

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

CVE-2026-90264

CVE-2026-90264 is a race condition in the Linux kernel's btrfs filesystem that can cause a kernel BUG/panic . The bug occurs when a direct IO finishes short: the file's isize is reverted, which skips the ordered extent (OE) wait during subsequent buffered writeback. This allows a new OE to be ins...

EUVD-2026-81857

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

CVE-2026-90264 btrfs: always wait for ordered extents to avoid OE races

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

CVE-2026-90264 btrfs: always wait for ordered extents to avoid OE races

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

EUVD-2026-81843

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90250

CVE-2026-90250 is a null pointer dereference vulnerability in the Linux kernel's BPF/cgroup subsystem . The issue occurs when a BPF program using BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE replaces an empty prog via link_update. The root cause is that __cgroup_bpf_replace fails to allocate and assign the...

CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90229 nvme-apple: Destroy the admin queue on removal

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

EUVD-2026-81822

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-90229 nvme-apple: Destroy the admin queue on removal

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-90192 mailbox: qcom-cpucp: handle NULL data in send_data callback

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90192 mailbox: qcom-cpucp: handle NULL data in send_data callback

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

EUVD-2026-81785

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90192

CVE-2026-90192 affects the Linux kernel 's Qualcomm qcom-cpucp mailbox driver. The root cause is a NULL pointer dereference in qcom_cpucp_mbox_send_data(), which blindly dereferenced the data pointer when mailbox_clear_channel() invoked mbox_send_message() with NULL data to signal an RX channel c...