CVE-2026-90269: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

PT-2026-94477

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtio balloon driver where the absence of a specific .shutdown handler allows the generic virtio bus shutdown process to break and reset the device while...

PT-2026-94714

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 driver where the mt7996 mcu beacon cntdwn function emits two bss bcn cntdwn tlv entries during an active CSA countdown, but the MT7996 BEACON UPDATE SIZE on...

CVE-2026-90432: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: schedext: Abort directly from the hardlockup handler scxhardlockup defers the abort to an irqwork because exit claiming used to take scxschedlock and couldn't run from NMI. The deferral is now unnecessary - claiming is NMI-safe a...

PT-2026-94431

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the act ife component of the network scheduler where the system incorrectly uses skb-dev-hard header len to determine the length of the Ethernet header during...

PT-2026-94540

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the qcom cpucp mbox send data function when it is invoked via the mailbox clear channel function under PREEMPT RT. The issue arises because mailbox...

PT-2026-94598

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null-pointer dereference occurs in the bpf and cgroup components when replacing a program. This happens when an empty program attached to a cgroup is replaced by a new program that...

PT-2026-94577

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-apple driver where the admin queue, allocated via blk mq alloc queue, is not properly destroyed during removal. When the controller fails to initialize and is...

CVE-2026-90229: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-90250: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-93135: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

PT-2026-94931

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the verifier skips rewriting the helper call offset insn-imm in bpf do misc fixups for architectures that implement bpf...

Linux Distros Unpatched Vulnerability : CVE-2026-61544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handsha...

CVE-2026-90382: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a...

PT-2026-94982

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CXL mailbox implementation where the out.size parameter is not bounded. When CXL MEM SEND COMMAND is used, the cxl mbox cmd ctor function calls kvzallocout.size...

CVE-2026-90232: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amtdeviceevent tries to unregister its upper AMT device, but it has two problems. 1. amtlookupupperdev looks up an upper device in the lower device's netn...

PT-2026-94401

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the packet classification path where the htb classify function does not bound the number of hops when following filter-selected inner classes. A filter on an inner cla...

PT-2026-94407

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the stmmac network driver where the conversion of the RX path to zero-copy failed to maintain the NET IP ALIGN in the RX DMA offset. On architectures where NET IP ALIG...

CVE-2026-90059: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: restore NETIPALIGN in the RX DMA offset Since the RX path was converted to zero-copy, the page pool page is handed to the stack directly as the skb head, and the offset the DMA engine writes at is what determines the...

PT-2026-94651

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the show pte function when CONFIG DEBUG USER=y and the user debug=31 command line option is enabled. This occurs because a user fault can trigger show pt...