CVE-2026-90192: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-92493: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active The crash issue may occur when modprobe amdpstateut on intel platform. amdpstateut: 1 amdpstateutacpicpcvalid success! amdpstateut: 2 amdpstateutcheckenabled...

PT-2026-94428

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the octeontx2-pf driver when setting up representors. The af xdp zc qidx pointer, which tracks receive queues using AF XDP zero-copy, remains NULL fo...

PT-2026-94492

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the dpll device ops function during a teardown race condition. This happens when the last owner of a dpll device unregisters while another driver sti...

PT-2026-94463

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the xsk rcv function within the multi-buffer path. The issue occurs because xsk buff alloc is called in a loop without verifying its return value...

PT-2026-94504

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where smb2 lock adds a ksmbd lock to the rollback list before the asynchronous work is allocated and registered. If these operations fail, the rollbac...

PT-2026-94619

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the arm mpam module when a user unbinds a Memory System Component MSC after an error interrupt has triggered the mpam disable function. This happens...

CVE-2026-90374: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

CVE-2026-90156: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

CVE-2026-90271: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable se...

CVE-2026-93068: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

PT-2026-94576

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the nvmet execute identify ns zns function. This happens when a host sends an Identify command with CNS 05h and CSI 02h ZNS targeting a file-backed...

PT-2026-94550

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mpt3sas SCSI driver where the base release memory pools function unconditionally frees every entry in the ioc-pcie sg lookup array. This includes entries that were...

CVE-2026-90202: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warni...

CVE-2026-90426: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241cmdqvremove tears each VINTF down first, then calls freeirq. Tearing a VINTF down frees vintf0 and clears cmdqv-vintfs0. An error in that window makes...

CVE-2026-93107: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-90165: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

CVE-2026-90397: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...

CVE-2026-90430: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241vintfinitlvcmdq stores the freshly allocated vcmdq pointer to the vintf-lvcmdqs array, before tegra241vcmdqallocsmmucmdq builds the vcmdq-cmdq. Th...

CVE-2026-93038: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: dac: ad5686: missing NULL check on match data Verify that chipinfo pointer is not NULL. If a user binds the driver using driveroverride via sysfs with a device name not present in the idtable or ofmatchtable, match data will...