CVE-2026-90186 null_blk: reject per-device queue resize for shared tag set

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90186

CVE-2026-90186 affects the Linux kernel null_blk driver. When the module is loaded with shared_tags enabled, a per-device resize of submit_queues or poll_queues via configfs calls blk_mq_update_nr_hw_queues() on the shared tag set, shrinking hardware queue contexts. The resulting NULL hardware co...

EUVD-2026-81779

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90186 null_blk: reject per-device queue resize for shared tag set

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90177 bpf: Check pointer type for all atomic RMW paths

In the Linux kernel, the following vulnerability has been resolved: bpf: Check pointer type for all atomic RMW paths Atomic RMW verification records an instruction pointer type only when the current destination is PTRTOARENA. A second path can therefore reach the same instruction with an ordinary...

CVE-2026-90177

CVE-2026-90177 affects the BPF subsystem of the Linux kernel . The root cause is in atomic read-modify-write (RMW) verification: an instruction pointer type is recorded only when the destination is PTR_TO_ARENA, but a second code path can reach the same instruction with an ordinary pointer withou...

EUVD-2026-81765

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdmaacceptfailed error path of smbdirectacceptconnectrequest, the receive io posted just above is owned by the QP recvio is set to NULL after a successful post...

CVE-2026-90172

CVE-2026-90172 affects the SMB Direct (smbdirect) RDMA module in the Linux kernel . On the rdma_accept_failed error path of smbdirect_accept_connect_request(), memory pools and the recv_io slab cache were destroyed before the QP was drained via ib_drain_qp(). This left an outstanding recv_io obje...

CVE-2026-90172 smb: smbdirect: destroy QP before mem pools on accept failure

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdmaacceptfailed error path of smbdirectacceptconnectrequest, the receive io posted just above is owned by the QP recvio is set to NULL after a successful post...

CVE-2026-90165 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

CVE-2026-90165 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

EUVD-2026-81759

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

EUVD-2026-81758

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

CVE-2026-90166 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90165

CVE-2026-90165 is an invalid pointer dereference in the Linux kernel's ksmbd (SMB server) subsystem. The root cause is in ksmbd_launch_ksmbd_durable_scavenger(): when kthread_run() fails, server_conf.dh_task is set to an ERR_PTR() while durable_scavenger_running remains true . A subsequent call t...

CVE-2026-90164

CVE-2026-90164 affects the ksmbd (SMB server) subsystem in the Linux kernel . The root cause is that ksmbd_proc_init() returns void after a procfs or percpu_counter allocation failure, causing ksmbd_server_init() to continue with NULL per-CPU counters. On SMP systems , this leads to a NULL pointe...

CVE-2026-90164 smb/server: abort initialization when proc setup fails

In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems. ksmbdprocinit tears down partial state on a procfs or percpucounter...

CVE-2026-90164 smb/server: abort initialization when proc setup fails

In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems. ksmbdprocinit tears down partial state on a procfs or percpucounter...

EUVD-2026-81757

In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems. ksmbdprocinit tears down partial state on a procfs or percpucounter...

CVE-2026-90156

CVE-2026-90156 affects the ksmbd (SMB server) module in the Linux kernel . The vulnerability is a NULL pointer dereference in the lock rollback path: when vfs_lock_file() defers a lock, smb2_lock() places its ksmbd_lock on the rollback list before allocating and registering the asynchronous work....