CVE-2026-90268

CVE-2026-90268 is a memory management flaw in the Linux kernel 's SCSI sd driver. In sd_probe(), when sd_large_pool_create() fails after device_add(&sdkp->disk_dev) has already succeeded, the error path incorrectly calls kfree() on an already-registered device instead of unregistering it via s...

CVE-2026-90233

In the Linux kernel nvme-pci driver, per-NUMA-node descriptor DMA pools are created lazily during nvme_init_hctx_common() but are only released in nvme_remove(). Any probe failure occurring after the admin tag set is allocated unwinds through the out_disable label and nvme_pci_free_ctrl(), neithe...

CVE-2026-90233 nvme-pci: release descriptor pools on probe failure

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pools are created lazily from nvmeinithctxcommon once the admin tag set is allocated, but they are only destroyed in nvmeremove via...

Information Exposure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure via the Buffer pool. An attacker can access and manipulate host memory by leveraging sandboxed code to acquire ArrayBuffers from...

GHSA-X5QG-8PQ6-39H6 Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcqc-726x-5wfc This link is maintained to preserve external references. Original Description vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by...

Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcqc-726x-5wfc This link is maintained to preserve external references. Original Description vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by...

CVE-2026-92947

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive dat...

CVE-2026-92947 vm2 before 3.11.7 Memory Disclosure via Buffer Pool

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive dat...

CVE-2026-92947 vm2 before 3.11.7 Memory Disclosure via Buffer Pool

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive dat...

CVE-2026-92947

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive dat...

CVE-2026-92947

CVE-2026-92947 affects the vm2 Node.js sandboxing library prior to version 3.11.7 . The vulnerability arises because Node's shared Buffer pool is exposed to sandboxed code: sandboxed scripts can acquire ArrayBuffers from small allocations (e.g., Buffer.from, Buffer.concat), gaining read and write...

CVE-2026-92947 vm2 before 3.11.7 Memory Disclosure via Buffer Pool

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive dat...

CVE-2026-93158: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: sa2ul - stop probe if context pool creation fails saulprobe calls sainitmem to create the DMA pool used for security context buffers, but ignores its return value. If pool creation fails, probe still continues with DMA...

CVE-2026-92947: Exposure of Sensitive Information to an Unauthorized Actor

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive dat...

PT-2026-94954

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sa2ul crypto component where the sa ul probe function calls sa init mem to create a DMA Direct Memory Access pool for security context buffers but fails to check t...

PT-2026-94733

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1.3 Description An issue exists in the md/raid1 component where adding a new rdev to an existing RAID1 array with the serialize policy enabled can lead to a system crash. This occurs because the bind rdev to array...

CVE-2026-90371: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...

PT-2026-94581

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the nvme-pci component when a probe failure happens after the admin tag set is allocated. The per-NUMA-node descriptor DMA pools, which are created lazily via the...

PT-2026-94549

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the net: page pool component. The problem occurs due to a race condition during xa cmpxchg when page pool destroy executes page pool scrub concurrent...

CVE-2026-90388: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page and fills cpuaddr only on success. Do not rely on cpuaddr to detect...