EUVD-2026-81822

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-90229

CVE-2026-90229 affects the nvme-apple platform driver in the Linux kernel. The admin queue is allocated via blk_mq_alloc_queue() but never destroyed on controller removal: blk_mq_exit_queue() and blk_sync_queue() are never called, leaving the timeout timer and work armed on a freed queue. This ca...

CVE-2026-90173 smb: smbdirect: free completion queues with ib_free_cq()

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: free completion queues with ibfreecq smbdirectconnectiondestroyqp creates the send and receive completion queues with iballoccqany, which for IBPOLLWORKQUEUE arms an internal completion handler that runs...

CVE-2026-90113 netdevsim: update queue NAPI association on queue reset

In the Linux kernel, the following vulnerability has been resolved: netdevsim: update queue NAPI association on queue reset In netdevsim, receive queues struct nsimrq embed their own struct napistruct. When queue reset is performed e.g. via queuereset debugfs, nsimqueuestart swaps in a newly...

EUVD-2026-81706

In the Linux kernel, the following vulnerability has been resolved: netdevsim: update queue NAPI association on queue reset In netdevsim, receive queues struct nsimrq embed their own struct napistruct. When queue reset is performed e.g. via queuereset debugfs, nsimqueuestart swaps in a newly...

CVE-2026-90092 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...

CVE-2026-90092 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...

CVE-2026-90021

A flaw was found in the Linux kernel's USB MIDI gadget driver fmidi. When a sound card is not registered, a work queue item may not be properly initialized. This can lead to a warning and a potential system crash, resulting in a Denial of Service DoS for a local attacker...

CVE-2026-93149: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

CVE-2026-90229: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-93151: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...

CVE-2026-93152: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Use acquire/release for queue enabled state applenvmeinitqueue initializes queue state and then marks the queue enabled. The interrupt and request paths check enabled before using that queue state. The old wmb after...

AZL-101478 CVE-2026-89894 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

DEBIAN-CVE-2026-89894

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

AZL-101690 CVE-2026-89811 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

CVE-2026-89811

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

DEBIAN-CVE-2026-89811

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

CVE-2026-89955

A NULL pointer dereference vulnerability exists in the Linux kernel's s390/vfio-ap module. The race occurs when vfio_ap_mdev_probe_queue() creates the sysfs attribute group before the queue's driver data is set; a concurrent read of the status attribute then retrieves NULL via dev_get_drvdata() a...

CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-89894 media: cx231xx: reject geometry changes while the VBI queue is busy

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...