CVE-2026-90409 drm/panthor: Add vm_bind region with kbo range overlap check

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Add vmbind region with kbo range overlap check When a VM is created, caller has to specify the range of the address space carve-out set aside for mapping kernel BO's. That means vmbind mappings of UM-exposed BO's...

CVE-2026-90199 fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

CVE-2026-90196 ASoC: SOF: validate topology volume range before allocation

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

EUVD-2026-81789

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

CVE-2026-90176 ksmbd: Do not skip lock checks for single-byte ranges

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

EUVD-2026-81769

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

CVE-2026-90114

This Linux kernel vulnerability affects the net: bridge subsystem. A pair of descending VLAN and tunnel IDs can pass the tunnel range span check because the VLAN subtraction produces a negative signed int, which is implicitly converted to unsigned when compared against the u32 tunnel ID delta. Wh...

EUVD-2026-81957

In the Linux kernel, the following vulnerability has been resolved: fuse: invalidate the correct range after OAPPEND direct write fusedirectwriteiter captures pos before genericwritechecks, which moves kipos to EOF for OAPPEND writes: fusedirectwriteiter pos = iocb-kipos; / 0 user-supplied /...

kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL

A flaw was found in the Linux kernel's ice driver. A malicious virtual function VF can provide an out-of-range 'ptype' value through the VIRTCHNL interface. This can lead to a write past the end of an allocated memory region, causing a kernel page fault and resulting in a Denial of Service DoS...

kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL

A flaw was found in the Linux kernel's ice driver. A malicious virtual function VF can provide an out-of-range 'ptype' value through the VIRTCHNL interface. This can lead to a write past the end of an allocated memory region, causing a kernel page fault and resulting in a Denial of Service DoS...

CVE-2026-90409: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Add vmbind region with kbo range overlap check When a VM is created, caller has to specify the range of the address space carve-out set aside for mapping kernel BO's. That means vmbind mappings of UM-exposed BO's...

CVE-2026-90350: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

CVE-2026-92478: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFSMAXLANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated...

CVE-2026-93045: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...

CVE-2026-93177: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...

CVE-2026-93085: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...

CVE-2026-90199: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

CVE-2026-90176: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

PT-2026-94524

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ksmbd module, the check lock range function incorrectly handles single-byte ranges because it uses inclusive ranges. When the start and end offsets are equal, the system treats it...

Weather Data Spoofing Attacks on Rain-Adaptive Millimeter-Wave Frequency Selection in V2X Communication Networks

Connected vehicles use millimeter-wave mmWave sidelinks for the data rates cooperative driving demands, and emerging designs select the carrier band from sensed rainfall. We show that this weather awareness is an attack surface: an adversary who spoofs only the rainfall input dictates the victim'...