CVE-2026-90314 remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...

CVE-2026-90307 RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names

A flaw was found in XML::LibXML for Perl. A remote attacker could exploit this vulnerability when processing specially crafted XML node names containing incomplete UTF-8 character sequences. This can lead to an out-of-bounds read in heap memory, potentially causing the application to crash and...

CVE-2026-90291

CVE-2026-90291 is a use-after-free in the Linux kernel's module/dups subsystem, specifically in the lifetime handling of kmod_dup_req instances. The root cause is that the code relied on RCU to protect concurrent access, but kmod_dup_request_exists_wait() may hold a reference across a blocking wa...

CVE-2026-90285

This Linux kernel vulnerability affects the scsi qla2xxx driver. In qla2x00_sysfs_read_vpd(), a redundant second call to ha->isp_ops->read_optrom() is made after releasing optrom_mutex , unlike the first call which holds the mutex. This exposes the flash read to concurrent optrom operations...

CVE-2026-90285 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...

CVE-2026-90266

CVE-2026-90266 affects the btrfs zoned filesystem in the Linux kernel. When btrfs_delayed_refs_rsv_refill() returns a transient -EAGAIN (triggered when over-committed metadata plus zone_unusable bytes exceeds the usable size in a metadata block-group), the transaction is aborted during block-grou...

CVE-2026-90266 btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge On a zoned FS, btrfsdelayedrefsrsvrefill returns -EAGAIN whenever the over-committed metadata plus the zoneunusable bytes exceeds the usable size in a...

CVE-2026-90266 btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge On a zoned FS, btrfsdelayedrefsrsvrefill returns -EAGAIN whenever the over-committed metadata plus the zoneunusable bytes exceeds the usable size in a...

EUVD-2026-81859

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge On a zoned FS, btrfsdelayedrefsrsvrefill returns -EAGAIN whenever the over-committed metadata plus the zoneunusable bytes exceeds the usable size in a...

CVE-2026-90263 btrfs: check if root is readonly when setting posix acl

In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs r...

EUVD-2026-81856

In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs r...

EUVD-2026-81855

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...

CVE-2026-90262 btrfs: retry verity reads for not-uptodate Merkle folios

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...

CVE-2026-90262 btrfs: retry verity reads for not-uptodate Merkle folios

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...

CVE-2026-90261 btrfs: zoned: flush active metadata block group at btree_writepages() start

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: flush active metadata block group at btreewritepages start btreewritepages writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block gro...

CVE-2026-90261 btrfs: zoned: flush active metadata block group at btree_writepages() start

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: flush active metadata block group at btreewritepages start btreewritepages writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block gro...

CVE-2026-90257

CVE-2026-90257 affects the Linux kernel 's Bluetooth virtio_bt driver. The function virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and passes the response to bt_dev_info() and hci_set_fw_info() as an unbounded "%s" string starting at skb->data + 1, withou...

CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

EUVD-2026-81850

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...