CVE-2026-90262 btrfs: retry verity reads for not-uptodate Merkle folios

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...

CVE-2026-90262 btrfs: retry verity reads for not-uptodate Merkle folios

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...

CVE-2026-90261 btrfs: zoned: flush active metadata block group at btree_writepages() start

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: flush active metadata block group at btreewritepages start btreewritepages writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block gro...

CVE-2026-90261 btrfs: zoned: flush active metadata block group at btree_writepages() start

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: flush active metadata block group at btreewritepages start btreewritepages writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block gro...

CVE-2026-90257

CVE-2026-90257 affects the Linux kernel 's Bluetooth virtio_bt driver. The function virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and passes the response to bt_dev_info() and hci_set_fw_info() as an unbounded "%s" string starting at skb->data + 1, withou...

CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

EUVD-2026-81850

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

CVE-2026-90246

AppArmor in the Linux kernel contains an integer overflow in the verify_tags() bounds check during policy blob validation. The 32-bit addition i + cnt wraps when an attacker-supplied count is near U32_MAX , bypassing the guard and causing an out-of-bounds read past a kcalloc allocation in the set...

CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

EUVD-2026-81839

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

EUVD-2026-81823

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90230 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90230

CVE-2026-90230 is a heap out-of-bounds read in the Linux kernel's NVMe target (nvmet) authentication path. The function nvmet_auth_negotiate() indexes a fixed idlist[60] array using host-supplied halen/dhlen fields (both u8, max 255) without validating the transfer length, allowing a malicious or...

CVE-2026-90230 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

EUVD-2026-81820

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

CVE-2026-90223 nfc: llcp: bound SNL TLV parsing to the skb and add length checks

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...