EUVD-2026-81736

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

CVE-2026-90143 net: kcm: Hold RCU read lock while running BPF parser

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

EUVD-2026-81730

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...

CVE-2026-90137

CVE-2026-90137 is an out-of-bounds read in the hp-bioscfg platform driver of the Linux kernel. The PSWD_ENCODINGS parser reads password_obj[elem + pos_values] while copying supported password encodings from an ACPI package, but lacks a bounds check on the computed index. A malformed ACPI package ...

CVE-2026-90137 platform/x86: hp-bioscfg: fix password encoding bounds check

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...

CVE-2026-90137 platform/x86: hp-bioscfg: fix password encoding bounds check

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...

CVE-2026-90131 ntfs: serialize resident iomap reads with mrec_lock

In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize resident iomap reads with mreclock ntfsreadiomapbeginresident walks the MFT record through ntfsattrlookup - ntfsattrfind without taking ni-mreclock, while ntfsattrrecordresize, ntfsmakeroomforattr and...

CVE-2026-90124 irqchip/renesas-rzg2l: Fix loss of interrupt

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

EUVD-2026-81717

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

CVE-2026-90124 irqchip/renesas-rzg2l: Fix loss of interrupt

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

CVE-2026-90124

This vulnerability affects the Linux kernel 's irqchip/renesas-rzg2l driver. The functions rzg2l_clear_irq_int() and rzg2l_clear_tint_int() perform a racy read-modify-write on the ISCR/TSCR status registers, which are write-0-to-clear per bit. If another interrupt's status bit is set between the ...

CVE-2026-90117 ntfs: validate usa_ofs before preserving the update sequence number

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate usaofs before preserving the update sequence number When ntfsmftrecordalloc reuses a free mft record it reads the old update sequence number straight from the on-disk record: usn = le16 u8 m + le16tocpum-usaofs; He...

CVE-2026-90112 net: qlcnic: validate unified ROM sections before loading

In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions...

CVE-2026-90112 net: qlcnic: validate unified ROM sections before loading

In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions...

CVE-2026-90112

CVE-2026-90112 affects the qlcnic network driver in the Linux kernel . The unified ROM parser performs unchecked additions and multiplications when forming table and data boundaries, allowing malformed firmware values to wrap before being compared with the firmware size. Additionally, the loader ...

EUVD-2026-81705

In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions...

CVE-2026-90106

CVE-2026-90106 is a Linux kernel vulnerability in the network bridge ARP/ND proxy subsystem. The root cause is that the neighbour hardware address (neigh ha) is read directly from memory, which can result in torn or partial reads if the neighbour entry is being updated concurrently. The fix repla...

CVE-2026-90106 net: bridge: arp/nd proxy: fix reading neigh ha

In the Linux kernel, the following vulnerability has been resolved: net: bridge: arp/nd proxy: fix reading neigh ha Currently neigh ha address is read directly, but that can result in torn/partial reads if the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address...

EUVD-2026-81699

In the Linux kernel, the following vulnerability has been resolved: net: bridge: arp/nd proxy: fix reading neigh ha Currently neigh ha address is read directly, but that can result in torn/partial reads if the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address...

CVE-2026-90105 vxlan: fix reading neigh ha

In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neighreduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address similar to...