CVE-2026-90352

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths that key off dev-hif2, which is not assigned until after the IRQ setup. If...

CVE-2026-90351

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached wedhif2 for the secondary function, leaving the device in an...

CVE-2026-90328

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-90318

In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fatscanlogstart leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fatscan. fatrebuildparent uses the directory entry to rebuild the...

CVE-2026-90309

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev-cqxa and invoke CQ completion or error callbacks outside the xarray lock. erdmadestroycq can erase the CQ from the xarray and free its queu...

CVE-2026-90307

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

CVE-2026-90292

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...

CVE-2026-90288

In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double ofnodeput on phy creation failure foreachchildofnodescoped releases the node reference on scope exit, so the explicit ofnodeputnp in the devmphycreate error path drops it twice. Drop the...

CVE-2026-90284

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: do not queue completed sysfs fallback requests fwloadsysfsfallback calls deviceadd before adding the fwpriv to pendingfwhead. deviceadd publishes the fallback loading interface, so a userspace helper which discove...

CVE-2026-90277

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmapcreate publishes mddev-bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb can initialize a new bitmap and flush it through helpers that use...

CVE-2026-90275

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover raid1takeover sets conf-arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier sees it stuck at 1...

CVE-2026-90272

In the Linux kernel, the following vulnerability has been resolved: perf: armpmuv3: Zero initialize hwid branch stack field PERFSAMPLEBRANCHHWINDEX is supported by BRBE so hwid is passed to userspace, but it's never set by the BRBE driver. Zero initialize it as it should be according to the docs:...

CVE-2026-90270

In the Linux kernel, the following vulnerability has been resolved: armmpam: Disable driver unbind to avoid UAF When a user unbinds an MSC and that MSC is the only MSC left for a component then the corresponding mpamcomponent will be freed. If the user then goes on to read the schemata file in th...

CVE-2026-90253

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only freed if sendcancel runs. A cancelled entry is leaked, as...

CVE-2026-90247

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

CVE-2026-90243

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copiedcontextteardown zeroes the 128-bit context entry with contextclearentry while the Present bit is still set, and only then issues the context-cache and...

CVE-2026-90242

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice enables IOPF for the new domain but never disables it for the old one. deviceblocktranslation, called at the start of the function, tears down...

CVE-2026-90239

In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: release partial allocations in isp4ifallocfwgpumem isp4ifallocfwgpumem allocates several GPU memory pools in sequence. If one of them fails, it jumps to errornomemory and returns -ENOMEM without releasing the...

CVE-2026-90236

In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...

CVE-2026-90229

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...