CVE-2026-98208

A flaw was found in the Linux kernel's SDIO UART driver. When registering a new device port while all available port slots are occupied, the driver fails to release an allocated transmit buffer during error handling. A local user could exploit this flaw by repeatedly triggering failed device...

MK4001MTD-USB-Bridge

MK4001MTD USB 브리지 Toshiba MK4001MTD 0.85인치 SDIO 마이크로드라이브를 USB 대용량 저장 장치로 연결하는 RP2040 Pico 펌웨어. MK4001MTD는 4GB 마이크로드라이브로, 원래 Nokia N91 뮤직폰 및 일부 MP3 플레이어나 USB 드라이브 같은 기기에 사용되었으며, 당시 플래시 저장 장치는 꽤 비쌌습니다. 이 드라이브가 MMC 프로토콜을 사용한다는 소개를 본 적이 있을 수 있지만, 이는 사실 잘못된 정보입니다. 저는 이 문제를 한동안 조사해 왔습니다. 8비트 MMCplus 카드...

AZL-106122 CVE-2026-98189 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...

DEBIAN-CVE-2026-98189

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...

CVE-2026-98213 mmc: core: Cancel SDIO IRQ work before freeing host

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdiosignalirq schedules host-sdioirqwork from its interrupt handler. That work is only cancelled on the suspend path mmcsdiosuspend, not on the...

CVE-2026-98213

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdiosignalirq schedules host-sdioirqwork from its interrupt handler. That work is only cancelled on the suspend path mmcsdiosuspend, not on the...

EUVD-2026-93117

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...

PT-2026-106537

In the Linux kernel, the following vulnerability has been resolved: mmc: sdio uart: fix xmit fifo leak when the port table is full sdio uart add port allocates the transmit fifo before claiming a slot in sdio uart table. When all UART NR slots are taken, it returns -EBUSY with the fifo still...

PT-2026-106542

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdio signal irq schedules host-sdio irq work from its interrupt handler. That work is only cancelled on the suspend path mmc sdio suspend, not on the...

CVE-2026-90378

A flaw was found in the Linux kernel's mt76 wireless driver, specifically in the mt792x SDIO TX path. When the txprepareskb function fails to prepare a socket buffer skb for transmission, the skb is not properly released. This memory leak can lead to resource exhaustion, potentially causing a...

SUSE CVE-2026-90378

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

AZL-102897 CVE-2026-90378 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

CVE-2026-90378

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

CVE-2026-90090

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdiotxpacket rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is: err = sdiowritesbbdev-func,...

CVE-2026-90378

CVE-2026-90378 affects the Linux kernel 's mt76/mt792x WiFi driver in its SDIO TX path . The root cause is a memory leak : when tx_prepare_skb() returns an error, the socket buffer (skb) is not freed. This can be triggered when zero-length frames (such as WNM NULL frames) are dropped to prevent p...

EUVD-2026-82039

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

CVE-2026-90378 wifi: mt76: mt792x: Fix memory leak in SDIO TX path

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

CVE-2026-90378 wifi: mt76: mt792x: Fix memory leak in SDIO TX path

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

EUVD-2026-81951

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdiotxpacket rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is: err = sdiowritesbbdev-func,...

CVE-2026-90090

This CVE affects the Linux kernel Bluetooth btmtksdio driver. In the TX path, btmtksdio_tx_packet() rounds the transfer size up to the SDIO block size of 256 bytes but passes the raw SKB buffer to sdio_writesb(). Since only skb->len bytes hold actual packet data, the host controller reads up t...