CVE-2026-93171

In the Linux kernel, the following vulnerability has been resolved: leds: lp5860: Fix a potential double-unlock In lp5860deviceinit, if lp5860initdt fails, an already unlocked mutex is unlocked another time. Slightly rework how the lock is taken/released to avoid this potential double unlock...

CVE-2026-93068

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

CVE-2026-90253 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only freed if sendcancel runs. A cancelled entry is leaked, as...

CVE-2026-90253

In the Linux kernel Bluetooth MGMT subsystem , mesh_send_cancel() queues a pending command with a NULL destroy callback , meaning it is only freed if send_cancel() actually runs. When the entry is cancelled (e.g., by hci_cmd_sync_clear() on controller unregistration), _hci_cmd_sync_cancel_entry()...

EUVD-2026-81845

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync runs. A cancelled entry is leaked, as hcicmdsynccancelentry...

CVE-2026-90252 Bluetooth: MGMT: free the HCI command when it is cancelled

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync runs. A cancelled entry is leaked, as hcicmdsynccancelentry...

CVE-2026-90252

CVE-2026-90252 is a memory and socket-reference leak in the Linux kernel's Bluetooth MGMT subsystem. The root cause is that mgmt_hci_cmd_sync() queues a pending HCI command with a NULL destroy callback , meaning a cancelled entry is never freed. When a controller is unregistered, hci_cmd_sync_cle...

CVE-2026-90252 Bluetooth: MGMT: free the HCI command when it is cancelled

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync runs. A cancelled entry is leaked, as hcicmdsynccancelentry...

EUVD-2026-81752

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfg,setsockopt in cgroup UNIX getname hooks bpfsetsockopt and bpfgetsockopt call sockownedbyme for full sockets, so these helpers expect the socket lock to be held. BPFCGROUPUNIXGETPEERNAME and...

CVE-2026-90142

CVE-2026-90142 is an out-of-bounds write vulnerability in the Linux kernel's virtio_net driver. When an AF_XDP socket is attached, the function virtnet_rx_resize fails to resize the rq->xsk_buffs XSK buffer array. If the RX ring size is subsequently increased (e.g., via ethtool -G ), virtnet_r...

CVE-2026-90138 vsock: don't check the listener's sk_err in vsock_accept()

In the Linux kernel, the following vulnerability has been resolved: vsock: don't check the listener's skerr in vsockaccept Syzbot reported an issue which can be reproduced with these steps: r0 = socketAFVSOCK, SOCKSTREAM, 0 bindr0, VMADDRCIDANY, PORT connectr0, VMADDRCIDLOCAL, PORT - -1, EPROTO...

CVE-2026-90138

CVE-2026-90138 affects the Linux kernel vsock (virtual socket) subsystem . The root cause is that vsock_accept() incorrectly checks the listener socket's sk_err field, which may retain a stale EPROTO error set during a prior failed self-connect while the socket was in TCP_SYN_SENT state. This cau...

EUVD-2026-81731

In the Linux kernel, the following vulnerability has been resolved: vsock: don't check the listener's skerr in vsockaccept Syzbot reported an issue which can be reproduced with these steps: r0 = socketAFVSOCK, SOCKSTREAM, 0 bindr0, VMADDRCIDANY, PORT connectr0, VMADDRCIDLOCAL, PORT - -1, EPROTO...

CVE-2026-90074

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqpie: clamp default quantum to avoid signed overflow fqpieinit sets q-quantum = pschedmtuqdiscdevsch without clamping. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu retu...

CVE-2026-50604

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be...

CVE-2026-50604 Unauthenticated Access Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be...

EUVD-2026-81319

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be...

CVE-2026-50604 Unauthenticated Access Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be...

CVE-2026-50604

CVE-2026-50604 affects the Acer Agent Service component bundled with NitroSense and PredatorSense software. The root cause is a missing authentication check during the socket handshake process, which allows an unauthenticated local attacker to establish a connection and access functionality that ...

CVE-2026-90253: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only freed if sendcancel runs. A cancelled entry is leaked, as...