CVE-2026-92460 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

CVE-2026-92458 yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to...

CVE-2026-92459 yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...

CVE-2026-92457 yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify...

CVE-2026-92456 yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints ...

CVE-2026-92455 yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints

yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST...

CVE-2026-92357 a2ui-project a2ui Model Processor model-processor.ts information disclosure

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument currentsegment leads to information disclosure. The attack may be initiated remotely. The identifier o...

CVE-2026-86107 Security Advisory 0180

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...

CVE-2026-90049 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

CVE-2026-90048 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in nicreateattrlist nicreateattrlist allocates a fixed buffer of alalignedrecordsize == recordsize bytes and then walks every attribute of the primary MFT record, writing one ATTRLISTENTRY p...

CVE-2026-90047 drm/xe: Don't hand out the flat CCS storage as usable VRAM

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat CCS storage as usable VRAM getflatccsoffset reads the base of the flat CCS storage from the hardware, scales it by the number of enabled L3 nodes, and rounds the result up to 128K. Everything below...

CVE-2026-90046 mm/page_alloc: don't spin_trylock() in NMI on UP

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: don't spintrylock in NMI on UP Patch series "mm/pagealloc: fixes for freepagesnolock on RT/UP". Pre-existing bugs found by Sashiko during review of this other series:...

CVE-2026-90045 USB: gadget: ffs: fix mm lifetime handling

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling iodata stores a pointer to the submitting task's mmstruct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task...

CVE-2026-90044 usb: gadget: f_fs: Fix Use-After-Free in AIO error path

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix Use-After-Free in AIO error path In ffsepfilewriteiter and ffsepfilereaditer, when ffsepfileio fails with an error other than -EIOCBQUEUED, the iodata structure p is freed. However, for AIO operations, the...

CVE-2026-90043 zram: fix slot lock bit position on big-endian 64-bit

In the Linux kernel, the following vulnerability has been resolved: zram: fix slot lock bit position on big-endian 64-bit The slot lock is a bit operation on the whole lock word, which flags and actime alias as two u32s. On little-endian the lock bit lands in the position ZRAMENTRYLOCK reserves i...

CVE-2026-90042 ceph: properly decrypt filenames in vmalloc() buffers

In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc ...

CVE-2026-90041 HID: sony: clean up device list on probe failure

In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list on probe failure sonyinputconfigured adds some controllers to sonydevicelist before HID core registers their input devices. inputregisterdevice can fail after the callback returns successfully...

CVE-2026-90039 NFSD: Guard admin state-revocation walks with NFSD_NET_UP

In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...

CVE-2026-90040 KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...

CVE-2026-90038 NFSD: Prevent client use-after-free during export state revocation

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...

CVE-2026-90037 NFSD: Prevent client use-after-free during close_lru reaping

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...

CVE-2026-90035 drm/amd/display: fix division by zero in get_estimated_bw()

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix division by zero in getestimatedbw getestimatedbw divides by link-dpiabwallocconfig.bwgranularity, which is zeroed by resetbwallocstruct and only populated once DPTUNNELINGBWALLOCCAPCHANGED has been handled...

CVE-2026-90036 NFSD: Prevent client use-after-free during blocked-lock reaping

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...

CVE-2026-90034 usb: image: mdc800: change kmalloc() to kzalloc()

In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc to kzalloc Change the kmalloc calls in usbmdc800init for irqurbbuffer and downloadurbbuffer to kzalloc, avoiding potential stack leaks if a shorter message is received in mdc800usbirq and...

CVE-2026-90032 media: usbtv: keep device alive while ALSA card exists

In the Linux kernel, the following vulnerability has been resolved: media: usbtv: keep device alive while ALSA card exists The ALSA PCM callbacks store the driver state in pcm-privatedata. An open PCM file can outlive USB disconnect because usbtvaudiofree uses sndcardfreewhenclosed. The disconnec...

CVE-2026-90033 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput picks a count of 2 on anything slower than high speed and never relates it to ep-maxtransfer. The URB buffer holds exactly maxtransfer bytes, so ...

CVE-2026-90031 usb-storage: ene_ub6250: fix race between scan work and probe

In the Linux kernel, the following vulnerability has been resolved: usb-storage: eneub6250: fix race between scan work and probe eneub6250probe calls usbstorprobe2, which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls enegetcardtype, which sends a...

CVE-2026-90030 usb: dwc3: clear forceRM when issuing EndTransfer

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active transfer. Older DWC3 programming guide revisions recommended setting...

CVE-2026-90029 usb: storage: realtek_cr: fix use-after-free on disconnect

In the Linux kernel, the following vulnerability has been resolved: usb: storage: realtekcr: fix use-after-free on disconnect realtekcrdestructor calls timerdelete before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a...

CVE-2026-90028 usb: typec: hd3ss3220: track VBUS enable state per consumer

In the Linux kernel, the following vulnerability has been resolved: usb: typec: hd3ss3220: track VBUS enable state per consumer regulatorisenabled reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can ski...

CVE-2026-90026 usb: typec: qcom-pmic: cancel reset_work on stop

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel resetwork on stop pdphystop disables IRQs but leaves resetwork pending. If the IRQ handler schedules it just before disableirq, the work runs after remove frees the struct via devm. Call cancelworksy...

CVE-2026-90027 usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop ccdebouncedwork is queued from the setcc and starttoggling callbacks, which run from TCPM's kthread worker. portstop returns before tcpmunregisterport destroys that...

CVE-2026-90025 usb: typec: ucsi: displayport: Fix OOB altmode array index

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM response after checking it is not 0xff. The port altmode array is...

CVE-2026-90024 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

CVE-2026-90022 usb: gadget: f_midi2: fix use-after-free in string attribute show path

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

CVE-2026-90023 usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...

CVE-2026-90021 usb: gadget: f_midi: initialize work in f_midi_alloc()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...

CVE-2026-90020 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...

CVE-2026-90019 usb: gadget: fix null pointer dereference in usb_put_function_instance()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocinst error path. However, fd is not allocated until later in...

CVE-2026-90018 staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte...

CVE-2026-90017 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...

CVE-2026-90016 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...

CVE-2026-90015 xhci: fix lost bounce buffers on TDs spanning several ring segments

In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhcialigntd stages the unalignable tail through the bounce buffer of...

CVE-2026-90014 tracing: Have show_event_filters/triggers files take trace array ref

In the Linux kernel, the following vulnerability has been resolved: tracing: Have showeventfilters/triggers files take trace array ref The newly added files showeventfilters and showeventtriggers that show all filters or triggers that are set within the trace array do not take a reference for the...

CVE-2026-90013 tracing: Take trace_array reference when opening options file

In the Linux kernel, the following vulnerability has been resolved: tracing: Take tracearray reference when opening options file The options files do not take the tracearray reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by...

CVE-2026-90012 spi: Fix DMA mapping ownership on partial map failure

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...

CVE-2026-90010 scsi: bsg: Cap io_uring sense copy to max_response_len

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

CVE-2026-90011 scsi: target: iscsi: Reserve a terminator byte for the login payload

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds MAXKEYVALUEPAIRS, but the test is '' and login-reqbuf is allocated with exactly...

CVE-2026-90009 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-90008 scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame

In the Linux kernel, the following vulnerability has been resolved: scsi: megaraidsas: Limit NVMe request size to the PRP chain frame megasasmakeprpnvme builds a command's PRP list in cmd-sgframe, a DMA pool buffer of instance-maxchainframesz bytes, spending one entry per NVMe page of the transfe...