CVE-2026-90396

In the Linux kernel, the following vulnerability has been resolved: block: fix dio leak on metadata mapping error A failed integrity mapping holds a dio reference, so we need to go through the full bio ending in case there were previously submitted bio's in the sequence...

CVE-2026-90395

In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier and power supply, but does not wait for queued or running work befor...

CVE-2026-90394

In the Linux kernel, the following vulnerability has been resolved: power: supply: sc2731charger: cancel work on remove The USB notifier and initial charger detection can schedule info-work. The remove path unregisters the notifier, but does not cancel queued or running work before the...

CVE-2026-90393

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF in bpfnetnslinkupdateprog In bpfnetnslinkupdateprog, the checks for oldprog and prog type are currently performed locklessly before acquiring netnsbpfmutex. This creates a race condition that can lead to a...

CVE-2026-90391

In the Linux kernel, the following vulnerability has been resolved: lib/testhmm: fail dmirrorfault when the mirrored mm is gone dmirrorfault is called from the dmirrorread and dmirrorwrite retry loops after dmirrordoread or dmirrordowrite finds a missing device page table entry. If the mirrored m...

CVE-2026-90392

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...

CVE-2026-90390

In the Linux kernel, the following vulnerability has been resolved: md/bitmap: resume array on backlogstore error path backlogstore suspends the array before checking whether a write-mostly device exists. If no such device exists, the error path only unlocks reconfigmutex and leaves the array...

CVE-2026-90389

In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave token in mddev-noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter...

CVE-2026-90388

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page and fills cpuaddr only on success. Do not rely on cpuaddr to detect...

CVE-2026-90387

In the Linux kernel, the following vulnerability has been resolved: swiotlb: Preserve allocation virtual address for dynamic pools swiotlballoctlb can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIGDMADIRECTREMAP, the atomic pool is backed by...

CVE-2026-90385

In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to array with serializepolicy=1 The following bug has been observed with kernel 7.1.3 after adding a new rdev to an existing RAID1 array with serializepolicy enabled: Oops: 0002 1 CPU: 0...

CVE-2026-90386

In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd-rxlen the count of addresses left unassigned equals master-maxdevs. The GENMASK index master-maxdevs - cmd-rxlen - 1 th...

CVE-2026-90384

In the Linux kernel, the following vulnerability has been resolved: iomap: release the folio batch on iomap callback failures A sashiko review of an unrelated patch points out that the folio batch mechanism used for iomap zero range fails to release the batch in a couple error scenarios. If eithe...

CVE-2026-90382

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a...

CVE-2026-90383

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

CVE-2026-90381

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each...

CVE-2026-90379

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash When an AER error occurs and the bus is hung, the register reads return 0xFFFFFFFF, causing the DMA queue state to be corrupted and resulting in an invalid...

CVE-2026-90380

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76rxpollcomplete A use-after-free issue occurs in mt76rxpollcomplete due to a race condition. The STA has already been removed, but the rxstatus still had a pointer to the wcid in the...

CVE-2026-90378

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

CVE-2026-90377

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RX data queuing of RRO 3.0 For RRO 3.0, RX data released from a RRO data queue should be put to the indicator queue. The frames are processed and completed in the context of the indicator queue NAPI, which only...

CVE-2026-90376

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP Problem: MCU command timeout while the firmware state is normal, and the firmware keeps showing the error log "ERROR!! NO PAUSE...". Root cause: If the MLDID field in the TXD ...

CVE-2026-90374

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

CVE-2026-90375

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations mt76txqueueskb overrides the wcid passed by the driver with sta-drvpriv, so the wcid might incorrectly be changed after TX, causing wcid-nonaqlpackets to be counted on th...

CVE-2026-90373

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-90372

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915mcugetstanss If a peer's VHT/HE MCS map has no supported spatial stream all fields 0x3, the loop exits with nss == 0 and the function returned u8-1 255, which was then written into...

CVE-2026-90371

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...

CVE-2026-90370

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

CVE-2026-90368

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unwind state on addinterface failure When mt76wcidalloc fails, mt7915addinterface returned without clearing the vifmask/omacmask bits it had already set, without removing the firmware dev info added earlier, a...

CVE-2026-90369

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76mmiowritecopy and mt76mmioreadcopy iterate up to ALIGNlen, 4, so a length that is not a multiple of four reads past the source buffer writecopy or writes past the...

CVE-2026-90367

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

CVE-2026-90366

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...

CVE-2026-90365

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by destroyworkqueue in mt76freedevice, which runs after the hw is unregister...

CVE-2026-90364

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Unregister cpufreq notifier on init failure acpiprocessordriverinit registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driverregister or...

CVE-2026-90362

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Drop devpmoppsetrate0 devpmoppsetrate0 removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call sit...

CVE-2026-90363

In the Linux kernel, the following vulnerability has been resolved: drm/msm: don't tear down KMS twice when KMS init fails When priv-kmsinit mdp4kmsinit / mdp5kmsinit fails partway through, both display drivers already tear their KMS state down via mdp4destroy / mdp5kmsdestroy before returning th...

CVE-2026-90361

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix leak in ath11kservicereadyextevent Currently, during ath11kservicereadyextevent processing, svcrdyext.macphycaps can be allocated during TLV parsing. This is a temporary allocation that is freed on the success...

CVE-2026-90359

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject 8 byte return values on return-reading trampoline paths btfdistillfuncproto builds the function model used for the fentry/fexit/fmodret/fsession trampolines and structops. It has accepted a 16-byte int128 return value...

CVE-2026-90360

In the Linux kernel, the following vulnerability has been resolved: regulator: core: use systemfreezablewq for init complete work scheduledelayedwork uses systemwq, which is non-freezable, allowing regulatorinitcompletework to run concurrently with system suspend. This work fires 30s after boot t...

CVE-2026-90358

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

CVE-2026-90357

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev-twtlist before sending the agreement to the firmware, but the error path leaves it linked while flowidmask is never set. The flow slot...

CVE-2026-90356

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset mt7996macresetvifiter queues non-default vif links for kfreercu while dev-wcid still holds pointers to the wcid embedded in each freed link;...

CVE-2026-90355

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: clear stale link state on full reset After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996viflinkadd short-circuits when the linkid is still marked in...

CVE-2026-90353

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix ext PHY use-after-free on register error path After mt7915registerextphy succeeded, a failure of the main PHY mt7915initdebugfs or mt7915coredumpregister unwound through freephy2, which called...

CVE-2026-90354

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix double hif2 init on the non-WED path mt7915pciinithif2 was called unconditionally and again inside the WED-inactive branch. The helper increments the global hifidx, writes the PCIe RECOGID register and tak...

CVE-2026-90352

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths that key off dev-hif2, which is not assigned until after the IRQ setup. If...

CVE-2026-90350

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

CVE-2026-90351

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached wedhif2 for the secondary function, leaving the device in an...

CVE-2026-90349

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

CVE-2026-90348

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to it are not permitted...

CVE-2026-90347

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...