CVE-2026-90025

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM response after checking it is not 0xff. The port altmode array is...

CVE-2026-90022

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

CVE-2026-90024

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

CVE-2026-90023

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...

CVE-2026-90026

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel resetwork on stop pdphystop disables IRQs but leaves resetwork pending. If the IRQ handler schedules it just before disableirq, the work runs after remove frees the struct via devm. Call cancelworksy...

CVE-2026-90020

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...

CVE-2026-90019

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocinst error path. However, fd is not allocated until later in...

CVE-2026-90015

In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhcialigntd stages the unalignable tail through the bounce buffer of...

CVE-2026-90017

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...

CVE-2026-90014

In the Linux kernel, the following vulnerability has been resolved: tracing: Have showeventfilters/triggers files take trace array ref The newly added files showeventfilters and showeventtriggers that show all filters or triggers that are set within the trace array do not take a reference for the...

CVE-2026-90016

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...

CVE-2026-90018

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte...

CVE-2026-90010

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

CVE-2026-90011

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds MAXKEYVALUEPAIRS, but the test is '' and login-reqbuf is allocated with exactly...

CVE-2026-90013

In the Linux kernel, the following vulnerability has been resolved: tracing: Take tracearray reference when opening options file The options files do not take the tracearray reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by...

CVE-2026-90012

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...

CVE-2026-90005

In the Linux kernel, the following vulnerability has been resolved: samples/damon/wsse: handle damonstart failure Patch series "samples/damon: handle damonstart,stop failures". All DAMON sample modules are not correctly handling failures from damonstart. Among those, mtier also has an additional...

CVE-2026-90006

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: handle damonstop failure damonsamplemtierstop assumes its damonstop call will always successfully stops the two DAMON contexts. Hence it deallocates the two DAMON contexts after the damonstop call. However, i...

CVE-2026-90009

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-90008

In the Linux kernel, the following vulnerability has been resolved: scsi: megaraidsas: Limit NVMe request size to the PRP chain frame megasasmakeprpnvme builds a command's PRP list in cmd-sgframe, a DMA pool buffer of instance-maxchainframesz bytes, spending one entry per NVMe page of the transfe...

CVE-2026-90007

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers with freeirq when requestirq fails. The rollback loop uses the failing index i for every iteration instead of th...

CVE-2026-90004

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: handle region split failure in applyminnrregions damonapplyminnrregions repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes...

CVE-2026-90003

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-after-free during requeue PI On PREEMPTRT, FUTEXCMPREQUEUEPI can trigger a KASAN report slab-out-of-bounds in futexrequeuepicomplete invocation of rcuwaitwakeup. The futexq used by futexwaitrequeuepi is...

CVE-2026-90002

In the Linux kernel, the following vulnerability has been resolved: ftrace: Take tracearray reference before accessing its ftraceops The trace instance files setftracefilter and setftracenotrace was updated to work with specific trace instances tracearrays. The issue is that when these files are...

CVE-2026-90001

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-89998

In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dmsetupmdqueue walks &md-tabledevices without...

CVE-2026-90000

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-89999

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

CVE-2026-8462

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

CVE-2026-89991

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...

CVE-2026-89992

In the Linux kernel, the following vulnerability has been resolved: cpuidle: dtidlegenpd: kfree the original name allocation dtidlepdalloc kasprintfs the full node path, then points pd-name at kbasename of that string. dtidlepdfree kfrees pd-name, which is no longer the start of the allocation...

CVE-2026-89995

In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dmadirectallocfrompool Commit 5b138c534fda "dma-direct: factor out a dmadirectallocfrompool helper" changed dmadirectallocfrompool to return the CPU address from dmaallocfrompool. That fits...

CVE-2026-89997

In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in dmdestroy. The result is that the table is destroyed...

CVE-2026-89990

In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in cephmdscheckaccess MDS session OPEN handling replaces mdsc-scapauths under mdsc-mutex, freeing the previous array and its strings. cephmdscheckaccess traverses this array without holding the mutex. A concurren...

CVE-2026-89989

In the Linux kernel, the following vulnerability has been resolved: ima: Check for ERRPTR from dentrypath in validatehashalgo dentrypath returns ERRPTR-ENAMETOOLONG when the path exceeds the buffer. validatehashalgo passes the result straight to integrityauditmsg without checking. ERRPTR is not...

CVE-2026-89996

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89993

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...

CVE-2026-89994

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsledmaengine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no...

CVE-2026-89981

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMIDEL1 when MTE is disabled cpuinfostorecpu gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel has disabled MTE CONFIGARM64MTE=n or arm64.nomte. KVM sets HCREL2.TID5 ...

CVE-2026-89985

In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits t...

CVE-2026-89982

In the Linux kernel, the following vulnerability has been resolved: i2c: mux: Fix channel node leak on adapter add failure i2cmuxaddadapter takes a reference to the Device Tree channel node before registering the new adapter. If adapter registration fails, the error path frees the private data...

CVE-2026-89984

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...

CVE-2026-89983

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix debugfs UAF on adapter removal i2cdeladapter frees the adapter's debugfs directory before it unregisters the adapter device, but the newdevice sysfs attribute stays writable until devicedel. A write racing with...

CVE-2026-89986

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix sleeping allocation in allocpagesbulkweightedinterleave syzbot reported a sleeping function called from invalid context splat in buckettablealloc. When rhashtableinsertslow rehashes the table under rcureadlock, ...

CVE-2026-89987

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: transfer the pmd dirty bit to the folio on zap zaphugepmdfolio propagates the pmd young bit to the folio for the file case, but not the dirty bit. The pte path does propagate it, in zappresentfolioptes and so does...

CVE-2026-89988

In the Linux kernel, the following vulnerability has been resolved: kprobes: Protect kprobeblacklist with RCU withinkprobeblacklist traverses kprobeblacklist without holding kprobemutex. When a module is unloaded, kproberemoveareablacklist removes blacklist entries and immediately frees them with...

CVE-2026-89979

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the concurrent state transitions between atomic PCM ops, but the checks between the non-atomic ops hwparams, hwfree and prepare and the atomic o...

CVE-2026-89975

In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix DHCHAP secret leak on parse failure nvmfparseoptions duplicates dhchapsecret and dhchapctrlsecret with matchstrdup before validating the DHHC-1: representation. If validation fails, the parser returns -EINVAL...

CVE-2026-89976

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix job completion fence cleanup ethosuioctlsubmitjob allocates donefence before validating buffer handles. Errors after allocation call ethosujoberrcleanup, which frees the job but leaks the uninitialized fence. A...

CVE-2026-89980

In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ sndharmonycreate registers the IRQ before initializing h-lock and h-mixerlock. A pending interrupt can invoke the handler while these locks are uninitialized. Initialize both...