CVE-2026-90349

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

CVE-2026-90344

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: disconnect on CSA to channel 0 The refactor for the CSA parsing erroneously equates channel zero and no information present, leading it to ignore a CSA on an AP that advertises a switch to that invalid channel. Th...

CVE-2026-90345

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary...

CVE-2026-90346

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: clean up color-change beacon data on errors nl80211colorchange calls nl80211parsebeacon for the beaconnext template, which can allocate params.beaconnext.mbssidies and .rnries. A parsing failure returned directly...

CVE-2026-90351

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached wedhif2 for the secondary function, leaving the device in an...

CVE-2026-90348

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to it are not permitted...

CVE-2026-90347

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

CVE-2026-90350

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

CVE-2026-90335

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

CVE-2026-90337

In the Linux kernel, the following vulnerability has been resolved: serial: core: do fallible allocations before the console can be registered serialcoreaddoneport allocates uport-ttygroups after uartconfigureport, which may register the console. If the allocation fails, the driver unwinds the po...

CVE-2026-90339

In the Linux kernel, the following vulnerability has been resolved: powerpc/syscall: Fix syscall skip handling for seccomp and ptrace After enabling GENERICENTRY on PowerPC, syscallenterfromusermode returns -1 as a sentinel to signal that seccomp or ptrace has intercepted the syscall and already...

CVE-2026-90341

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboottablepopulate bounds checks limit individual entries to the mapped length. However, coreboottableprobe replaces the platform resource length with header and table siz...

CVE-2026-90336

In the Linux kernel, the following vulnerability has been resolved: serial: core: clear freed pointers on uartregisterdriver failure uartregisterdriver leaves drv-state pointing to freed memory when ttyallocdriver fails. If ttyregisterdriver fails, drv-ttydriver also retains a pointer after its...

CVE-2026-90340

In the Linux kernel, the following vulnerability has been resolved: pinctrl: generic: free maps on pinctrlgenerictomap failure pinctrlgenerictomap parses DT configuration and allocates pinctrl maps via pinctrlutilsreservemap. If subsequent steps such as pinctrlutilsaddmapmux,...

CVE-2026-90342

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock deadlock on arena lock failure Reported by the Sashiko AI review. arenavmfault returns VMFAULTRETRY when it can't take arena-spinlock, but it never took mmaplock. The fault path assumes a VMFAULTRETRY handler...

CVE-2026-90343

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wirelessdev is still present in the driver. cfg80211leavelocked and cfg80211stoppd already do this before invoki...

CVE-2026-90338

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: keep console clock enabled for atomic writes pl011consolewriteatomic runs from nbcon atomic context, where sleeping is not allowed. It calls clkenable, which takes the common-clk enablelock. Under PREEMPTRT th...

CVE-2026-90333

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

CVE-2026-90329

In the Linux kernel, the following vulnerability has been resolved: HID: synchronize input before cleaning up a failed probe hiddeviceiostart allows reports to run concurrently with probe. If the probe subsequently fails, hiddeviceprobe releases driver resources and clears hdev-driver without fir...

CVE-2026-90332

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush cached MSI write before unmapping the iATU The MSI-X path already flushes any posted MSI-X write before tearing down its iATU mapping. That was added by commit c22533c66cca "PCI: dwc: ep: Flush MSI-X write...

CVE-2026-90331

In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid-asus driver: - unchecked size in asusrawevent - unclean teardown of asusprobe on failure - possible use-after-free in asuspro...

CVE-2026-90334

In the Linux kernel, the following vulnerability has been resolved: tty: clear cdev pointer after cdevadd failure ttycdevadd drops the cdev reference when cdevadd fails, but leaves driver-cdevsindex pointing to freed memory. ttyunregisterdevice later passes that stale pointer to cdevdel, causing ...

CVE-2026-90330

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix FF device cleanup on init failure hidppffinit creates the input force-feedback device with inputffcreate, then allocates the HID++ FF private data, effect ID array, and workqueue. If any of those...

CVE-2026-90328

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-90321

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxat...

CVE-2026-90327

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller's buffer with mint, but then stores the value with putuserval, int user optval, which always writes sizeofint bytes. A...

CVE-2026-90323

In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uringcmd With UBLKFAUTOBUFREG, invalid sqe-addr can fail after ublkfilliocmd has set UBLKIOFLAGACTIVE. The uringcmd is completed while the tag stays active, which can hang teardown. Split...

CVE-2026-90325

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcgactivatepolicy When switching IO schedulers on a block device, blkcgactivatepolicy can race with concurrent blkcg deletion, leading to a use-after-free in rcuacceleratecbs. T1: T2: blkgdestroy...

CVE-2026-90322

In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nmnodelocalstore handles local=0 by stopping o2net and setting cllocalnode to O2NMINVALIDNODENUM, but it leaves clhaslocal set. That stale state makes o2nmthisnode return 255,...

CVE-2026-90326

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix race between policy activation and blkg destruction When switching an IO scheduler on a block device, blkcgactivatepolicy allocates blkgpolicydata pd for all blkgs attached to the queue. However, blkcgactivatepoli...

CVE-2026-90324

In the Linux kernel, the following vulnerability has been resolved: ublk: check importubuf return value importubuf can fail if the address range provided by the userspace ublk server is outside the allowed user address space. Return that 0 bytes were copied if importubuf fails rather than passing...

CVE-2026-90314

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...

CVE-2026-90316

In the Linux kernel, the following vulnerability has been resolved: drm/omap: dsi: Do not copy isr table To be able to unregister stuff from isrs, the corresponding table was copied. Nobody seems to unregister stuff that way, so it does not help. But there are stack-allocated objects passed to...

CVE-2026-90319

In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...

CVE-2026-90315

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers Currently, the legacy I/O and memory sysfs handlers do not check securitylockeddownLOCKDOWNPCIACCESS, leaving the legacyio and legacymem files unprotected when the...

CVE-2026-90313

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

CVE-2026-90318

In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fatscanlogstart leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fatscan. fatrebuildparent uses the directory entry to rebuild the...

CVE-2026-90320

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate external xattr entries when reading metadata ocfs2validatexattrblock checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xhcount and...

CVE-2026-90317

In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpfspinunlock ends that protection, but the verifier leaves the pointer valid...

CVE-2026-90305

In the Linux kernel, the following vulnerability has been resolved: ARM: 9483/1: select HAVEPOSIXCPUTIMERSTASKWORK Commit c6e61c06d606 "ARM: 9463/1: Allow to enable RT" enabled PREEMPTRT on ARM but did not select HAVEPOSIXCPUTIMERSTASKWORK. This leaves CONFIGPOSIXCPUTIMERSTASKWORK disabled, so CP...

CVE-2026-90308

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold QP references for AE and CM processing AE QP fatal events and iWARP CM paths load QPs from dev-qpxa and then use or reference them outside the xarray lock. erdmadestroyqp can drop the destroy-path reference and...

CVE-2026-90312

In the Linux kernel, the following vulnerability has been resolved: bpf: Check load-acquire src ptr type before the load checkatomicload calls checkloadmem before atomicptrtypeok. For a load-acquire that fetches into its own source register dstreg == srcreg, checkloadmem overwrites srcreg's type...

CVE-2026-90307

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

CVE-2026-90304

In the Linux kernel, the following vulnerability has been resolved: ARM: 9484/1: enable interrupts when unhandled user faults are triggered PREEMPTRT requires interrupts to be enabled when sending signals. When doDataAbort/doPrefetchAbort triggers unhandled user faults, that is inf-fn return a...

CVE-2026-90310

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-90311

In the Linux kernel, the following vulnerability has been resolved: thermal: hwmon: Remove hwmon class device along with its parent The current code creates one hwmon device per thermal zone type and that device is registered under the first thermal zone of the given type. That turns out to be...

CVE-2026-90309

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev-cqxa and invoke CQ completion or error callbacks outside the xarray lock. erdmadestroycq can erase the CQ from the xarray and free its queu...

CVE-2026-90306

In the Linux kernel, the following vulnerability has been resolved: ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hwbreakpointcfihandler from ARM, making it not steal breakpoint type 0x03 ARMENTRYCFIBREAKPOINT unless CFI is actively used in the kernel. When not...

CVE-2026-90303

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...

CVE-2026-90297

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...