9153 matches found
CVE-2026-90292 RDMA/siw: Fix use-after-free in siw_accept()
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...
CVE-2026-90291 module/dups: Fix use-after-free in kmod_dup_req lifetime handling
In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...
CVE-2026-90290 arm64: hibernate: Restore DAIF state on error
In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error Sashiko AI has reported that if swsuspmtesavetags for some reason fails we return from swsusparchsuspend with DAIF being masked - that is not what we'd expect. Restore the saved DAIF...
CVE-2026-90289 drm/amd/display: Resize MST HDCP per-connector arrays to 32
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPUDMMAXDISPLAYINDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAXDISPLAYCOUNT. Hence we're off by one with DRM core, which...
CVE-2026-90287 phy: sunplus: fix error handling in sp_uphy_init()
In the Linux kernel, the following vulnerability has been resolved: phy: sunplus: fix error handling in spuphyinit Fix the error paths of spuphyinit to undo exactly what each stage did: return directly if clkprepareenable fails, release only the clock if resetcontroldeassert fails, and jump to...
CVE-2026-90288 phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure
In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double ofnodeput on phy creation failure foreachchildofnodescoped releases the node reference on scope exit, so the explicit ofnodeputnp in the devmphycreate error path drops it twice. Drop the...
CVE-2026-90286 drm/amdgpu/gfx6: Use PFP on the compute queues too
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...
CVE-2026-90285 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...
CVE-2026-90284 firmware_loader: do not queue completed sysfs fallback requests
In the Linux kernel, the following vulnerability has been resolved: firmwareloader: do not queue completed sysfs fallback requests fwloadsysfsfallback calls deviceadd before adding the fwpriv to pendingfwhead. deviceadd publishes the fallback loading interface, so a userspace helper which discove...
CVE-2026-90283 hugetlbfs: release subpool on fill_super failure
In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fillsuper failure hugetlbfsfillsuper allocates a hugepage subpool when size or minsize mount options are specified. hugepagenewsubpool may also reserve huge pages for minsize. If root dentry creation...
CVE-2026-90282 phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because...
CVE-2026-90281 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phycreate only enables runtime PM on the PHY device if it is already enabled on this parent...
CVE-2026-90280 phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...
CVE-2026-90279 md/raid5: round bitmap stripes with sector division
In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5bitmapsectormap aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunksectors multiplied by the number of data...
CVE-2026-90277 md/md-llbitmap: prevent create failure bitmap UAF
In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmapcreate publishes mddev-bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb can initialize a new bitmap and flush it through helpers that use...
CVE-2026-90278 md: wait for behind writes before destroying bitmap
In the Linux kernel, the following vulnerability has been resolved: md: wait for behind writes before destroying bitmap mdstop destroyed the bitmap before calling mddevdetach. That made mddevdetach skip bitmapops-waitbehindwrites, because the bitmap was already disconnected from mddev. This was...
CVE-2026-90276 md/md-llbitmap: stop daemon timer rearm on destroy
In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmapdestroy deletes pendingtimer before flushing mdllbitmapiowq. However, daemonwork can still be queued or running after the timer has been deleted, and the daemon path can...
CVE-2026-90275 md/raid1: don't set array_frozen in raid1_takeover()
In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover raid1takeover sets conf-arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier sees it stuck at 1...
CVE-2026-90274 coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of nrseqstate - 1 According to IHI006H Embedded Trace Macrocell Architecture Specification0, TRCSEQEVR is implemented only when TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0...
CVE-2026-90273 coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: missing cscfgcsdevdisableactiveconfig in perf enable In the perf enable path, there are missing cases where cscfgcsdevdisableactiveconfig is not called: - Branch broadcast is selected but not supported by the...
CVE-2026-90272 perf: arm_pmuv3: Zero initialize hw_id branch stack field
In the Linux kernel, the following vulnerability has been resolved: perf: armpmuv3: Zero initialize hwid branch stack field PERFSAMPLEBRANCHHWINDEX is supported by BRBE so hwid is passed to userspace, but it's never set by the BRBE driver. Zero initialize it as it should be according to the docs:...
CVE-2026-90271 arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt
In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable se...
CVE-2026-90270 arm_mpam: Disable driver unbind to avoid UAF
In the Linux kernel, the following vulnerability has been resolved: armmpam: Disable driver unbind to avoid UAF When a user unbinds an MSC and that MSC is the only MSC left for a component then the corresponding mpamcomponent will be freed. If the user then goes on to read the schemata file in th...
CVE-2026-90268 scsi: sd: Fix error handling in sd_probe() after large pool creation failure
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskdev and let scsidiskrelease free sdkp. Going through outfreeindex kfre...
CVE-2026-90269 bpf: Reject load-acquire from pointers requiring fault protection
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...
CVE-2026-90267 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix specialvec mempool leak when scsiallocsgtables fails sdsetspecialbvec allocates a special payload page for UNMAP and WRITE SAME commands. If scsiallocsgtables fails afterward in sdsetupunmapcmnd or...
CVE-2026-90265 btrfs: defrag: fix deadlock between defrag and delalloc space reservation
In the Linux kernel, the following vulnerability has been resolved: btrfs: defrag: fix deadlock between defrag and delalloc space reservation While running fsstress with autodefrag and flushoncommit, hit a deadlock due to the fact that defrag reserves delalloc space while it's holding dirty and...
CVE-2026-90266 btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge On a zoned FS, btrfsdelayedrefsrsvrefill returns -EAGAIN whenever the over-committed metadata plus the zoneunusable bytes exceeds the usable size in a...
CVE-2026-90263 btrfs: check if root is readonly when setting posix acl
In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs r...
CVE-2026-90264 btrfs: always wait for ordered extents to avoid OE races
In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...
CVE-2026-90262 btrfs: retry verity reads for not-uptodate Merkle folios
In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...
CVE-2026-90260 btrfs: zoned: don't clobber the extent buffer when zeroing it out
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't clobber the extent buffer when zeroing it out On a zoned filesystem a freed-but-still-dirty tree block is written out as zeros EXTENTBUFFERZONEDZEROOUT only to keep the zone write pointer advancing...
CVE-2026-90261 btrfs: zoned: flush active metadata block group at btree_writepages() start
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: flush active metadata block group at btreewritepages start btreewritepages writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block gro...
CVE-2026-90259 btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...
CVE-2026-90258 pinctrl: airoha: add missed IRQ resource helpers
In the Linux kernel, the following vulnerability has been resolved: pinctrl: airoha: add missed IRQ resource helpers Without hooking .irqrequestresources, gpiolib cannot set GPIODFLAGUSEDASIRQ. This breaks pin direction locking and can allow userspace or another driver to reconfigure an active IR...
CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...
CVE-2026-90256 Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...
CVE-2026-90254 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire hands a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback, and only advtimeoutexpiresync frees it. That leak...
CVE-2026-90255 Bluetooth: hci_conn: fix the SCO setup context lifetime
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...
CVE-2026-90253 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only freed if sendcancel runs. A cancelled entry is leaked, as...
CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...
CVE-2026-90252 Bluetooth: MGMT: free the HCI command when it is cancelled
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync runs. A cancelled entry is leaked, as hcicmdsynccancelentry...
CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog
In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...
CVE-2026-90248 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix teardown of an adopted proto on insert-race loss In tcnewtfilter the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique. When the caller loses the race another request inserted a proto a...
CVE-2026-90249 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...
CVE-2026-90247 bpf: Fix mmap_lock leak in irq_work path
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...
CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...
CVE-2026-90244 iommu/dma: Restore locking around msi_page_list
In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...
CVE-2026-90245 fbdev: kyro: Validate overlay viewport coordinates
In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wra...
CVE-2026-90243 iommu/vt-d: Clear Present bit before tearing down copied context entry
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copiedcontextteardown zeroes the 128-bit context entry with contextclearentry while the Present bit is still set, and only then issues the context-cache and...