CVE-2026-90229

A flaw was found in the Linux kernel's NVMe Apple driver. When an NVMe controller fails to initialize and is subsequently removed, the driver does not properly destroy the associated admin queue. This oversight can lead to a kernel panic, effectively causing a denial of service DoS on the affecte...

CVE-2026-90228

A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker can trigger a NULL pointer dereference by issuing a specific Identify command CNS 05h, CSI 02h ZNS targeting a file-backed namespace. This vulnerability occurs because the system attempts to access a block device that does...

CVE-2026-90226

A flaw was found in the Linux kernel's Near Field Communication NFC Logical Link Control Protocol LLCP subsystem. A local user could trigger a buffer overflow in the nfcllcpgetsockopt function by supplying an invalid option length. This improper handling allows the kernel to write past the...

CVE-2026-90225

A flaw was found in the Near Field Communication NFC Logical Link Control Protocol LLCP subsystem of the Linux kernel. A race condition exists between the nfcllcpgetsockopt and llcpsockbind functions. This allows a local attacker to potentially cause a use-after-free vulnerability by racing a...

CVE-2026-90224

A flaw was found in the Near Field Communication NFC Controller Interface NCI subsystem of the Linux kernel. A double completion race condition can occur when nciclosedevice and ncirxwork concurrently call ncidataexchangecomplete. This can lead to a use-after-free vulnerability, where a network...

CVE-2026-90223

A flaw was found in the Near Field Communication NFC Logical Link Control Protocol LLCP in the Linux kernel. This vulnerability allows a nearby unauthenticated NFC device to trigger an out-of-bounds read during the parsing of Service Name List SNL Type-Length-Value TLV lists. This can occur due t...

CVE-2026-90222

A flaw was found in the Linux kernel's Near Field Communication NFC PN533 driver. A race condition can occur during frame transmission where a memory buffer is prematurely released while the I2C transport is still attempting to use it. This use-after-free vulnerability can lead to system...

CVE-2026-90323

A flaw was found in the Linux kernel's ublk subsystem. When the automatic buffer registration feature is active, an invalid buffer address can be processed, causing a command to complete while its associated tag remains active. This can lead to a system hang during resource teardown, allowing a...

CVE-2026-90306

A flaw was found in the Linux kernel's ARM architecture. When Control-Flow Integrity CFI is not actively used, or when a breakpoint is issued in userspace, the hwbreakpointcfihandler does not properly handle breakpoint type 0x03 ARMENTRYCFIBREAKPOINT. This can lead to an unhandled fault,...

CVE-2026-90311

A flaw was found in the Linux kernel's thermal subsystem. When a thermal zone device is removed, the associated hardware monitoring hwmon class device may not be properly detached if it contains attributes belonging to another thermal zone. This improper handling can prevent the thermal zone...

CVE-2026-90304

A flaw was found in the Linux kernel. When unhandled user faults are triggered, specifically by user programs executing the bkpt instruction with CONFIGPERFEVENTS=n disabled, the system attempts to send a signal with interrupts disabled. This can lead to system instability or a denial of service...

CVE-2026-90290

A flaw was found in the Linux kernel's hibernate functionality for arm64 architectures. When the system attempts to save memory tags during hibernation, a failure in this process can prevent the proper restoration of the Disable Asynchronous Interrupts and Fast interrupts DAIF state. This leaves...

CVE-2026-90285

A flaw was found in the Linux kernel's scsi: qla2xxx component. A redundant read of the Vital Product Data VPD flash in the qla2x00sysfsreadvpd function occurs without the necessary locking mechanism. This exposes flash access to concurrent operations, which can lead to unpredictable behavior or...

CVE-2026-90281

A flaw was found in the Linux kernel's QCOM SNPS Femto V2 PHY driver. During an early runtime suspend, a timing window exists where the power management PM callbacks may attempt to access an uninitialized hardware-specific PHY hsphy instance. This can lead to a NULL pointer dereference, potential...

CVE-2026-90280

A flaw was found in the Linux kernel's qcom qmp-usb physical layer PHY driver. A local attacker could trigger a null pointer dereference by re-enabling runtime power management via a sysfs attribute before the PHY is fully initialized. This can lead to a system crash, resulting in a Denial of...

CVE-2026-90275

A flaw was found in the Linux kernel's md/raid1 component. The raid1takeover function incorrectly sets a flag arrayfrozen that is not subsequently cleared. This issue can lead to a permanent stall of all input/output I/O operations to the RAID array, effectively causing a Denial of Service DoS fo...

CVE-2026-90266

A flaw was found in the Linux kernel's btrfs zoned filesystem. When metadata over-commitment occurs during a reclaim operation, the btrfsdelayedrefsrsvrefill function may return a transient error -EAGAIN. This error can cause the current transaction to abort, leading to the filesystem being force...

CVE-2026-90335

A flaw was found in the Linux kernel's handling of TTY devices. When a TTY device registration fails before a character device cdev is allocated, the serial core retains the port. Subsequent removal of this port can lead to a null-pointer dereference if cdevdel is called with a NULL cdev slot. Th...

CVE-2026-90320

A flaw was found in the Oracle Cluster File System 2 ocfs2 component of the Linux kernel. This vulnerability occurs due to insufficient validation of external extended attribute xattr entries when reading metadata. A local attacker could craft malicious xattr metadata, leading to a use-after-free...

CVE-2026-90331

A flaw was found in the Linux kernel's hid-asus driver. This vulnerability involves multiple issues, including an unchecked size in a function handling raw events and a potential use-after-free condition during device probing. These flaws could allow a local attacker to trigger memory corruption,...

CVE-2026-97873

A flaw was found in Bouncy Castle. In its legacy password-based encryption implementations, iteration counts parsed from untrusted cryptographic inputs are processed without enforcing an upper limit. A remote attacker could exploit this vulnerability by supplying crafted parameters with an...

CVE-2026-90332

A flaw was found in the Linux kernel's PCI dwc endpoint driver. This vulnerability occurs when the driver unmaps an Inbound Address Translation Unit iATU entry without ensuring that all pending Message Signaled Interrupts MSI writes have been flushed. This can lead to MSI writes being dropped or...

CVE-2026-90322

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 cluster heartbeat mechanism. When a local node within the cluster is reset, an internal flag is not properly cleared, leading to an inconsistent state. This inconsistency can cause the system's heartbeat monitoring process ...

CVE-2026-90319

A flaw was found in the Linux kernel's rapidio component. When the rioaddnet function fails, a pointer to a network object mport-net is not properly cleared, leaving it pointing to a memory area that has already been released. A subsequent operation to unregister the mport can then attempt to...

CVE-2026-90317

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. In sleepable BPF programs, a use-after-free vulnerability can occur due to improper handling of RCU Read-Copy-Update protected pointers after a spin unlock operation. A local attacker with limited capabilities could...

CVE-2026-90316

A flaw was found in the Linux kernel's drm/omap DSI Display Serial Interface driver. The driver incorrectly copied the Interrupt Service Routine ISR table, which could lead to a Use-After-Free UAF vulnerability. This occurs when stack-allocated objects are accessed after they have been deallocate...

CVE-2026-90314

A flaw was found in the Linux kernel's remoteproc component. This vulnerability allows a local attacker to trigger an out-of-bounds read by providing a specially crafted offset from firmware. The issue arises because a 32-bit unsigned integer offset is incorrectly handled as a signed integer,...

CVE-2026-90313

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter cgroup functionality. This issue arises during the replacement of a cgroup BPF program in multi-attach mode. If the replacement process fails, the system may not correctly restore the original program's storage pointers, leaving th...

CVE-2026-90312

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF. This vulnerability arises from an issue in how the BPF verifier processes certain memory load operations, specifically when a load-acquire instruction fetches into its own source register. This can lead to a type confusion, where...

CVE-2026-90309

A flaw was found in the Linux kernel's RDMA/erdma component. This vulnerability stems from improper management of Completion Queue CQ references during Event Queue EQ event processing. This can lead to a situation where a CQ is deallocated while still in use by an EQ handler, resulting in memory...

CVE-2026-90308

A flaw was found in the Linux kernel's RDMA/erdma component. A race condition exists where Queue Pair QP resources can be prematurely freed while still being referenced by other processes. This can lead to a use-after-free vulnerability, potentially allowing an attacker to cause system instabilit...

CVE-2026-90307

A flaw was found in the Linux kernel. A remote attacker could exploit a vulnerability in the SCSI Remote Protocol SRP implementation by sending a specially crafted, truncated credential request. This malformed request causes an out-of-bounds read, leading to a heap information leak of up to 8 byt...

CVE-2026-90305

A flaw was found in the Linux kernel, specifically affecting ARM architectures with PREEMPTRT enabled. A local attacker can trigger a Denial of Service DoS by utilizing CPU timers, such as through setrlimit or setitimer. This occurs because the kernel attempts to acquire a sleeping lock...

CVE-2026-90303

A flaw was found in the Linux kernel. Under specific debug configurations, a local user could exploit a use-after-free vulnerability in the memory management subsystem. This issue arises when a user fault triggers a specific function without proper locking, while another process simultaneously...

CVE-2026-90302

A flaw was found in the ocfs2 component of the Linux kernel. A race condition exists during the heartbeat teardown process where heartbeat callbacks remain registered while the o2netwq workqueue is being destroyed. This can lead to a use-after-free vulnerability when queue or flush operations...

CVE-2026-90301

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System version 2 heartbeat mechanism. This vulnerability arises from a race condition during the management of heartbeat regions and their associated network handlers. A remote attacker could exploit this timing issue to trigger a...

CVE-2026-90300

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. The bpfgettaskstack helper function, used by bpfgettaskstack and bpfgettaskstacksleepable, fails to clear a buffer buf on error paths. This oversight can lead to non-deterministic buffer contents, potentially resulting i...

CVE-2026-90299

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When the CONFIGFUNCTIONERRORINJECTION option is disabled, a sleepable tracing program can incorrectly attach to certain symbols, which the BPF verifier misidentifies as kernel functions instead of other BPF programs. A...

CVE-2026-90297

A flaw was found in the Linux kernel's drm/sun4i display driver. When layer initialization fails in sun4icrtcinit, a null pointer is returned instead of an error. Subsequent calls to sun4irgbinit and sun4ilvdsinit then attempt to dereference this null pointer, leading to a kernel crash. This can...

CVE-2026-90295

A flaw was found in the cpufreq: imx6q driver within the Linux kernel. When the driver is unbound and then rebound, a static counter is not reset, causing an out-of-bounds write to memory. A local attacker could exploit this vulnerability to trigger a kernel crash, leading to a denial of service...

CVE-2026-90294

A flaw was found in the Linux kernel. The iSER iSCSI Extensions for RDMA protocol implementation incorrectly sends a login response before the session is fully registered. A remote attacker could exploit this by sending a SCSI command immediately after receiving the premature login response. This...

CVE-2026-90293

A flaw was found in the Linux kernel's IB/isert module, which handles InfiniBand IB and iSCSI Extensions for RDMA iSER connections. A remote attacker could exploit this by sending a specially crafted SCSI command before a network session is fully established. This could lead to a system crash,...

CVE-2026-90292

A flaw was found in the Linux kernel's RDMA/siw component. The siwaccept function, when handling a Queue Pair QP already in the Ready To Send RTS state, can incorrectly manage connection endpoints CEP during cleanup. This can lead to a use-after-free vulnerability, where a freed memory region is...

CVE-2026-90291

A flaw was found in the Linux kernel's module duplication handling module/dups. This use-after-free vulnerability arises from incorrect lifetime management of internal request objects. When multiple operations access these objects concurrently, an object can be prematurely freed while still being...

CVE-2026-90289

A flaw was found in the drm/amd/display component of the Linux kernel. An off-by-one error in the sizing of Multi-Stream Transport MST High-bandwidth Digital Content Protection HDCP per-connector arrays could lead to incorrect array handling. This issue stems from a discrepancy between the intend...

CVE-2026-90288

A flaw was found in the Renesas R-Car Gen2 PHY driver within the Linux kernel. This vulnerability occurs due to a double call to ofnodeput during the PHY creation failure path. A local attacker could potentially exploit this double free condition, leading to memory corruption and a denial of...

CVE-2026-90286

A flaw was found in the Linux kernel's AMD GPU Graphics Processing Unit driver, specifically affecting GFX6 series GPUs. This vulnerability stems from incorrect handling of the Pre-Fetch Parser PFP on compute queues, which can lead to synchronization issues. An attacker could potentially exploit...

CVE-2026-90284

A flaw was found in the Linux kernel's firmware loader. Due to improper handling of sysfs fallback requests, a race condition can occur where a userspace helper completes a request before it is properly queued. This can lead to the system retaining a pointer to freed memory, potentially causing a...

CVE-2026-90282

A flaw was found in the Linux kernel's qcom qmp-usb-legacy driver. This vulnerability occurs due to a NULL-dereference during an early runtime suspend operation or when a local user re-enables runtime power management via the sysfs attribute before the physical layer PHY is properly initialized...

CVE-2026-90279

A flaw was found in the Linux kernel's md/raid5 component. Incorrect rounding of bitmap stripes during sector division in the raid5bitmapsectormap function can lead to an incorrect mapping of array ranges to component sectors. This issue can result in data corruption or unintended data access...