CVE-2026-90278

A flaw was found in the Linux kernel's Multiple Device MD driver, specifically in how it handles bitmap destruction. When the mdstop function was called, it destroyed the bitmap before ensuring all pending write operations were complete. This could lead to RAID1 behind-write completions attemptin...

CVE-2026-90276

A flaw was found in the md/md-llbitmap component of the Linux kernel. During the teardown process, a timing issue can occur where a timer is rearmed after the associated memory has been freed. This can lead to the system attempting to access memory that is no longer allocated, potentially causing...

CVE-2026-90270

A flaw was found in the armmpam driver of the Linux kernel. A local user could trigger a use-after-free vulnerability by unbinding a Memory System Component MSC and then attempting to read the schemata file in the resctrl filesystem. This could lead to system instability or a denial of service...

CVE-2026-90269

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When a BPF program attempts to perform a load-acquire operation on certain untrusted pointers, the BPF verifier fails to apply necessary fault protection. This oversight can lead to a kernel panic if the dereferenced...

CVE-2026-90268

A flaw was found in the Linux kernel's SCSI disk sd driver. Improper error handling during the probing of a SCSI device, specifically after a large pool creation failure, can lead to a situation where an already registered device is freed and a system file system sysfs entry is leaked. This...

CVE-2026-90265

A flaw was found in the btrfs filesystem within the Linux kernel. A local user could trigger a deadlock during file defragmentation when the system attempts to reserve delayed allocation space while holding dirty and locked data. This condition can cause the system to become unresponsive, leading...

CVE-2026-90264

A flaw was found in the Linux kernel's btrfs filesystem. A race condition can occur when direct I/O operations complete prematurely, causing the system to fail to properly wait for existing ordered extents OEs to be cleared. This can lead to conflicting OEs for the same data range. A local attack...

CVE-2026-90263

A flaw was found in the Linux kernel's btrfs filesystem. A local user could bypass the intended read-only protection by setting a POSIX Access Control List ACL on a btrfs filesystem configured as read-only. This vulnerability occurs because the setacl code path fails to properly check the...

CVE-2026-90336

A flaw was found in the Linux kernel's serial core component. When uartregisterdriver fails, pointers to freed memory are not properly cleared. This can allow a local attacker to cause a use-after-free condition by repeatedly attempting to register and bind a serial port. Successful exploitation ...

CVE-2026-90337

A flaw was found in the Linux kernel's serial core component. This vulnerability occurs when the system attempts to allocate resources for a serial port after the console has been registered. If this allocation fails, the driver may improperly handle the port, leading to memory corruption issues...

CVE-2026-90321

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 component. Improper validation of inline extended attributes xattrs during inode block validation can lead to a use-after-free vulnerability. A local attacker could exploit this by providing specially crafted file system...

CVE-2026-90338

A flaw was found in the Linux kernel's amba-pl011 serial driver. When the pl011consolewriteatomic function is called from an atomic context, such as during a printk operation on a PREEMPTRT kernel, it attempts to acquire a sleeping lock. This action is forbidden in an atomic context and can lead ...

CVE-2026-90325

A flaw was found in the Linux kernel's blk-cgroup component. This vulnerability arises from a race condition that occurs when input/output IO schedulers are switched on a block device simultaneously with the deletion of a blk-cgroup. This timing issue can lead to a use-after-free error, which may...

CVE-2026-90324

A flaw was found in the ublk component of the Linux kernel. A local attacker, by providing an invalid address range from a userspace ublk server, could cause the importubuf function to fail. This failure, if not properly handled, leads to an uninitialized data structure being used in subsequent...

CVE-2026-90328

A flaw was found in the Human Interface Device HID subsystem of the Linux kernel, specifically within the Steam Controller driver. This vulnerability arises because the driver trusts the message size encoded within Steam Controller FEATURE reports without verifying that the reported size matches...

CVE-2026-90326

A flaw was found in the Linux kernel's blk-cgroup component. A race condition exists between the activation of an I/O scheduler policy and the destruction of a block group blkg. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated, and memory lea...

CVE-2026-90327

A flaw was found in the Linux kernel's phonet: pep component. A local attacker could exploit an out-of-bounds write vulnerability in the pepgetsockopt function. This occurs when a getsockopt call provides an optlen smaller than sizeofint, causing the function to write a full integer beyond the...

CVE-2026-90334

A flaw was found in the Linux kernel's tty subsystem. When a character device cdev is added and fails, a pointer to the device's memory is not properly cleared. This can lead to a 'use-after-free' vulnerability, where the system attempts to access memory that has already been released. A local...

CVE-2026-90216

A flaw was found in the Linux kernel's Unsorted Block Images UBI subsystem. The ubiinitattach function, responsible for rolling back module initialization failures, incorrectly assumes that the parameter index matches the UBI device number. This can lead to a successfully attached device being...

CVE-2026-90211

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter component, specifically affecting the s390 architecture. When a read-modify-write atomic operation with BPFFETCH faults over an unmapped memory region, a register may not be properly cleared. This can lead to the program resuming...

CVE-2026-90209

A flaw was found in the Linux kernel's s390/debug component. A local user could trigger a deadlock by unregistering an s390dbf debug area while one of its associated debugfs files is being written to. This can lead to a system hang, resulting in a Denial of Service DoS...

CVE-2026-90190

A flaw was found in the nullblk module of the Linux kernel. A race condition occurs during initialization where a mutex is accessed before it is properly set up. A local attacker, by creating a directory in /sys/kernel/config/nullb/ at a specific time, could trigger this race condition. This coul...

CVE-2026-90186

A flaw was found in the Linux kernel's nullblk module. A local user can cause a system crash by attempting to resize device queues while a shared tag set is active. This improper handling of queue resizing leads to a null pointer dereference, which can result in a denial of service...

CVE-2026-90184

A flaw was found in the Linux kernel's nullblk module. A race condition exists where configfs attribute updates can occur concurrently with the nullblk device setup. This lack of synchronization can lead to incorrect device configuration, resulting in a system crash Denial of Service or failure t...

CVE-2026-90160

A flaw was found in the Linux kernel's Lightweight Tunnel BPF lwtbpf component. An attacker, by using a specially crafted BPF program, could cause an insufficient headroom condition after the program modifies the socket buffer skb head. This can lead to the kernel dropping network packets,...

CVE-2026-90147

A flaw was found in the Linux kernel's clock management subsystem. The devmclkgetoptionalenabledwithrate function registers its cleanup action prematurely, before successfully setting the clock rate. If the rate setting fails, the system attempts to disable and unprepare a clock that was never...

CVE-2026-90144

A flaw was found in the Linux kernel's dpll Digital Phase-Locked Loop subsystem. A race condition during device teardown, specifically when a dpll device unregisters while another driver still holds a pin, can lead to a NULL pointer dereference. This issue can cause a kernel crash, resulting in a...

CVE-2026-90220

A flaw was found in the ALSA Advanced Linux Sound Architecture sequencer component of the Linux kernel. An unprivileged local attacker can exploit this vulnerability by sending a specially crafted variable-length event to a non-existent port and then reading the bounced error event. This can lead...

CVE-2026-90217

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. The verifier, responsible for ensuring the safety of BPF programs, incorrectly compared iterator types during state pruning. This discrepancy between MEMRCU and PTRUNTRUSTED states could allow the verifier to prune an...

CVE-2026-90207

A flaw was found in the Advanced Linux Sound Architecture ALSA MIDI sequencer component of the Linux kernel. A race condition can occur during the teardown of a rawmidi substream while input events are being processed. This can lead to a null pointer dereference, allowing a local attacker to caus...

CVE-2026-90201

A flaw was found in the Linux kernel's pagepool networking component. A race condition can occur when the pagepooldestroy function runs concurrently with page return operations. This race condition can lead to a Use-After-Free UAF vulnerability, where the system attempts to access memory after it...

CVE-2026-90221

A flaw was found in the Linux kernel's Near Field Communication NFC NCI NFC Controller Interface component. A remote attacker could exploit this by injecting a specially crafted COREINITRSP packet. This malformed packet, which declares more supported radio frequency interfaces than it provides da...

CVE-2026-90203

A flaw was found in Squashfs, a compressed read-only filesystem within the Linux kernel. A local attacker with administrative privileges could create a specially crafted Squashfs filesystem that contains a negative block offset. If this malicious filesystem is mounted, an unprivileged user could...

CVE-2026-90214

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA System on Chip ASoC Xilinx formatter Pulse-Code Modulation PCM driver. During the opening of an audio stream, memory allocated for stream data is not properly released if an error occurs in a subsequent step. This can...

CVE-2026-90212

A flaw was found in the Linux kernel's arm64 EFI Extensible Firmware Interface implementation. When software PAN Privileged Access Never is enabled, the system can experience a bad kernel memory access. This occurs due to incorrect handling of the TTBR0EL1 register during voluntary preemption...

CVE-2026-90205

A flaw was found in ocfs2 within the Linux kernel. OCFS2 trusts active orphan slot data read from disk inodes without proper validation. A corrupted inode could lead to an out-of-bounds memory access when processing orphan slots, potentially causing system instability or a denial of service...

CVE-2026-90200

A flaw was found in the Linux kernel's NTFS3 file system driver. An integer overflow vulnerability exists in the Multi-File Table MFT cluster validation logic. When processing a specially crafted boot sector, the driver fails to properly validate MFT cluster numbers due to an integer overflow...

CVE-2026-90208

A flaw was found in the Linux kernel's samsungpwm clock source driver. When the PREEMPTRT Preemptible Real-Time feature is enabled on ARM systems, a regular spinlock is incorrectly converted to a sleeping lock. This can lead to a deadlock or system instability, resulting in a Denial of Service Do...

CVE-2026-90165

A flaw was found in the Linux kernel's ksmbd server. This vulnerability occurs when the ksmbdstopdurablescavenger function attempts to stop a kernel thread that was not properly initialized, leading to an invalid pointer dereference. An attacker could potentially exploit this to cause a system...

CVE-2026-90210

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. This use-after-free UAF vulnerability occurs when the bpftrampolineupdate function fails during an update operation. This failure can lead to a previously freed memory region being accessed, potentially resulting in syst...

CVE-2026-90204

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 component. A local attacker could exploit a vulnerability where a corrupted filesystem metadata entry, specifically an append-DIO dinode, contains an out-of-range orphan slot value. The OCFS2 dinode validator fails to...

CVE-2026-90218

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA Connection Manager Assistant CMA component. During asynchronous address resolution, a programming error could lead to a warning assertion in the restort function. This occurs when a device acquisition fails, but the resource ...

CVE-2026-90199

A flaw was found in the Linux kernel's fs/ntfs3 file system driver. An issue in the mienumattr function, responsible for validating virtual cluster numbers VCNs for non-resident attributes, could allow a local attacker to craft a malformed on-disk attribute. This malformed attribute, with an...

CVE-2026-90198

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture core. A local user could exploit a use-after-free vulnerability when a sound card is unbound while a user-space application still holds an open file descriptor. This race condition allows the system to attempt to access...

CVE-2026-90197

A flaw was found in the Linux kernel's Human Interface Device HID haptic subsystem. A local attacker could exploit a vulnerability in the filleffectbuf function, which incorrectly writes uninitialized or leftover memory values to the field-value array for unhandled haptic usages. This uninitializ...

CVE-2026-90196

A flaw was found in the Linux kernel's Sound Open Firmware SOF component. This vulnerability occurs due to improper validation of topology mixer volume ranges. An attacker could potentially provide malformed volume range values, leading to an integer overflow during memory allocation. This could...

CVE-2026-90195

A flaw was found in the Linux kernel's RISC-V 64-bit RV64 Just-In-Time JIT compiler for Berkeley Packet Filter BPF programs. The RV64 JIT fails to perform proper sign-extension for signed 1-byte and 2-byte kernel function kfunc arguments. This oversight can lead to incorrect processing of data...

CVE-2026-90193

A flaw was found in the Linux kernel's qcom-cpucp mailbox driver. Under specific PREEMPTRT configurations, the qcomcpucpmboxirqfn interrupt handler attempts to re-acquire a spinlock it already holds. This re-entrant lock attempt causes a permanent deadlock within the kernel. This can lead to a...

CVE-2026-90192

A flaw was found in the Linux kernel's qcom-cpucp mailbox driver. The qcomcpucpmboxsenddata function, responsible for sending data, did not properly handle a NULL data pointer when mailboxclearchannel attempted to notify the remote side that the receive RX channel was cleared. This blind...

CVE-2026-90191

A flaw was found in the Linux kernel's mailbox: riscv-sbi-mpxy component. This vulnerability arises from insufficient validation of the SBI System Binary Interface return value, which dictates the number of bytes copied from shared memory into the RPMI RISC-V Platform Management Interface...