CVE-2026-92516

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpfresspinlock Sashiko pointed out correctly that the case statement for BPFRESSPINLOCK incorrectly checks offset for BPFSPINLOCK. Fix it by checking resspinlockoff instead...

CVE-2026-92517

In the Linux kernel, the following vulnerability has been resolved: bpf, riscv: Fix extable handling for arena loadacquire emitatomicldst returns 1 to have buildbody skip the zext after a sub-word loadacquire. The caller does "ret = ret ?: addexceptionhandler...", which skips addexceptionhandler ...

CVE-2026-92524

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in itsvpeirqdomainalloc When itsirqgicdomainalloc fails, the following itsvpeirqdomainfree fails to invoke itsvepteardown for the corresponding interrupt, which leaks the resource. Invoke...

CVE-2026-93037

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-93040

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

CVE-2026-93044

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

CVE-2026-93045

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...

CVE-2026-93046

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs was failing when passed UINTMAX, this in turn would lead to an out of bound access in the propert...

CVE-2026-93047

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Associate BOs with every job that accesses them A submission can expand into a chain of jobs e.g. bin + render + cache clean. Implicit synchronization in v3dsubmitlockreservations is gated on each job's bo, but the BO li...

CVE-2026-93052

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...

CVE-2026-93059

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix taskstruct reference leak in recoverworker getpidtask increments the task reference count, but the corresponding puttaskstruct was missing in the else branch, leaking a reference on every GPU hang recovery. Patchwork...

CVE-2026-90292

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...

CVE-2026-90296

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6socvolt is allocated with devmkcalloccpudev, ..., where cpudev is the CPU device from getcpudevice0. That device is never unbound, so its devres list is never...

CVE-2026-90414

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject PDUs declaring more data than was received isertrecvdone hands each received PDU to the opcode handlers without ever looking at wc-bytelen, the number of bytes the HCA actually placed in the receive descriptor. T...

CVE-2026-90242

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice enables IOPF for the new domain but never disables it for the old one. deviceblocktranslation, called at the start of the function, tears down...

CVE-2026-90219

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

CVE-2026-90283

In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fillsuper failure hugetlbfsfillsuper allocates a hugepage subpool when size or minsize mount options are specified. hugepagenewsubpool may also reserve huge pages for minsize. If root dentry creation...

CVE-2026-93055

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

CVE-2026-90399

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in macphycapsparse Currently, in ath12kwmimacphycapsparse, kzalloc sizes the macphycaps buffer as totphyid len, where len is clamped to minfirmwarelen, sizeofstruct ath12kwmimacphycapsparams. The...

CVE-2026-90428

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs tegra241cmdqvprobe requests the error IRQ before it has allocated the cmdqv-vintfs array and set cmdqv-numvintfs. A CMDQV left enabled with a latched error...

CVE-2026-90278

In the Linux kernel, the following vulnerability has been resolved: md: wait for behind writes before destroying bitmap mdstop destroyed the bitmap before calling mddevdetach. That made mddevdetach skip bitmapops-waitbehindwrites, because the bitmap was already disconnected from mddev. This was...

CVE-2026-90249

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

CVE-2026-90222

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

CVE-2026-90202

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warni...

CVE-2026-90115

In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in xskrcv In the xskrcv multi-buffer path, xskbuffalloc is called in a loop without checking its return value. xskbuffcanalloc only counts fill queue entries without validating their addresses, s...

CVE-2026-90266

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge On a zoned FS, btrfsdelayedrefsrsvrefill returns -EAGAIN whenever the over-committed metadata plus the zoneunusable bytes exceeds the usable size in a...

CVE-2026-90351

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached wedhif2 for the secondary function, leaving the device in an...

CVE-2026-90333

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

CVE-2026-90320

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate external xattr entries when reading metadata ocfs2validatexattrblock checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xhcount and...

CVE-2026-90397

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...

CVE-2026-90089

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Validate the FW dump header length nxpprocessfwdump pulls the ACL header off the frame and then reads seqnum and buflen from a struct nxpfwdumphdr placed at skb-data, without checking that the ACL payload is...

CVE-2026-90117

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate usaofs before preserving the update sequence number When ntfsmftrecordalloc reuses a free mft record it reads the old update sequence number straight from the on-disk record: usn = le16 u8 m + le16tocpum-usaofs; He...

CVE-2026-90251

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

CVE-2026-90361

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix leak in ath11kservicereadyextevent Currently, during ath11kservicereadyextevent processing, svcrdyext.macphycaps can be allocated during TLV parsing. This is a temporary allocation that is freed on the success...

CVE-2026-90379

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash When an AER error occurs and the bus is hung, the register reads return 0xFFFFFFFF, causing the DMA queue state to be corrupted and resulting in an invalid...

CVE-2026-90118

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-90353

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix ext PHY use-after-free on register error path After mt7915registerextphy succeeded, a failure of the main PHY mt7915initdebugfs or mt7915coredumpregister unwound through freephy2, which called...

CVE-2026-90151

In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4allocclient allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the...

CVE-2026-90270

In the Linux kernel, the following vulnerability has been resolved: armmpam: Disable driver unbind to avoid UAF When a user unbinds an MSC and that MSC is the only MSC left for a component then the corresponding mpamcomponent will be freed. If the user then goes on to read the schemata file in th...

CVE-2026-90220

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90341

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboottablepopulate bounds checks limit individual entries to the mapped length. However, coreboottableprobe replaces the platform resource length with header and table siz...

CVE-2026-90318

In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fatscanlogstart leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fatscan. fatrebuildparent uses the directory entry to rebuild the...

CVE-2026-92508

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...

CVE-2026-90432

In the Linux kernel, the following vulnerability has been resolved: schedext: Abort directly from the hardlockup handler scxhardlockup defers the abort to an irqwork because exit claiming used to take scxschedlock and couldn't run from NMI. The deferral is now unnecessary - claiming is NMI-safe a...

CVE-2026-90122

In the Linux kernel, the following vulnerability has been resolved: clk: visconti: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize onl...

CVE-2026-90170

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...

CVE-2026-90364

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Unregister cpufreq notifier on init failure acpiprocessordriverinit registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driverregister or...

CVE-2026-90376

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP Problem: MCU command timeout while the firmware state is normal, and the firmware keeps showing the error log "ERROR!! NO PAUSE...". Root cause: If the MLDID field in the TXD ...

CVE-2026-90330

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix FF device cleanup on init failure hidppffinit creates the input force-feedback device with inputffcreate, then allocates the HID++ FF private data, effect ID array, and workqueue. If any of those...

CVE-2026-90394

In the Linux kernel, the following vulnerability has been resolved: power: supply: sc2731charger: cancel work on remove The USB notifier and initial charger detection can schedule info-work. The remove path unregisters the notifier, but does not cancel queued or running work before the...