CVE-2026-93058

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Only fini scheduler after successful init msmringbuffernew destroys a partially initialized ring through msmringbufferdestroy when an allocation or scheduler setup step fails. If drmschedinit fails before it finishes...

CVE-2026-92494

In the Linux kernel, the following vulnerability has been resolved: ext4: fix bufferhead leak in ext4initorphaninfo ext4initorphaninfo reads orphan file blocks with ext4bread and stores the returned bufferhead in oi-ofbinfoi.obbh. If ext4bread succeeds but the orphan block magic or checksum...

CVE-2026-90315

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers Currently, the legacy I/O and memory sysfs handlers do not check securitylockeddownLOCKDOWNPCIACCESS, leaving the legacyio and legacymem files unprotected when the...

CVE-2026-90366

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...

CVE-2026-90402

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix controller cleanup on EDL sysfs failure mhiregistercontroller adds the controller device before creating the optional triggeredl sysfs file. If sysfscreatefile fails, the error path only drops the device...

CVE-2026-90170

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...

CVE-2026-90292

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...

CVE-2026-93047

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Associate BOs with every job that accesses them A submission can expand into a chain of jobs e.g. bin + render + cache clean. Implicit synchronization in v3dsubmitlockreservations is gated on each job's bo, but the BO li...

CVE-2026-90318

In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fatscanlogstart leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fatscan. fatrebuildparent uses the directory entry to rebuild the...

CVE-2026-90122

In the Linux kernel, the following vulnerability has been resolved: clk: visconti: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize onl...

CVE-2026-92513

In the Linux kernel, the following vulnerability has been resolved: RDMA/manaib: drain QP references after partial table insertion manatablestoreudqp publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xainsertirq calls. A concurrent...

CVE-2026-92516

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpfresspinlock Sashiko pointed out correctly that the case statement for BPFRESSPINLOCK incorrectly checks offset for BPFSPINLOCK. Fix it by checking resspinlockoff instead...

CVE-2026-93052

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...

CVE-2026-92508

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...

CVE-2026-90296

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6socvolt is allocated with devmkcalloccpudev, ..., where cpudev is the CPU device from getcpudevice0. That device is never unbound, so its devres list is never...

CVE-2026-93037

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-93055

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

CVE-2026-93040

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

CVE-2026-93045

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...

CVE-2026-90412

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...

CVE-2026-90240

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

CVE-2026-92524

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in itsvpeirqdomainalloc When itsirqgicdomainalloc fails, the following itsvpeirqdomainfree fails to invoke itsvepteardown for the corresponding interrupt, which leaks the resource. Invoke...

CVE-2026-93044

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

CVE-2026-90145

In the Linux kernel, the following vulnerability has been resolved: hinic3: Fix skb linearization mismatch and drop skb when skbchecksumhelp failed Previously, hinic3sendoneskb cached the skb fragment count before calling hinic3txoffload. If hinic3txcsum falls back to skbchecksumhelp for...

CVE-2026-92522

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both MADT and MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generi...

CVE-2026-92485

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARNING in bpftracinglinkrelease The trampoline could be corrupted by the blindly 'tr-flags = BPFTRAMPFTAILCALLCTX' in verifier. 1. A fexit attached to a tailcallreachable prog. 'tr-flags' became 'BPFTRAMPFCALLORIG |...

CVE-2026-92499

In the Linux kernel, the following vulnerability has been resolved: ext4: validate readdir offset before accessing dirent A corrupted directory can trigger the following KASAN report when ext4readdir resumes from an invalid position: BUG: KASAN: use-after-free in ext4checkdirentry+0x5ef/0x820 Rea...

CVE-2026-90435

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

CVE-2026-92487

In the Linux kernel, the following vulnerability has been resolved: exfat: fix validsize extension over a shared writable mapping When a shared writable mapping has its validsize extended by a buffered write or a page fault, exfat zeroes the page-cache gap below the new validsize. A store through...

CVE-2026-90423

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxeodpmrinituser stores &umemodp-umem in mr-umem before calling rxeodpinitpages. If rxeodpinitpages fails, rxeodpmrinituser releases umemodp and returns an error. rxeregusermr the...

CVE-2026-90400

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90252

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync runs. A cancelled entry is leaked, as hcicmdsynccancelentry...

CVE-2026-90224

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in ncidataexchangecomplete nciclosedevice and ncirxwork can both call ncidataexchangecomplete concurrently. After commit 4527025d440ce8 "nfc: nci: fix circular locking dependency in...

CVE-2026-90245

In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wra...

CVE-2026-90387

In the Linux kernel, the following vulnerability has been resolved: swiotlb: Preserve allocation virtual address for dynamic pools swiotlballoctlb can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIGDMADIRECTREMAP, the atomic pool is backed by...

CVE-2026-90276

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmapdestroy deletes pendingtimer before flushing mdllbitmapiowq. However, daemonwork can still be queued or running after the timer has been deleted, and the daemon path can...

CVE-2026-90159

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfg,setsockopt in cgroup UNIX getname hooks bpfsetsockopt and bpfgetsockopt call sockownedbyme for full sockets, so these helpers expect the socket lock to be held. BPFCGROUPUNIXGETPEERNAME and...

CVE-2026-90302

In the Linux kernel, the following vulnerability has been resolved: ocfs2: synchronize heartbeat callbacks with o2net teardown Patch series "ocfs2: harden heartbeat teardown races". This series fixes two OCFS2 heartbeat/o2net teardown races found by KASAN. This patch of 2: Heartbeat callbacks sta...

CVE-2026-90268

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskdev and let scsidiskrelease free sdkp. Going through outfreeindex kfre...

CVE-2026-90384

In the Linux kernel, the following vulnerability has been resolved: iomap: release the folio batch on iomap callback failures A sashiko review of an unrelated patch points out that the folio batch mechanism used for iomap zero range fails to release the batch in a couple error scenarios. If eithe...

CVE-2026-92517

In the Linux kernel, the following vulnerability has been resolved: bpf, riscv: Fix extable handling for arena loadacquire emitatomicldst returns 1 to have buildbody skip the zext after a sub-word loadacquire. The caller does "ret = ret ?: addexceptionhandler...", which skips addexceptionhandler ...

CVE-2026-90151

In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4allocclient allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the...

CVE-2026-90349

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

CVE-2026-90285

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...

CVE-2026-92478

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFSMAXLANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated...

CVE-2026-90327

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller's buffer with mint, but then stores the value with putuserval, int user optval, which always writes sizeofint bytes. A...

CVE-2026-92501

In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write fallback generic/746 started failing intermittently on ext3 no-extent inodes. The test triggers 'Page cache invalidation failure on direct I/O' warnings and subsequent fsync returns...

CVE-2026-92500

In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the live inode state ext4hasinlinedatainode and ext4testinodestateinode, EXT4STATEMAYINLINEDATA in the writeend handlers, use the fsdata parameter...

CVE-2026-90359

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject 8 byte return values on return-reading trampoline paths btfdistillfuncproto builds the function model used for the fentry/fexit/fmodret/fsession trampolines and structops. It has accepted a 16-byte int128 return value...

CVE-2026-90345

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary...