CVE-2026-90296

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6socvolt is allocated with devmkcalloccpudev, ..., where cpudev is the CPU device from getcpudevice0. That device is never unbound, so its devres list is never...

CVE-2026-93037

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-93055

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

CVE-2026-93040

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

CVE-2026-93045

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...

CVE-2026-90428

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs tegra241cmdqvprobe requests the error IRQ before it has allocated the cmdqv-vintfs array and set cmdqv-numvintfs. A CMDQV left enabled with a latched error...

CVE-2026-90302

In the Linux kernel, the following vulnerability has been resolved: ocfs2: synchronize heartbeat callbacks with o2net teardown Patch series "ocfs2: harden heartbeat teardown races". This series fixes two OCFS2 heartbeat/o2net teardown races found by KASAN. This patch of 2: Heartbeat callbacks sta...

CVE-2026-92509

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counterrelease When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end ...

CVE-2026-90263

In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs r...

CVE-2026-90156

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

CVE-2026-92512

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ibqueryqp When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdmarestrackget, meanwhile during the QP destroy path rdmarestrackdel is called at the end o...

CVE-2026-90153

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...

CVE-2026-93050

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-90300

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear buf on error in bpfgettaskstack Both bpfgettaskstack and bpfgettaskstacksleepable helpers that use bpfgettaskstack have buf defined as ARGPTRTOUNINITMEM argument and we should initialize the buf on every return path...

CVE-2026-90433

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

CVE-2026-90182

In the Linux kernel, the following vulnerability has been resolved: blk-iocost: clear delay state when freeing policy data iocgkickdelay turns sufficiently large debt into an explicit block-cgroup delay with blkcgsetdelay, setting blkg-usedelay to -1 and incrementing blkcg-congestioncount. Cleari...

CVE-2026-90247

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

CVE-2026-90410

In the Linux kernel, the following vulnerability has been resolved: spi: davinci: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestthreadedirq. During removal, spibitbangstop only unregisters th...

CVE-2026-90322

In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nmnodelocalstore handles local=0 by stopping o2net and setting cllocalnode to O2NMINVALIDNODENUM, but it leaves clhaslocal set. That stale state makes o2nmthisnode return 255,...

CVE-2026-93062

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

CVE-2026-90407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

CVE-2026-90311

In the Linux kernel, the following vulnerability has been resolved: thermal: hwmon: Remove hwmon class device along with its parent The current code creates one hwmon device per thermal zone type and that device is registered under the first thermal zone of the given type. That turns out to be...

CVE-2026-90234

In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to record When an NFS server grants a delegation in an OPEN reply, nfsinodesetdelegation records it on the client. However, three of its error flows return without sending DELEGRETURN. A...

CVE-2026-90385

In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to array with serializepolicy=1 The following bug has been observed with kernel 7.1.3 after adding a new rdev to an existing RAID1 array with serializepolicy enabled: Oops: 0002 1 CPU: 0...

CVE-2026-92525

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-90105

In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neighreduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address similar to...

CVE-2026-90389

In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave token in mddev-noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter...

CVE-2026-90169

In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauthsession between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates...

CVE-2026-90375

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations mt76txqueueskb overrides the wcid passed by the driver with sta-drvpriv, so the wcid might incorrectly be changed after TX, causing wcid-nonaqlpackets to be counted on th...

CVE-2026-90264

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

CVE-2026-92507

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdeallocpduser When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-90418

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfscopydirtypages on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfscopydirtypages, which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved...

CVE-2026-90256

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...

CVE-2026-92481

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: free EINT resources on unbind mtkeintdoinit creates an IRQ domain, populates it with a mapping for every EINT line and installs a chained handler on the parent interrupt, but none of these are ever released. Th...

CVE-2026-92510

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroysrquser When accessing a SRQ via the netlink path the only synchronization mechanism for the said SRQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-90199

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

CVE-2026-90188

In the Linux kernel, the following vulnerability has been resolved: nullblk: free global tagset on init error path If sharedtags is enabled, nullsetuptagset allocates the global tagset via nullinitglobaltagset. If device creation later fails, errdev destroys the default devices and calls...

CVE-2026-90398

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix stride mismatch in macphycapsparse Currently, in ath11kwmitlvmacphycapsparse, kcalloc sizes the macphycaps buffer as totphyid len, where len is clamped to minfirmwarelen, sizeofstruct wmimacphycapabilities. The...

CVE-2026-90155

In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already...

CVE-2026-90392

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...

CVE-2026-90235

In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE xprtsock replaces and restores sk-skdataready and sk-skwritespace on live sockets with plain stores, and xsudpdosetbuffersize invokes sk-skwritespace via ...

CVE-2026-90119

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup sndice1712probe performs multiple initialization steps after sndcardnew, but directly returns on failures from later steps without releasing the ALSA card,...

CVE-2026-90227

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

CVE-2026-90200

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

CVE-2026-93042

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Terminate all descriptors without callbacks The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst: "No callback functions will be called for...

CVE-2026-90260

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't clobber the extent buffer when zeroing it out On a zoned filesystem a freed-but-still-dirty tree block is written out as zeros EXTENTBUFFERZONEDZEROOUT only to keep the zone write pointer advancing...

CVE-2026-90174

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbdallocuser ksmbdallocuser copies resp-hashsz bytes out of the mountd IPC login response with user-passkeysz = resp-hashsz; user-passkey = kmallocresp-hashsz, KSMBDDEFAULTGFP; if...

CVE-2026-90183

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, checkscalechange scales down its peers, and a peer that reaches...

CVE-2026-90383

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

CVE-2026-90154

In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...