CVE-2026-90009

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-89989

In the Linux kernel, the following vulnerability has been resolved: ima: Check for ERRPTR from dentrypath in validatehashalgo dentrypath returns ERRPTR-ENAMETOOLONG when the path exceeds the buffer. validatehashalgo passes the result straight to integrityauditmsg without checking. ERRPTR is not...

CVE-2026-89917

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

CVE-2026-89985

In the Linux kernel, the following vulnerability has been resolved: memcg: keep folio's objcg same as its node memcgreparentobjcgs has an inherent assumption that a folio's objcg is the objcg of the folio's node. Folio migration across nodes breaks that assumption: the new folio simply inherits t...

CVE-2026-89922

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...

CVE-2026-89919

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmulock to read gmap-asce Every other dat consumer in this file kvms390getskeys, setskeys, getcmmabits, setcmmabits, MEMCLRCMMA, kvms390fixupprefix, kvmtestagegfn, kvmagegfn reads kvm-arch.gmap-asce inside t...

CVE-2026-89940

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Tie IIO dma fence lock lifetime to the fence The iiodmafence implementation currently uses a lock embedded in the iiodmabufpriv. But the iiodmafence can outlive the iiodmabufpriv, which can cause a use-after-free. Ti...

CVE-2026-89974

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvmeaddctrl fails nvmfcreatectrl owns the fabrics options and frees them whenever -createctrl returns an error, so a transport must not free them on its own error paths. nvme-fc...

CVE-2026-89953

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdoops: free page bitmap when the backing MTD is removed mtdoopsnotifyadd allocates oopspageused when the configured MTD device is registered. mtdoopsnotifyremove detaches from that device but leaves the bitmap allocated. I...

CVE-2026-89915

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

CVE-2026-90044

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix Use-After-Free in AIO error path In ffsepfilewriteiter and ffsepfilereaditer, when ffsepfileio fails with an error other than -EIOCBQUEUED, the iodata structure p is freed. However, for AIO operations, the...

CVE-2026-89961

In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addrpfn tracking in compound vmemmap population vmemmappopulatecompoundpages uses addrpfn to determine the PFN offset within a compound page and to decide whether the current vmemmap slot should be populated...

CVE-2026-90035

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix division by zero in getestimatedbw getestimatedbw divides by link-dpiabwallocconfig.bwgranularity, which is zeroed by resetbwallocstruct and only populated once DPTUNNELINGBWALLOCCAPCHANGED has been handled...

CVE-2026-89910

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Variable vector is declared on stack in function dmsintcinjectirq and sometimes it is used without initialized. Here fix this issue...

CVE-2026-89973

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answer...

CVE-2026-89911

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means i...

CVE-2026-90004

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: handle region split failure in applyminnrregions damonapplyminnrregions repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes...

CVE-2026-89998

In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dmsetupmdqueue walks &md-tabledevices without...

CVE-2026-90032

In the Linux kernel, the following vulnerability has been resolved: media: usbtv: keep device alive while ALSA card exists The ALSA PCM callbacks store the driver state in pcm-privatedata. An open PCM file can outlive USB disconnect because usbtvaudiofree uses sndcardfreewhenclosed. The disconnec...

CVE-2026-89986

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix sleeping allocation in allocpagesbulkweightedinterleave syzbot reported a sleeping function called from invalid context splat in buckettablealloc. When rhashtableinsertslow rehashes the table under rcureadlock, ...

CVE-2026-90003

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-after-free during requeue PI On PREEMPTRT, FUTEXCMPREQUEUEPI can trigger a KASAN report slab-out-of-bounds in futexrequeuepicomplete invocation of rcuwaitwakeup. The futexq used by futexwaitrequeuepi is...

CVE-2026-90026

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel resetwork on stop pdphystop disables IRQs but leaves resetwork pending. If the IRQ handler schedules it just before disableirq, the work runs after remove frees the struct via devm. Call cancelworksy...

CVE-2026-90045

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling iodata stores a pointer to the submitting task's mmstruct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task...

CVE-2026-90027

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop ccdebouncedwork is queued from the setcc and starttoggling callbacks, which run from TCPM's kthread worker. portstop returns before tcpmunregisterport destroys that...

CVE-2026-89957

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...

CVE-2026-90033

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput picks a count of 2 on anything slower than high speed and never relates it to ep-maxtransfer. The URB buffer holds exactly maxtransfer bytes, so ...

CVE-2026-89950

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: linearize skbuff for packet generation batadvmcastforwpacket and batadvmcastforwscrape is not only called indirectly by the unsharing+linearizing batadvrecvmcastpacket handler. When it is called indirectly by...

CVE-2026-90024

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

CVE-2026-89964

In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invalid IRQ value When an invalid value is passed via the "eisairqedge=" kernel command line parameter e.g. "eisairqedge=16,5", eisairqsetup prints an error message and continues witho...

CVE-2026-89918

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-90006

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: handle damonstop failure damonsamplemtierstop assumes its damonstop call will always successfully stops the two DAMON contexts. Hence it deallocates the two DAMON contexts after the damonstop call. However, i...

CVE-2026-89977

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: check MMIO mapping errors in probe devmplatformioremapresource returns an error pointer when the register resource cannot be mapped. ethosuprobe stores it and continues until initialization dereferences it through...

CVE-2026-90039

In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...

CVE-2026-89941

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Make IIO DMA fence release RCU-safe The dmafence documentation states that if a custom release implementation is provided, the dmafence object must be freed in an RCU-safe way. The current iiodmafence implementation...

CVE-2026-89967

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: avoid out-of-bounds writes for compound folios migratedevicerange and migratedevicepfns clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compoun...

CVE-2026-90020

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...

CVE-2026-90012

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...

CVE-2026-90036

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...

CVE-2026-89930

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter KVM services local TLB flushes on "full" nested VM-Exits through nestedvmxvmexit, but not if a nested VM-Enter fails e.g. due to failed VMCS checks in...

CVE-2026-90049

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

CVE-2026-89970

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

CVE-2026-89990

In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in cephmdscheckaccess MDS session OPEN handling replaces mdsc-scapauths under mdsc-mutex, freeing the previous array and its strings. cephmdscheckaccess traverses this array without holding the mutex. A concurren...

CVE-2026-89993

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...

CVE-2026-89979

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the concurrent state transitions between atomic PCM ops, but the checks between the non-atomic ops hwparams, hwfree and prepare and the atomic o...

CVE-2026-89923

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Free guest debug data on vcpu destroy kvms390clearbpdata is only called from kvmarchvcpuioctlsetguestdebug, i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are...

CVE-2026-89925

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory leak in guest debug handling bpdata is freed only for the error case by kfreebpdata. Every successful KVMSETGUESTDEBUG will leak bpdata...

CVE-2026-89937

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: sgp30: Handle IAQ thread creation failure kthreadrun can fail and return an error pointer, but sgpprobe stores it and returns success, so the device is registered without its IAQ thread and sgpremove later passes t...

CVE-2026-89983

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix debugfs UAF on adapter removal i2cdeladapter frees the adapter's debugfs directory before it unregisters the adapter device, but the newdevice sysfs attribute stays writable until devicedel. A write racing with...

CVE-2026-89912

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89965

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. bttfreelistinit and bttrttinit size the per-lane...