CVE-2026-90013

CVE-2026-90013 is a use-after-free vulnerability in the Linux kernel's ftrace tracing subsystem . When a trace options file is opened, the kernel does not take a reference to the underlying trace_array , so a concurrent removal of the tracing instance by another task can free the options descript...

CVE-2026-90014

A use-after-free vulnerability exists in the Linux kernel tracing subsystem . The newly added show_event_filters and show_event_triggers files iterate over events within a trace array instance but fail to take a reference to that trace_array. This allows the array to be freed via rmdir while a ta...

CVE-2026-90012

CVE-2026-90012 is a Linux kernel SPI bug in DMA mapping ownership on partial map failure. When RX mapping fails after TX mapping succeeds, __spi_map_msg() unmaps TX but leaves tx_sg_mapped set, and cur_{tx,rx}_dma_dev are not yet updated. The subsequent spi_unmap_msg() can then double-free a TX m...

CVE-2026-90010

CVE-2026-90010 affects the Linux kernel's scsi: bsg (block SCSI generic) subsystem. During io_uring completion , the code copied scmd->sense_len into the user response buffer without capping it to max_response_len. After a valid sense, the SCSI midlayer sets sense_len to the actual length (up ...

CVE-2026-90011

CVE-2026-90011 is a critical (CVSS 9.1) out-of-bounds read in the Linux kernel's iSCSI target subsystem . The login->req_buf buffer is allocated at exactly MAX_KEY_VALUE_PAIRS (8192) bytes , but iscsit_get_login_rx() can write the full 8192 bytes when the payload length falls between 8189 and ...

CVE-2026-90009

CVE-2026-90009 is a TOCTOU (time-of-check to time-of-use) race condition in the Linux kernel's scsi: bsg subsystem, specifically in scsi_bsg_uring_cmd() during io_uring passthrough command setup. The function reads bsg_uring_cmd fields from a shared mmap'd SQE; a local attacker with low privilege...

CVE-2026-90007

This vulnerability affects the pm8001 SCSI host controller driver in the Linux kernel . In pm8001_request_msix(), when request_irq() fails, the rollback loop that frees previously registered MSI-X vectors incorrectly uses the failing index i on every iteration instead of the already registered ve...

CVE-2026-90008

The Linux kernel megaraid_sas driver contains a buffer overflow in megasas_make_prp_nvme(), which builds an NVMe PRP list in a fixed-size DMA pool buffer (cmd->sg_frame) without checking bounds. After commit 9b8b84879d4a raised BLK_DEF_MAX_SECTORS_CAP from 1280 KiB to 4 MiB, the required list ...

CVE-2026-90006

CVE-2026-90006 is a use-after-free vulnerability in the Linux kernel's DAMON subsystem, specifically in the mtier sample (samples/damon/mtier). The function damon_sample_mtier_stop() invokes damon_stop() once for two DAMON contexts and then unconditionally deallocates both. If one context has alr...

CVE-2026-90005

CVE-2026-90005 affects the Linux kernel 's samples/damon/wsse module. The function damon_sample_wsse_start() fails to free the DAMON context when damon_start() fails, causing a memory leak . The fix frees the context on failure. The broader patch series (of which this is one of six patches) also ...

CVE-2026-90004

CVE-2026-90004 is a Linux kernel vulnerability in the DAMON (Data Access Monitoring) subsystem (mm/damon/core). The function damon_apply_min_nr_regions() assumes that region splitting (damon_split_region_at()) always succeeds. On a silent memory allocation failure, an invalid pointer can be retur...

CVE-2026-90003

CVE-2026-90003 is a use-after-free in the Linux kernel's futex subsystem, triggered on PREEMPT_RT when a FUTEX_CMP_REQUEUE_PI operation races with a waiter's early wakeup (timeout or signal). The requeue task calls rcuwait_wake_up() after the waiter has already left the syscall and freed its stac...

CVE-2026-90002

CVE-2026-90002 is a use-after-free race condition in the Linux kernel's ftrace subsystem, specifically in the trace instance files set_ftrace_filter and set_ftrace_notrace. When these files are opened, a small race window exists where a concurrent rmdir of the trace instance can free the ftrace_o...

CVE-2026-90001

A race condition in the Linux kernel HID BPF subsystem allows __hid_bpf_ops_destroy_device() and hid_bpf_unreg() to double-put the struct hid_device reference, freeing the device while hid_destroy_device() is still using it. The root cause is a TOCTOU flaw: the two paths run under different lock ...

CVE-2026-90000

The Linux kernel hid-rmi driver allocates its report buffers based solely on the device-supplied report descriptor, with no minimum size bound. A device declaring undersized reports (as small as 1 byte each) causes out-of-bounds reads and writes past the allocation into adjacent slab objects at p...

CVE-2026-89998

This Linux kernel vulnerability affects the Device Mapper (dm) subsystem. A race condition occurs when userspace issues two concurrent table-load ioctls where one succeeds and the other fails: dm_setup_md_queue walks &md->table_devices without holding a lock, racing against dm_table_destroy → ...

CVE-2026-89999

CVE-2026-89999 is an out-of-bounds read in the Linux kernel's HID wacom driver , specifically in wacom_intuos_pro2_bt_irq(). The function receives the wire report length but never validates it before parsing; sub-parsers dereference wacom->data at fixed offsets (up to byte 285 for INTUOSP2_BT/...

CVE-2026-89997

CVE-2026-89997 affects the Linux kernel device-mapper (dm) subsystem . A race condition occurs when the resume and remove ioctls are issued simultaneously: the device may be resumed after being suspended in __dm_destroy, causing the table to be destroyed without invoking the postsuspend method. S...

CVE-2026-89996

CVE-2026-89996 affects the Linux kernel 's dma-heap subsystem. In DMA_HEAP_IOCTL_ALLOC, the file descriptor is installed into the caller's fd table via fd_install() before copy_to_user() completes. If copy_to_user() fails, the fd and its underlying dma-buf reference are leaked for the process lif...

CVE-2026-89994

CVE-2026-89994 affects the Linux kernel 's fsl-edma DMA engine driver . The fsl-edma trace events store a pointer to struct fsl_edma_engine in the ringbuffer and dereference it during log output, at which point the pointer may already be invalid (use-after-free) . A local user with tracing access...