CVE-2026-90075

In the Linux kernel , the fq_codel qdisc (net/sched) fails to clamp the default quantum and codel mtu derived from psched_mtu(). A device whose MTU wraps the value into the sign bit (e.g., a dummy device with max_mtu == 0 accepting MTU 2147483634) causes two distinct failures: (1) the signed flow...

CVE-2026-90074

In the Linux kernel , the fq_pie network scheduling qdisc sets its default quantum from psched_mtu() without clamping. A device with an extremely large MTU (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634) causes psched_mtu() to return 0x80000000, which overflows the signed flow-&g...

CVE-2026-90073

This Linux kernel vulnerability affects the net/sched hhf (Hierarchical Fair Queuing) scheduler. The root cause is that hhf_init() assigns the device MTU directly to the quantum without an overflow check; a device with a very large MTU (e.g., a dummy device with max_mtu == 0 accepting MTU 2147483...

CVE-2026-90071

CVE-2026-90071 is a use-after-free (UAF) in the Linux kernel's TEQL (Traffic Engineering Load Balancing) QoS scheduler (net/sched/sch_teql). The function teql_master_xmit() sets skb->dev to the current slave before attempting transmit but fails to restore it when the transmit fails. The skb th...

CVE-2026-90072

CVE-2026-90072 is a signed overflow vulnerability in the Linux kernel's net/sched: sfq (Stochastic Fairness Queuing) qdisc. In sfq_init(), the quantum value is set from psched_mtu(), which returns an unsigned value. A device with an extremely large MTU (e.g., a dummy device with max_mtu == 0 acce...

CVE-2026-90070

CVE-2026-90070 affects the Linux kernel TPM driver for the st33zp24 chip. The st33zp24_status() function ignores the result of the transport read, returning data even when no byte was received. With the I2C transport , for example, the function skips i2c_master_recv() when the register-select wri...

CVE-2026-90068

CVE-2026-90068 is an off-by-one bounds check in the Linux kernel's ASoC dapm (Digital Audio Processing Module) subsystem. The function snd_soc_dapm_put_enum_double() rejects item[0] when it reaches e->items but permits item[1] to equal that value, causing snd_soc_enum_item_to_val() to read one...

CVE-2026-90069

CVE-2026-90069 is a slab out-of-bounds write in the Linux kernel's crypto acomp subsystem. The macro ACOMP_REQUEST_ON_STACK() reserves storage sized only for the synchronous fallback. When an asynchronous implementation is selected, acomp_request_clone() copies only that stack-sized object, leavi...

CVE-2026-90067

CVE-2026-90067 is a Linux kernel vulnerability in the Ceph messenger v2 protocol implementation (net/ceph/messenger_v2.c). When parsing the msgr2 protocol banner, a client sending a payload_len of 0 causes the kernel to set up a 0-length socket read , violating a state-machine invariant and trigg...

CVE-2026-90065

CVE-2026-90065 affects the Linux kernel 's net/smc subsystem. When an IPPROTO_SMC socket creation fails after the proto->init hook has run (e.g., a cgroup BPF program at BPF_CGROUP_INET_SOCK_CREATE denies the socket), neither smc_inet_prot nor smc_inet6_prot defines a .destroy hook, so the int...

CVE-2026-90066

CVE-2026-90066 affects the Linux kernel 's samples/ftrace module (ftrace-direct-multi-modify). The root cause is a missing IS_ERR() check on the return value of kthread_run() in ftrace_direct_multi_init(). When kthread_run() fails (e.g., returning ERR_PTR(-ENOMEM)), the module loads with simple_t...

CVE-2026-90064

CVE-2026-90064 affects the Linux kernel drm/xe driver (Intel GPU). The root cause lies in the ASID lookup for page fault handling: scratch-enabled VMs that are not in fault mode—including dma-fence mode VMs—are incorrectly admitted. When such a VM faults on an already valid VMA, the handler repor...

CVE-2026-90063

CVE-2026-90063 is a vulnerability in the Linux kernel's virtio-net driver. A user can specify a gso_size smaller than 8 (below TCP_MIN_GSO_SIZE) in a packet crafted via an AF_PACKET PACKET_VNET_HDR socket. Because GSO_MAX_SIZE equals 8 × 65535, dividing the SKB length by a gso_size

CVE-2026-90062

CVE-2026-90062 is a vulnerability in the Linux kernel 's netfilter/nf_tables subsystem. The root cause is an ordering issue where the chain blob was allocated after the ruleset hardware offload, which could leave the offloaded ruleset in the NIC inconsistent with the software ruleset . The fix mo...

CVE-2026-90061

This Linux kernel netfilter nf_tables vulnerability occurs in both the dynset and newsetelem code paths. When no override expressions are provided for a new set element, the kernel clones the existing set expressions twice —once for the template and again for the new element—leading to a referenc...

CVE-2026-90060

CVE-2026-90060 affects the ALSA control subsystem in the Linux kernel . The kcontrol LED state layer naively assumes all associated kcontrol elements are readable, but a write-only element with no get callback (which can even be created by a user element) can trigger a NULL pointer dereference in...

CVE-2026-90059

CVE-2026-90059 is a Linux kernel vulnerability in the stmmac network driver. When the RX path was converted to zero-copy, NET_IP_ALIGN was not carried over into stmmac_rx_offset(), leaving IP headers misaligned on architectures where it is 2 (e.g., ARM32 ). Any received ICMP echo request triggers...

CVE-2026-90058

CVE-2026-90058 is a Linux kernel vulnerability in the net/sched subsystem. The root cause is that qdisc_get_stab() accepts a user-supplied size table, and __qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through overhead, size-table data (u16), and size_log, allowing a crafted stab to set th...

CVE-2026-90057

CVE-2026-90057 is a slab-use-after-free in the Linux kernel's SLIP line discipline . The root cause is a race between slip_hangup() and reader functions such as slip_receive_buf(): tty_ldisc_hangup() held only a read lock on tty->ldisc_sem, allowing slip_close() to run concurrently with reader...

CVE-2026-90056

CVE-2026-90056 affects the Linux kernel FEC (Fast Ethernet Controller) driver. The root cause is a logic error: fec_ptp_init() is only invoked when fep->bufdesc_ex is available, yet fec_ptp_stop() is called unconditionally in fec_probe() (on the failed_init path) and in fec_drv_remove() during...