CVE-2026-90398

CVE-2026-90398 is a buffer overflow in the Linux kernel's ath11k WiFi driver , specifically in ath11k_wmi_tlv_mac_phy_caps_parse(). The allocation via kcalloc() sizes the buffer using a clamped length, but the subsequent memcpy() advances by the full struct size per slot. When firmware supplies s...

CVE-2026-90396

CVE-2026-90396 affects the Linux kernel block subsystem. When an integrity mapping fails, it holds a DIO (direct I/O) reference that is not properly released. The fix ensures the full bio ending path is taken, which properly handles previously submitted bios in the sequence and releases the leake...

CVE-2026-90397

CVE-2026-90397 affects the Qualcomm SCM (Secure Channel Manager) driver in the Linux kernel . The root cause is a race condition in qcom_scm_probe(): devm_request_threaded_irq() is called before __scm is published via smp_store_release(), allowing two code paths (the IRQ handler and non-atomic SM...

CVE-2026-90394

CVE-2026-90394 affects the Linux kernel 's sc2731_charger power supply driver. On device removal, the driver unregisters the USB notifier but fails to cancel queued or running info->work before the devm-allocated driver data is released, creating a use-after-free condition. The issue was disco...

CVE-2026-90395

CVE-2026-90395 is a race condition in the Linux kernel's isp1704_charger power supply driver. The USB notifier and initial VBUS detection can schedule isp->work, but the remove path unregisters the notifier and power supply without waiting for queued or running work before tearing down the pow...

CVE-2026-90393

CVE-2026-90393 is a potential Use-After-Free (UAF) in the Linux kernel BPF subsystem , specifically in the function bpf_netns_link_update_prog. The root cause is a race condition : checks for old_prog and the program type are performed locklessly before acquiring netns_bpf_mutex. If two threads c...

CVE-2026-90392

CVE-2026-90392 is a Use-After-Free (UAF) vulnerability in the Linux kernel's BPF subsystem. In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, the link->prog pointer is accessed without holding any locks. If the program is concurrently replaced via bpf_link_update, the old program can be fre...

CVE-2026-90391

CVE-2026-90391 affects the Linux kernel in the lib/test_hmm component. The vulnerable function is dmirror_fault() , called from the dmirror_read() and dmirror_write() retry loops. When the mirrored memory manager (mm) has already exited, mmget_not_zero() fails, but the code incorrectly returns 0 ...

CVE-2026-90390

CVE-2026-90390 affects the Linux kernel md/bitmap subsystem. The root cause is in backlog_store() , which suspends the array before checking whether a write-mostly device exists. If no such device is found, the error path only unlocks reconfig_mutex but leaves the array suspended, blocking subseq...

CVE-2026-90388

CVE-2026-90388 is a Linux kernel vulnerability in the iommu/dma subsystem. The non-blocking, non-coherent DMA allocation path calls dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success. The affected code incorrectly relied on cpu_addr to detect allocation fai...

CVE-2026-90389

CVE-2026-90389 is a bug in the Linux kernel md (multiple device) subsystem . The root cause is that a memalloc_noio_save() token is stored in mddev->noio_flags, allowing one task to save the token and another task to restore it . With concurrent sysfs writes to suspend_lo and suspend_hi, task ...

CVE-2026-90387

CVE-2026-90387 is a Linux kernel vulnerability in the swiotlb (Software I/O Translation Lookaside Buffer) subsystem. When CONFIG_DMA_DIRECT_REMAP is enabled, swiotlb_init_io_tlb_pool() reconstructs the pool virtual address from the physical start address via phys_to_virt(), which yields the wrong...

CVE-2026-90386

This Linux kernel vulnerability affects the DesignWare I3C master driver (drivers/i3c/master/dw-i3c-master.c:905). On an empty I3C bus, the ENTDAA (Enhanced Dynamic Address Assignment) command assigns no devices, causing cmd->rx_len to equal master->maxdevs. The resulting GENMASK() index be...

CVE-2026-90385

This Linux kernel vulnerability affects the md/raid1 module. When a new rdev is added to an existing RAID1 array with serialize_policy enabled, the condition in mddev_create_serial_pool() skips initialization of rdev->serial. The wait_for_serialization() function then dereferences an uninitial...

CVE-2026-90384

CVE-2026-90384 affects the Linux kernel iomap subsystem. The folio batch mechanism used for iomap zero-range operations fails to release the batch when either ->iomap_end() or ->iomap_begin() callbacks fail, as the direct return paths bypass batch cleanup. The ->iomap_end() case is not p...

CVE-2026-90382

CVE-2026-90382 affects the mt76x02 driver in the Linux kernel's mt76 Wi-Fi subsystem. In monitor mode with the fcsfail filter enabled, the hardware can pass up corrupted frames reporting an MPDU length larger than the receive buffer. The existing bounds check correctly discards such frames, but i...

CVE-2026-90383

CVE-2026-90383 affects the Linux kernel's SGI GRU (General Register Unit) driver. The GRU TLB miss handler walks a process's page tables in interrupt context without holding page-table locks or a reference to the mapped page, and uses a kernel page-table accessor on user page tables, supporting o...

CVE-2026-90381

CVE-2026-90381 affects the mt76 WiFi driver in the Linux kernel. The vulnerability resides in mt76_switch_vif_chanctx() : when channel switches occur on different radios within a short timeframe, channel contexts with different bands can be carried for each ieee80211_vif_chanctx_switch structure,...

CVE-2026-90380

CVE-2026-90380 is a use-after-free in the Linux kernel's mt76 WiFi driver (mt792x variant), occurring in mt76_rx_poll_complete due to a race condition: a station (STA) is removed but rx_status still holds a pointer to the freed wcid. The fix sets the links' wcid pointers to NULL in mt7925_sta_pre...

CVE-2026-90379

CVE-2026-90379 affects the Linux kernel's mt76/mt7921 Wi-Fi driver . When a PCIe AER error causes the bus to hang, register reads return 0xFFFFFFFF, corrupting the DMA queue state and leading to an invalid memory access in mt76_dma_add_buf() (kernel panic). The fix validates and clamps the DMA in...