CVE-2026-90350

CVE-2026-90350 affects the mt76 WiFi driver in the Linux kernel (mt7996 variant). The function mt76_vif_link() indexes the mvif->link[] array without validating link_id. Callers pass deflink_id, which holds IEEE80211_LINK_UNSPECIFIED (0xf) until the first link is added. Since IEEE80211_MLD_MAX...

CVE-2026-90349

CVE-2026-90349 is an out-of-bounds array access in the Linux kernel's mt76 mt7996 Wi-Fi driver. In mt7996_tx() , when mac80211 leaves the link unspecified, the primary link id is IEEE80211_LINK_UNSPECIFIED (0xf) —a value of 15—yet it is used unchecked to index vif->link_conf[] , mvif->mt76....

CVE-2026-90347

CVE-2026-90347 is a flaw in the Linux kernel on arm64 architectures, in the ptrace subsystem's handling of the orig_x0 register. A prior fix (commit e057b9477232) intended to prevent a tracer from manipulating the first syscall argument (x0) without seccomp or audit scrutiny was incomplete: it fa...

CVE-2026-90348

CVE-2026-90348 affects the Linux kernel's ath10k WiFi driver in its SNOC variant on WCN3990 hardware. The MSA (Modem Software Area) region is mapped via devm_memremap(MEMREMAP_WT), which on arm64 is not Normal-cacheable and does not permit unaligned accesses. However, ath10k_msa_dump_memory() use...

CVE-2026-90346

This Linux kernel vulnerability affects the nl80211 WiFi subsystem. The root cause is a memory leak in nl80211_color_change(): when nl80211_parse_beacon() fails while parsing the beacon_next template, it returned directly without releasing previously allocated mbssid_ies and rnr_ies buffers via t...

CVE-2026-90345

This vulnerability affects the brcmfmac Wi-Fi driver in the Linux kernel . Certain P2P action frame code paths incorrectly assume that the P2P device virtual interface (vif) is always present. This assumption breaks when userspace sends non-P2P public action frames through the primary interface, ...

CVE-2026-90344

CVE-2026-90344 affects the Linux kernel 's mac80211 WiFi subsystem. A refactor of the Channel Switch Announcement (CSA) parsing logic erroneously treats channel zero as equivalent to "no information present," causing the driver to ignore a CSA from an access point that advertises a switch to that...

CVE-2026-90343

CVE-2026-90343 is a use-after-free vulnerability in the Linux kernel cfg80211 WiFi subsystem. The functions cfg80211_stop_p2p_device() and cfg80211_stop_nan() fail to abort active PMSR (Passive Measurements for Spectrum Regulation) requests before removing the mac80211 subinterface from the drive...

CVE-2026-90342

CVE-2026-90342 is a deadlock in the Linux kernel BPF subsystem, specifically in the arena_vm_fault() path. The root cause is that arena_vm_fault() returns VM_FAULT_RETRY when it fails to acquire arena->spinlock, without ever having taken mmap_lock. The fault handler (do_user_addr_fault) then r...

CVE-2026-90341

CVE-2026-90341 affects the Linux kernel's coreboot firmware driver . The vulnerable function coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or adve...

CVE-2026-90340

CVE-2026-90340 affects the Linux kernel pinctrl generic subsystem. The root cause is a memory leak in the error path of pinctrl_generic_to_map(): when subsequent operations (such as pinctrl_utils_add_map_mux(), pinctrl_generic_add_group(), or pinconf_generic_parse_dt_config()) fail after partial ...

CVE-2026-90339

CVE-2026-90339 is a Linux kernel vulnerability affecting the PowerPC architecture (both ppc32 and ppc64). After enabling GENERIC_ENTRY , the sentinel value -1 returned by syscall_enter_from_user_mode() to indicate that seccomp or ptrace had already set a return value was not handled correctly in ...

CVE-2026-90338

CVE-2026-90338 affects the Linux kernel AMBA PL011 serial console driver. The root cause is that pl011_console_write_atomic() calls clk_enable(), which acquires the common-clock enable_lock. Under PREEMPT_RT , this lock can sleep on contention, but atomic (nbcon) context forbids sleeping, trigger...

CVE-2026-90337

CVE-2026-90337 is a Linux kernel vulnerability in the serial core . In serial_core_add_one_port(), the uport->tty_groups and uport->name allocations occur after uart_configure_port() registers the console. If an allocation fails, the driver unwinds the port while its console remains registe...

CVE-2026-90336

CVE-2026-90336 affects the Linux kernel serial core subsystem. When uart_register_driver() fails, drv->state is left pointing to freed memory after tty_alloc_driver() fails, and drv->tty_driver retains a dangling pointer after tty_register_driver() fails. Drivers that use drv->state as a...

CVE-2026-90335

CVE-2026-90335 is a NULL-pointer dereference in the Linux kernel's TTY subsystem (serial core). When TTY device registration fails before a cdev is allocated, the serial core retains the port for use by setserial. On later removal, the NULL cdev slot is passed to cdev_del(), triggering the derefe...

CVE-2026-90334

CVE-2026-90334 is a use-after-free vulnerability in the Linux kernel TTY subsystem. In tty_cdev_add() , when cdev_add() fails, the function drops the cdev reference but leaves driver->cdevs[index] pointing to freed memory. Later, tty_unregister_device() passes that stale pointer to cdev_del() ...

CVE-2026-90332

CVE-2026-90332 affects the Linux kernel 's PCI DesignWare (DWC) endpoint driver . When the Root Complex changes the MSI target address, dw_pcie_ep_raise_msi_irq() unmaps the existing iATU (internal Address Translation Unit) entry and reprograms it for the new address. However, unlike the already-...

CVE-2026-90333

This CVE affects the dm-integrity target in the Linux kernel (standalone mode). The discard-block check in dm_integrity_rw_tag() treats a stored tag of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded, skipping HMAC verification. An attacker with raw write access to the backing devi...

CVE-2026-90331

CVE-2026-90331 affects the hid-asus driver in the Linux kernel . Multiple defects were identified: an unchecked size in asus_raw_event(), a possible use-after-free in asus_probe, unclean teardown on probe failure, sleeping calls in atomic context , and incorrect packet sizes sent to the keyboard ...