CVE-2026-90338

CVE-2026-90338 affects the Linux kernel AMBA PL011 serial console driver. The root cause is that pl011_console_write_atomic() calls clk_enable(), which acquires the common-clock enable_lock. Under PREEMPT_RT , this lock can sleep on contention, but atomic (nbcon) context forbids sleeping, trigger...

CVE-2026-90337

CVE-2026-90337 is a Linux kernel vulnerability in the serial core . In serial_core_add_one_port(), the uport->tty_groups and uport->name allocations occur after uart_configure_port() registers the console. If an allocation fails, the driver unwinds the port while its console remains registe...

CVE-2026-90336

CVE-2026-90336 affects the Linux kernel serial core subsystem. When uart_register_driver() fails, drv->state is left pointing to freed memory after tty_alloc_driver() fails, and drv->tty_driver retains a dangling pointer after tty_register_driver() fails. Drivers that use drv->state as a...

CVE-2026-90335

CVE-2026-90335 is a NULL-pointer dereference in the Linux kernel's TTY subsystem (serial core). When TTY device registration fails before a cdev is allocated, the serial core retains the port for use by setserial. On later removal, the NULL cdev slot is passed to cdev_del(), triggering the derefe...

CVE-2026-90334

CVE-2026-90334 is a use-after-free vulnerability in the Linux kernel TTY subsystem. In tty_cdev_add() , when cdev_add() fails, the function drops the cdev reference but leaves driver->cdevs[index] pointing to freed memory. Later, tty_unregister_device() passes that stale pointer to cdev_del() ...

CVE-2026-90332

CVE-2026-90332 affects the Linux kernel 's PCI DesignWare (DWC) endpoint driver . When the Root Complex changes the MSI target address, dw_pcie_ep_raise_msi_irq() unmaps the existing iATU (internal Address Translation Unit) entry and reprograms it for the new address. However, unlike the already-...

CVE-2026-90333

This CVE affects the dm-integrity target in the Linux kernel (standalone mode). The discard-block check in dm_integrity_rw_tag() treats a stored tag of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded, skipping HMAC verification. An attacker with raw write access to the backing devi...

CVE-2026-90331

CVE-2026-90331 affects the hid-asus driver in the Linux kernel . Multiple defects were identified: an unchecked size in asus_raw_event(), a possible use-after-free in asus_probe, unclean teardown on probe failure, sleeping calls in atomic context , and incorrect packet sizes sent to the keyboard ...

CVE-2026-90330

CVE-2026-90330 is a resource leak in the Linux kernel's Logitech HID++ force-feedback driver. In hidpp_ff_init(), if any of the subsequent allocations (HID++ FF private data, effect ID array, or workqueue) fail after input_ff_create() succeeds, the function returns an error without calling input_...

CVE-2026-90329

CVE-2026-90329 is a use-after-free in the Linux kernel HID (Human Interface Device) subsystem. When hid_device_io_start() permits HID reports to run concurrently with device probe, a failed probe can trigger __hid_device_probe() to free driver resources (including the hidraw object) while a repor...

CVE-2026-90327

CVE-2026-90327 is a memory out-of-bounds write in the Linux kernel's phonet: pep subsystem. The vulnerable function pep_getsockopt() clamps the reported length to the caller's buffer using min_t(), but then stores the value via put_user(), which unconditionally writes sizeof(int) bytes. When a ge...

CVE-2026-90328

CVE-2026-90328 affects the Linux kernel 's HID Steam controller driver. The root cause is that FEATURE reports from the Steam Controller encode the message size within the report itself, but the driver previously trusted that the reported size matched the actual number of bytes read , without ver...

CVE-2026-90326

A race condition in the Linux kernel's blk-cgroup subsystem can lead to a use-after-free and memory leak when switching an I/O scheduler on a block device. The race occurs between blkcg_activate_policy() and concurrent blkcg deletion: the rollback path may access already-freed policy data (pd), a...

CVE-2026-90324

CVE-2026-90324 affects the Linux kernel ublk (userspace block device) driver. The vulnerability occurs because the return value of import_ubuf() is not checked: when the address range supplied by the userspace ublk server falls outside the allowed user address space, import_ubuf() fails, and an u...

CVE-2026-90325

CVE-2026-90325 is a use-after-free vulnerability in the Linux kernel's blk-cgroup (block I/O cgroup) subsystem. When switching I/O schedulers on a block device, blkcg_activate_policy() can race with concurrent block-group deletion, causing a double call_rcu and a subsequent use-after-free in rcu_...

CVE-2026-90323

CVE-2026-90323 affects the ublk (Userspace Block) subsystem of the Linux kernel . When the UBLK_F_AUTO_BUF_REG flag is in use, an invalid sqe->addr can fail after ublk_fill_io_cmd() has already set UBLK_IO_FLAG_ACTIVE . This causes the uring_cmd to be completed while the tag remains active, wh...

CVE-2026-90322

CVE-2026-90322 affects the Linux kernel OCFS2 cluster subsystem (nodemanager and disk heartbeat). The root cause is that when the local node is reset via local=0, the cl_has_local flag is left set while cl_local_node is set to the invalid value 255. Heartbeat threads that dynamically re-read o2nm...

CVE-2026-90321

CVE-2026-90321 affects the Linux kernel's OCFS2 filesystem . The root cause is that ocfs2_validate_inode_block() did not validate inline extended-attribute (xattr) entry name/value bounds, allowing getxattr() or listxattr() to walk out-of-range entries from corrupted metadata , leading to a use-a...

CVE-2026-90320

This Linux kernel vulnerability affects the ocfs2 filesystem 's handling of external extended attribute (xattr) metadata. The root cause is insufficient validation in ocfs2_validate_xattr_block(), which fails to verify that non-indexed block entry counts and offsets fit within the block, and that...

CVE-2026-90319

CVE-2026-90319 affects the RapidIO (rio) subsystem in the Linux kernel . The root cause is a use-after-free / double-free bug: when rio_add_net() fails during device registration, rio_scan_alloc_net() releases the allocated rio_net object via put_device(), but the mport->net pointer is left da...