CVE-2026-90431

CVE-2026-90431 is a use-after-free vulnerability in the Linux kernel remoteproc subsystem. The root cause is a race condition between rproc_crash_handler_work() and rproc_del(): a driver can be removed while crash-handler work is scheduled or executing, with no synchronization between the two cod...

CVE-2026-90430

CVE-2026-90430 is a race condition in the Linux kernel's Tegra241 IOMMU command queue virtualization (iommu/tegra241-cmdqv) driver. The function tegra241_vintf_init_lvcmdq() stored a freshly allocated vcmdq pointer into the vintf->lvcmdqs[] array before the underlying arm_smmu_cmdq was fully b...

CVE-2026-90429

CVE-2026-90429 is a race condition in the Linux kernel's iommu/tegra241-cmdqv driver (NVIDIA Tegra 241 IOMMU). The error interrupt service routine (ISR) can read a cmdqv->vintfs[] slot concurrently with VINTF teardown or initialization, leading to a NULL dereference , a use-after-free , or a s...

CVE-2026-90428

CVE-2026-90428 affects the Linux kernel driver iommu/tegra241-cmdqv (NVIDIA Tegra 241 CMDQV IOMMU). The root cause is that __tegra241_cmdqv_probe() requests the error IRQ before allocating the cmdqv->vintfs array and setting cmdqv->num_vintfs. If a CMDQV is left enabled with a latched error...

CVE-2026-90427

This is a use-after-free in the Linux kernel's iommu/tegra241-cmdqv driver (NVIDIA Tegra 241 SMMU command queue). The function __tegra241_cmdqv_probe() calls devm_krealloc() to grow the smmu struct into the larger tegra241_cmdqv, freeing the original pointer. If a subsequent failure path returned...

CVE-2026-90426

CVE-2026-90426 affects the Linux kernel 's tegra241-cmdqv IOMMU driver. In tegra241_cmdqv_remove(), VINTFs are torn down before the error IRQ is freed, creating a window where the ISR can read a stale cmdqv->vintfs[0] slot and pass a NULL or freed pointer to tegra241_vintf0_handle_error(), cau...

CVE-2026-90425

CVE-2026-90425 affects the Linux kernel's iommu/tegra241-cmdqv subsystem (NVIDIA Tegra 241 IOMMU). The vulnerable function tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID taken from master->streams[0]. When a device has multiple streams , only the first is mapped, s...

CVE-2026-90424

This Linux kernel vulnerability affects the Tegra241 CMDQV IOMMU driver (iommu/tegra241-cmdqv). The root cause is a memory leak of the VINTF0 structure on two initialization-failure paths in tegra241_cmdqv_init_structures(). In the first path, a failure in tegra241_cmdqv_init_vintf() returns befo...

CVE-2026-90423

This Linux kernel vulnerability is a Use-After-Free (UAF) in the RDMA/rxe (Soft-RoCE) subsystem, specifically in the ODP (On-Demand Paging) initialization error-handling path. The root cause is that rxe_odp_mr_init_user() stores a pointer to the ODP umem in mr->umem before calling rxe_odp_init...

CVE-2026-90422

CVE-2026-90422 affects the Linux kernel driver clk: mediatek: pllfh (MediaTek PLLFH clock driver). The root cause is an IO remapping leak : when mtk_clk_register_pllfhs fails to register a PLL, its error path unregisters all PLLs and performs cleanup but does not free the IO memory mapped on the ...

CVE-2026-90421

CVE-2026-90421 is a Use-After-Free (UAF) vulnerability in the Linux kernel 's PCI subsystem . The root cause is that dynamic PCI IDs are only guaranteed to be valid while dynids.lock is held, but remove_id_store() can free the node, creating a window where pci_match_device() may access freed memo...

CVE-2026-90420

CVE-2026-90420 affects the nilfs2 filesystem in the Linux kernel. The vulnerability is an infinite loop in nilfs_clean_segments(): when nilfs_segctor_construct() repeatedly returns -EROFS (for example, after a device is remounted read-only following an I/O error), the cleaner thread logs the erro...

CVE-2026-90419

CVE-2026-90419 affects the nilfs2 filesystem in the Linux kernel. The root cause is an out-of-bounds read in super-root block parsing: the super-root inode metadata size is trusted before nilfs_read_inode_common() is invoked, allowing a malformed filesystem image to cause a read past the end of t...

CVE-2026-90418

CVE-2026-90418 affects the Linux kernel's nilfs2 filesystem in the function nilfs_copy_dirty_pages() , which copies dirty DAT file folios/pages to a shadow page cache. The root cause is that the 'dirty' flag of a folio/page can be cleared asynchronously after the filesystem detects metadata corru...

CVE-2026-90417

This CVE affects the Linux kernel RDMA/cxgb4 driver (Chelsio cxgb4). The root cause is improper skb ownership in write_tpt_entry() : when the device is in a fatal error state or allocation fails, the function returns early without freeing the caller's preallocated skb. As a result, c4iw_dereg_mr(...

CVE-2026-90416

This stack out-of-bounds read affects the RDMA/mlx5 driver's cc_params debugfs interface in the Linux kernel . The root cause is a format-string mismatch: get_param() reads a congestion control parameter as a u32 but formats it with the signed "%d" specifier into an 11-byte stack buffer . When a ...

CVE-2026-90415

CVE-2026-90415 affects the Linux kernel RDMA/cxgb4 driver (Chelsio T4/T5/T6). In write_tpt_entry(), a new STAG index is allocated via c4iw_get_resource() and stats.stag.cur is incremented before programming the TPT entry. When the subsequent write_adapter_mem() call fails, the error is returned w...

CVE-2026-90414

CVE-2026-90414 affects the Linux kernel's ib_isert (InfiniBand iSCSI Target) module. The root cause is that isert_recv_done() passes received PDUs to opcode handlers without validating the HCA-reported wc->byte_len against the initiator-declared data-segment length (dlength). Handlers such as ...

CVE-2026-90413

CVE-2026-90413 is a slab-out-of-bounds read in the Linux kernel's iSCSI target over RDMA (isert) subsystem. The root cause is that isert_rx_login_req() copies only the actually-received bytes into a fixed 8192-byte buffer, but subsequent login handlers (iscsi_target_locate_portal() and iscsi_deco...

CVE-2026-90411

CVE-2026-90411 is a DMA mapping leak in the Linux kernel's nvme-fc driver . The function __nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. When the rsp_iu mapping fails, the original code left the already-mapped cmd_iu unmapped and marked the operation as FCPOP_STATE_IDLE. Because blk...