CVE-2026-90409

CVE-2026-90409 affects the Linux kernel drm/panthor driver. The root cause is a missing overlap check: when a VM is created, the caller specifies an address-space carve-out for mapping kernel buffer objects (BOs), yet vm_bind mappings of user-mode-exposed BOs were not verified to stay outside tha...

CVE-2026-90408

CVE-2026-90408 affects the ath12k WiFi driver in the Linux kernel. The root cause is twofold: a missing TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT (so no minimum length is enforced), and the firmware-supplied num_vdevs field being used as an unbounded loop counter over the vd...

CVE-2026-90407

CVE-2026-90407 affects the ath11k Linux WiFi driver in the function ath11k_wmi_process_csa_switch_count_event(). Two root causes produce an out-of-bounds read : (1) no TLV policy entry exists for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum le...

CVE-2026-90405

CVE-2026-90405 affects the Linux kernel driver media: stm32: dcmi, specifically error handling in its probe() function. Three bugs are identified: (1) after requesting a DMA channel via dma_request_chan(), the first error path returns without cleanup; (2) error paths check dcmi->mdma_chan befo...

CVE-2026-90406

CVE-2026-90406 affects the Linux kernel 's qcom iris media driver . The vulnerability resides in iris_core_deinit(), where the return value of pm_runtime_resume_and_get() was not checked. If the runtime PM resume fails, the driver would proceed with hardware power-off operations and call pm_runti...

CVE-2026-90404

CVE-2026-90404 is a Linux kernel vulnerability in the cros_ec_debugfs driver (platform/chrome). The root cause is a use-after-free : when the debugfs device is removed, the panic notifier registered by cros_ec_debugfs_probe() is not unregistered. A subsequent panic notification can therefore invo...

CVE-2026-90403

CVE-2026-90403 affects the Linux kernel's rtlwifi PCI driver . In the last error path of rtl_pci_probe(), a wrong goto label causes cleanup functions to be skipped, leaving previously successful calls to rtl_init_rfkill(), ieee80211_register_hw(), and rtl_debug_add_one() unreverted. The fix updat...

CVE-2026-90402

CVE-2026-90402 is a Linux kernel flaw in the MHI host controller driver (bus: mhi: host). The function mhi_register_controller() registers the controller device before attempting to create the optional trigger_edl sysfs file. When sysfs_create_file() fails, the error path only calls put_device() ...

CVE-2026-90401

CVE-2026-90401 affects the Linux kernel md (multiple device) subsystem, specifically the raid1 , raid10 , and raid456 personalities. The root cause is that REQ_NOWAIT support is fundamentally incomplete for these personalities: when a write to one mirror succeeds while another returns -EAGAIN , m...

CVE-2026-90400

CVE-2026-90400 is a race condition in the Linux kernel's md/raid10 subsystem. In md_start_sync(), the check for whether spare configuration changes are needed can become stale before reconfig_mutex is acquired, because the rdev state may change in the interim. This allows md_choose_sync_action() ...

CVE-2026-90399

This Linux kernel vulnerability affects the ath12k WiFi driver (Qualcomm WCN7850 hardware). In ath12k_wmi_mac_phy_caps_parse(), the buffer is allocated with a size of tot_phy_id * len where len is clamped to min(firmware_len, sizeof(struct)), but the subsequent memcpy() advances the destination b...

CVE-2026-90398

CVE-2026-90398 is a buffer overflow in the Linux kernel's ath11k WiFi driver , specifically in ath11k_wmi_tlv_mac_phy_caps_parse(). The allocation via kcalloc() sizes the buffer using a clamped length, but the subsequent memcpy() advances by the full struct size per slot. When firmware supplies s...

CVE-2026-90396

CVE-2026-90396 affects the Linux kernel block subsystem. When an integrity mapping fails, it holds a DIO (direct I/O) reference that is not properly released. The fix ensures the full bio ending path is taken, which properly handles previously submitted bios in the sequence and releases the leake...

CVE-2026-90397

CVE-2026-90397 affects the Qualcomm SCM (Secure Channel Manager) driver in the Linux kernel . The root cause is a race condition in qcom_scm_probe(): devm_request_threaded_irq() is called before __scm is published via smp_store_release(), allowing two code paths (the IRQ handler and non-atomic SM...

CVE-2026-90394

CVE-2026-90394 affects the Linux kernel 's sc2731_charger power supply driver. On device removal, the driver unregisters the USB notifier but fails to cancel queued or running info->work before the devm-allocated driver data is released, creating a use-after-free condition. The issue was disco...

CVE-2026-90395

CVE-2026-90395 is a race condition in the Linux kernel's isp1704_charger power supply driver. The USB notifier and initial VBUS detection can schedule isp->work, but the remove path unregisters the notifier and power supply without waiting for queued or running work before tearing down the pow...

CVE-2026-90393

CVE-2026-90393 is a potential Use-After-Free (UAF) in the Linux kernel BPF subsystem , specifically in the function bpf_netns_link_update_prog. The root cause is a race condition : checks for old_prog and the program type are performed locklessly before acquiring netns_bpf_mutex. If two threads c...

CVE-2026-90392

CVE-2026-90392 is a Use-After-Free (UAF) vulnerability in the Linux kernel's BPF subsystem. In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, the link->prog pointer is accessed without holding any locks. If the program is concurrently replaced via bpf_link_update, the old program can be fre...

CVE-2026-90391

CVE-2026-90391 affects the Linux kernel in the lib/test_hmm component. The vulnerable function is dmirror_fault() , called from the dmirror_read() and dmirror_write() retry loops. When the mirrored memory manager (mm) has already exited, mmget_not_zero() fails, but the code incorrectly returns 0 ...

CVE-2026-90390

CVE-2026-90390 affects the Linux kernel md/bitmap subsystem. The root cause is in backlog_store() , which suspends the array before checking whether a write-mostly device exists. If no such device is found, the error path only unlocks reconfig_mutex but leaves the array suspended, blocking subseq...