CVE-2026-90355

CVE-2026-90355 affects the mt76/mt7996 WiFi driver in the Linux kernel. After a full chip reset, the reset path frees link structures without clearing the valid_links bits or the MLD index masks. When mac80211 replays its reconfiguration, mt7996_vif_link_add() short-circuits because the link IDs ...

CVE-2026-90354

CVE-2026-90354 affects the Linux kernel mt76/mt7915 Wi-Fi driver. The function mt7915_pci_init_hif2() was invoked unconditionally and a second time inside the WED-inactive branch, causing the global hif_idx to be double-incremented, the PCIe RECOG_ID register to be written twice, and a device ref...

CVE-2026-90353

CVE-2026-90353 is a use-after-free vulnerability in the Linux kernel's mt76/mt7915 Wi-Fi driver. After mt7915_register_ext_phy() succeeds, a failure in mt7915_init_debugfs() or mt7915_coredump_register() causes the error path (free_phy2) to call ieee80211_free_hw() on the external PHY while it is...

CVE-2026-90352

CVE-2026-90352 affects the mt76: mt7915 WiFi driver in the Linux kernel . The root cause is a resource leak : the hif2 reference obtained by mt7915_pci_init_hif2() is only released on error paths that key off dev->hif2, which is not assigned until after IRQ setup. If pci_alloc_irq_vectors() or...

CVE-2026-90351

This vulnerability affects the Linux kernel mt76:mt7996 Wi-Fi driver's WED (Wireless Event Device) attach path. When the WED attach for the primary PCIe function fails during probe, the driver still attaches wed_hif2 for the secondary function, leaving the device in an inconsistent half-WED confi...

CVE-2026-90350

CVE-2026-90350 affects the mt76 WiFi driver in the Linux kernel (mt7996 variant). The function mt76_vif_link() indexes the mvif->link[] array without validating link_id. Callers pass deflink_id, which holds IEEE80211_LINK_UNSPECIFIED (0xf) until the first link is added. Since IEEE80211_MLD_MAX...

CVE-2026-90349

CVE-2026-90349 is an out-of-bounds array access in the Linux kernel's mt76 mt7996 Wi-Fi driver. In mt7996_tx() , when mac80211 leaves the link unspecified, the primary link id is IEEE80211_LINK_UNSPECIFIED (0xf) —a value of 15—yet it is used unchecked to index vif->link_conf[] , mvif->mt76....

CVE-2026-90347

CVE-2026-90347 is a flaw in the Linux kernel on arm64 architectures, in the ptrace subsystem's handling of the orig_x0 register. A prior fix (commit e057b9477232) intended to prevent a tracer from manipulating the first syscall argument (x0) without seccomp or audit scrutiny was incomplete: it fa...

CVE-2026-90348

CVE-2026-90348 affects the Linux kernel's ath10k WiFi driver in its SNOC variant on WCN3990 hardware. The MSA (Modem Software Area) region is mapped via devm_memremap(MEMREMAP_WT), which on arm64 is not Normal-cacheable and does not permit unaligned accesses. However, ath10k_msa_dump_memory() use...

CVE-2026-90346

This Linux kernel vulnerability affects the nl80211 WiFi subsystem. The root cause is a memory leak in nl80211_color_change(): when nl80211_parse_beacon() fails while parsing the beacon_next template, it returned directly without releasing previously allocated mbssid_ies and rnr_ies buffers via t...

CVE-2026-90345

This vulnerability affects the brcmfmac Wi-Fi driver in the Linux kernel . Certain P2P action frame code paths incorrectly assume that the P2P device virtual interface (vif) is always present. This assumption breaks when userspace sends non-P2P public action frames through the primary interface, ...

CVE-2026-90344

CVE-2026-90344 affects the Linux kernel 's mac80211 WiFi subsystem. A refactor of the Channel Switch Announcement (CSA) parsing logic erroneously treats channel zero as equivalent to "no information present," causing the driver to ignore a CSA from an access point that advertises a switch to that...

CVE-2026-90343

CVE-2026-90343 is a use-after-free vulnerability in the Linux kernel cfg80211 WiFi subsystem. The functions cfg80211_stop_p2p_device() and cfg80211_stop_nan() fail to abort active PMSR (Passive Measurements for Spectrum Regulation) requests before removing the mac80211 subinterface from the drive...

CVE-2026-90342

CVE-2026-90342 is a deadlock in the Linux kernel BPF subsystem, specifically in the arena_vm_fault() path. The root cause is that arena_vm_fault() returns VM_FAULT_RETRY when it fails to acquire arena->spinlock, without ever having taken mmap_lock. The fault handler (do_user_addr_fault) then r...

CVE-2026-90341

CVE-2026-90341 affects the Linux kernel's coreboot firmware driver . The vulnerable function coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or adve...

CVE-2026-90340

CVE-2026-90340 affects the Linux kernel pinctrl generic subsystem. The root cause is a memory leak in the error path of pinctrl_generic_to_map(): when subsequent operations (such as pinctrl_utils_add_map_mux(), pinctrl_generic_add_group(), or pinconf_generic_parse_dt_config()) fail after partial ...

CVE-2026-90338

CVE-2026-90338 affects the Linux kernel AMBA PL011 serial console driver. The root cause is that pl011_console_write_atomic() calls clk_enable(), which acquires the common-clock enable_lock. Under PREEMPT_RT , this lock can sleep on contention, but atomic (nbcon) context forbids sleeping, trigger...

CVE-2026-90339

CVE-2026-90339 is a Linux kernel vulnerability affecting the PowerPC architecture (both ppc32 and ppc64). After enabling GENERIC_ENTRY , the sentinel value -1 returned by syscall_enter_from_user_mode() to indicate that seccomp or ptrace had already set a return value was not handled correctly in ...

CVE-2026-90337

CVE-2026-90337 is a Linux kernel vulnerability in the serial core . In serial_core_add_one_port(), the uport->tty_groups and uport->name allocations occur after uart_configure_port() registers the console. If an allocation fails, the driver unwinds the port while its console remains registe...

CVE-2026-90336

CVE-2026-90336 affects the Linux kernel serial core subsystem. When uart_register_driver() fails, drv->state is left pointing to freed memory after tty_alloc_driver() fails, and drv->tty_driver retains a dangling pointer after tty_register_driver() fails. Drivers that use drv->state as a...