CVE-2026-90316

CVE-2026-90316 affects the drm/omap DSI driver in the Linux kernel. The root cause is a Use-After-Free (UAF) risk: the ISR (interrupt service routine) table was copied to allow unregistration of ISRs, but stack-allocated objects passed to those ISRs may be freed if IRQs are unregistered while sti...

CVE-2026-90314

CVE-2026-90314 is an out-of-bounds read vulnerability in the Linux kernel remoteproc subsystem, specifically in rsc_table_for_each_entry(). The root cause is a signed/unsigned type mismatch : table->offset[i] is a u32 value supplied by firmware, but was stored into a signed int. A crafted offs...

CVE-2026-90312

CVE-2026-90312 affects the Linux kernel BPF verifier . In check_atomic_load(), the function calls check_load_mem() before atomic_ptr_type_ok(). When a load-acquire fetches into its own source register (dst_reg == src_reg), check_load_mem() overwrites the source register's type, causing atomic_ptr...

CVE-2026-90313

CVE-2026-90313 affects the Linux kernel BPF/cgroup subsystem. When a cgroup BPF program is replaced using BPF_F_REPLACE and the replacement fails midway (e.g., in bpf_trampoline_link_cgroup_shim or update_effective_progs), the cleanup path frees the new storage but fails to restore pl->storage...

CVE-2026-90311

CVE-2026-90311 affects the Linux kernel thermal hwmon subsystem. When a thermal zone holding a hwmon class device is removed (e.g., via unbinding the ACPI thermal driver), the removal can get stuck because another thermal zone of the same type has sysfs attributes registered under that hwmon devi...

CVE-2026-90310

CVE-2026-90310 affects the Linux kernel 's xen/xenbus driver. A race condition exists where the xenstore watch thread (xenwatch ) can trigger xenbus_dev_changed() before the otherend_id field is initialized during device probe (e.g., on module load). The still-zeroed otherend_id is then misinterp...

CVE-2026-90309

CVE-2026-90309 is a use-after-free vulnerability in the Linux kernel's RDMA/erdma subsystem. Event Queue (EQ) handlers look up Completion Queues (CQs) from dev->cq_xa and invoke CQ completion or error callbacks outside the xarray lock. The function erdma_destroy_cq() can erase the CQ from the ...

CVE-2026-90307

CVE-2026-90307 is a heap information disclosure vulnerability in the Linux kernel's RDMA/srp (SCSI RDMA Protocol) subsystem. The root cause is that srp_process_cred_req() and srp_process_aer_req() read fixed-size fields from the receive buffer without verifying that the data was actually present....

CVE-2026-90308

CVE-2026-90308 is a use-after-free race condition in the Linux kernel's RDMA/erdma subsystem. AE QP fatal events and iWARP CM paths load queue pairs from dev->qp_xa and then reference them outside the xarray lock, while erdma_destroy_qp() can concurrently free those QP resources. The fix intro...

CVE-2026-90306

CVE-2026-90306 affects the Linux kernel on ARM architectures. The vulnerability resides in the hw_breakpoint_cfi_handler() stub, which was unconditionally claiming breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) even when CFI (Control Flow Integrity) was not actively instrumented in the kernel. T...

CVE-2026-90305

CVE-2026-90305 affects the Linux kernel on ARM when PREEMPT_RT is enabled. The root cause is that commit c6e61c06d606 enabled PREEMPT_RT on ARM without selecting HAVE_POSIX_CPU_TIMERS_TASK_WORK , leaving CPU timers to expire in hard IRQ context . On PREEMPT_RT, this causes run_posix_cpu_timers() ...

CVE-2026-90304

CVE-2026-90304 affects the Linux kernel on ARM architectures. The vulnerability resides in the exception handlers do_DataAbort() and do_PrefetchAbort() , where PREEMPT_RT requires interrupts to be enabled when sending signals. However, when an unhandled user fault is triggered (i.e., the hook fun...

CVE-2026-90303

CVE-2026-90303 affects the Linux kernel on ARM architecture. When CONFIG_DEBUG_USER=y and the kernel command-line option user_debug=31 are active, a user fault can trigger show_pte() without holding any lock. If another thread in the same process concurrently calls munmap() , page table pages may...

CVE-2026-90301

CVE-2026-90301 is a use-after-free in the Linux kernel's OCFS2 file system heartbeat subsystem (o2hb ). The struct o2hb_region is exposed to o2net negotiate handlers before the heartbeat runtime is fully initialized, and can be freed while in-flight callbacks or delayed timeout work still referen...

CVE-2026-90302

CVE-2026-90302 is a use-after-free vulnerability in the Linux kernel's OCFS2 (Oracle Cluster File System 2) subsystem. The race occurs between heartbeat callbacks and o2net teardown : when configfs local-node teardown calls o2net_stop_listening(), a concurrent node-down event can still reach o2ne...

CVE-2026-90300

CVE-2026-90300 affects the Linux kernel BPF subsystem, specifically the __bpf_get_task_stack helper used by both bpf_get_task_stack and bpf_get_task_stack_sleepable. The buffer argument is declared as ARG_PTR_TO_UNINIT_MEM, requiring initialization on every return path, but the error/fail paths w...

CVE-2026-90298

CVE-2026-90298 affects the Linux kernel Allwinner DRM (drm/sun4i) TCON driver . The root cause is a device reference leak : the function of_find_device_by_node() acquires a device reference, which was not dropped after mux configuration succeeds. The fix, provided in the referenced kernel commits...

CVE-2026-90299

CVE-2026-90299 affects the Linux kernel BPF subsystem. When CONFIG_FUNCTION_ERROR_INJECTION is disabled, the BPF verifier fails to distinguish whether an attachment target symbol is a kernel function or a BPF program , allowing a sleepable tracing program to attach to a non-kernel BPF program who...

CVE-2026-90297

CVE-2026-90297 is a null pointer dereference (kernel oops) in the Linux kernel's drm/sun4i driver (Allwinner). The function sun4i_crtc_init() returns plain NULL when layer initialization fails, while its other error paths return an error pointer. Its sole caller, sun4i_tcon_bind(), checks the res...

CVE-2026-90295

CVE-2026-90295 affects the Linux kernel cpufreq driver for i.MX6 (imx6q). The root cause is that soc_opp_count has static storage and is never reset between driver probe cycles. On a second bind after an unbind, imx6_soc_volt is freshly re-allocated (sized to the current number of ARM OPPs), but ...