CVE-2026-90296

CVE-2026-90296 affects the Linux kernel's cpufreq/imx6q driver. The root cause is a devres allocation leak : imx6_soc_volt was allocated via devm_kcalloc() against the CPU device (get_cpu_device(0)), which is never unbound, so its devres list is never freed. Each driver rebind (probe) therefore a...

CVE-2026-90294

CVE-2026-90294 is a NULL pointer dereference in the Linux kernel's iSCSI over RDMA target (iSER) module. The root cause is a race condition: isert_put_login_tx() transmits the final Login Response before __transport_register_session() completes, so an initiator that immediately issues a SCSI comm...

CVE-2026-90293

CVE-2026-90293 is a NULL pointer dereference in the Linux kernel's IB/isert (iSCSI target over RDMA) component. The function isert_put_login_tx() posts full-feature receive buffers before __transport_register_session() completes, so an iSCSI initiator that sends a SCSI command before receiving th...

CVE-2026-90292

CVE-2026-90292 is a use-after-free in the Linux kernel's RDMA/siw subsystem, specifically in siw_accept() . When a QP supplied by userspace is already in the RTS state, the error cleanup path incorrectly drops a reference from the incoming CEP rather than the existing qp->cep, potentially free...

CVE-2026-90291

CVE-2026-90291 is a use-after-free in the Linux kernel's module/dups subsystem, specifically in the lifetime handling of kmod_dup_req instances. The root cause is that the code relied on RCU to protect concurrent access, but kmod_dup_request_exists_wait() may hold a reference across a blocking wa...

CVE-2026-90290

CVE-2026-90290 affects the Linux kernel on arm64 in the hibernate/suspend path. When swsusp_mte_save_tags() fails, the function swsusp_arch_suspend() returns with the DAIF (Debug, Async, IRQ, FIQ) flags still masked, leaving interrupts in an unexpected disabled state . The fix restores the saved ...

CVE-2026-90289

CVE-2026-90289 is a Linux kernel vulnerability in the drm/amd/display subsystem. The constant AMDGPU_DM_MAX_DISPLAY_INDEX was defined as 31 (implying 32 connectors) but used as a count, creating an off-by-one mismatch with the DRM core, which supports a maximum of 32 connectors. The fix renames t...

CVE-2026-90288

CVE-2026-90288 affects the Linux kernel driver phy: renesas: rcar-gen2. The root cause is a double of_node_put() on the PHY creation failure path: for_each_child_of_node_scoped() already releases the device-tree node reference on scope exit, so the explicit of_node_put(np) in the devm_phy_create(...

CVE-2026-90287

This Linux kernel vulnerability affects the sunplus PHY driver in the function sp_uphy_init() . The error handling paths did not correctly unwind each initialization stage: if clk_prepare_enable() failed, the function should return directly; if reset_control_deassert() failed, only the clock shou...

CVE-2026-90286

CVE-2026-90286 is a Linux kernel vulnerability in the DRM/AMDGPU GFX6 driver. On GFX6 GPUs, compute rings share the same Command Processor (CP) path as the graphics ring, but the Packet Front-End (PFP) was not being correctly used on compute queues. The fix ensures PFP is used for register writes...

CVE-2026-90285

This Linux kernel vulnerability affects the scsi qla2xxx driver. In qla2x00_sysfs_read_vpd(), a redundant second call to ha->isp_ops->read_optrom() is made after releasing optrom_mutex , unlike the first call which holds the mutex. This exposes the flash read to concurrent optrom operations...

CVE-2026-90284

This Linux kernel vulnerability affects the firmware_loader subsystem, specifically the fw_load_sysfs_fallback() function. A race condition exists because device_add() publishes the sysfs loading interface before the firmware request is added to pending_fw_head. A userspace helper discovering the...

CVE-2026-90283

CVE-2026-90283 is a resource management flaw in the Linux kernel's hugetlbfs filesystem. In hugetlbfs_fill_super(), when a hugepage subpool is allocated via hugepage_new_subpool() (triggered by size or min_size mount options) and subsequent root dentry creation fails, the error path releases the ...

CVE-2026-90282

CVE-2026-90282 affects the QCOM QMP USB legacy PHY driver in the Linux kernel. The root cause is a NULL pointer dereference of qmp->phy when the runtime suspend callback executes in a narrow window between pm_runtime_enable() and pm_runtime_forbid(), before the PHY pointer is initialized. The ...

CVE-2026-90281

CVE-2026-90281 affects the Linux kernel driver phy: qcom: snps-femto-v2 . The root cause is a NULL pointer dereference that can occur during early runtime suspend: runtime PM callbacks dereference the hsphy instance before it is fully initialized, because phy_create() enables runtime PM on the PH...

CVE-2026-90280

CVE-2026-90280 is a NULL pointer dereference in the Linux kernel 's Qualcomm QMP USB PHY driver (phy: qcom: qmp-usb). A small timing window exists where the runtime suspend callback executes after pm_runtime_enable() but before pm_runtime_forbid(), causing a crash because the qmp->phy pointer ...

CVE-2026-90279

CVE-2026-90279 affects the Linux kernel md/raid5 subsystem, specifically the raid5_bitmap_sector_map() function. The root cause is that this function aligns array ranges to full RAID5 stripe widths using round_down()/round_up() mask-based arithmetic, which fails when the stripe width (chunk secto...

CVE-2026-90278

CVE-2026-90278 is a use-after-free vulnerability in the Linux kernel's md (multiple device) subsystem , specifically in the bitmap teardown path of __md_stop(). The bug occurred because the bitmap was destroyed before mddev_detach() was called, causing the detach path to skip bitmap_ops->wait_...

CVE-2026-90277

CVE-2026-90277 is a Use-After-Free (UAF) in the Linux kernel's md/md-llbitmap component. When llbitmap_create() fails during bitmap superblock read, the old cleanup path freed the llbitmap structure before clearing mddev->bitmap. Readers relying on bitmap_info.mutex (such as /proc/mdstat ) cou...

CVE-2026-90275

CVE-2026-90275 is a Linux kernel bug in the md/raid1 (Software RAID mirror) driver. In raid1_takeover(), the code sets conf->array_frozen = 1 on the newly-allocated r1conf structure, but nothing subsequently clears it. This became impactful after commit b39f35ebe86d ("md: don't quiesce in mdde...