CVE-2026-90273

CVE-2026-90273 affects the Linux kernel in the coresight etm4x driver. In the perf enable path, cscfg_csdev_disable_active_config() is not called in two error cases: when branch broadcast is selected but not supported by hardware, and when etm4_enable_hw() fails. This results in a leak of config_...

CVE-2026-90271

This vulnerability affects the Linux kernel's arm_mpam (Memory Partitioning and Monitoring) driver. The root cause is a NULL pointer dereference that occurs when a user unbinds an MSC (Memory System Component) after mpam_disable() has been called in response to an error interrupt, which sets the ...

CVE-2026-90272

This vulnerability affects the Linux kernel 's ARM PMU v3 performance monitoring subsystem (perf: arm_pmuv3). The BRBE (Branch Record Buffer Extension) driver passes the hw_id field to userspace via PERF_SAMPLE_BRANCH_HW_INDEX, but never sets it, leaving it as uninitialized data . According to ke...

CVE-2026-90270

CVE-2026-90270 affects the arm_mpam driver in the Linux kernel . A use-after-free occurs when a user unbinds the last Memory System Component (MSC) for a given component, causing the corresponding mpam_component to be freed. A subsequent read of the schemata file in the resctrl filesystem then ac...

CVE-2026-90268

CVE-2026-90268 is a memory management flaw in the Linux kernel 's SCSI sd driver. In sd_probe(), when sd_large_pool_create() fails after device_add(&sdkp->disk_dev) has already succeeded, the error path incorrectly calls kfree() on an already-registered device instead of unregistering it via s...

CVE-2026-90269

CVE-2026-90269 affects the Linux kernel BPF subsystem. The verifier fails to rewrite BPF_LOAD_ACQ (load-acquire) into a BPF_PROBE_MEM load, unlike a regular BPF_LDX . As a result, the JIT emits a plain load with no exception-table entry, so a page fault on that load panics the kernel instead of b...

CVE-2026-90267

CVE-2026-90267 affects the Linux kernel SCSI disk driver (scsi: sd). The vulnerability is a mempool leak of the special_vec page used for UNMAP and WRITE SAME commands. When sd_set_special_bvec() allocates the payload page and a subsequent call to scsi_alloc_sgtables() fails (in sd_setup_unmap_cm...

CVE-2026-90266

CVE-2026-90266 affects the btrfs zoned filesystem in the Linux kernel. When btrfs_delayed_refs_rsv_refill() returns a transient -EAGAIN (triggered when over-committed metadata plus zone_unusable bytes exceeds the usable size in a metadata block-group), the transaction is aborted during block-grou...

CVE-2026-90265

CVE-2026-90265 is a deadlock in the Linux kernel's btrfs filesystem, occurring between the defrag path and delalloc space reservation. The root cause is that btrfs_defrag_file reserves delalloc space while still holding dirty and locked folios and the extent range lock , causing a lock-ordering d...

CVE-2026-90264

CVE-2026-90264 is a race condition in the Linux kernel's btrfs filesystem that can cause a kernel BUG/panic . The bug occurs when a direct IO finishes short: the file's isize is reverted, which skips the ordered extent (OE) wait during subsequent buffered writeback. This allows a new OE to be ins...

CVE-2026-90263

CVE-2026-90263 affects the Linux kernel's btrfs filesystem . When the btrfs read-only property is set to true, all write operations including ACL and xattr should be denied. However, POSIX ACLs could still be set because a prior commit (353c2ea735e4) removed a readonly-root check from btrfs_setxa...

CVE-2026-90262

CVE-2026-90262 affects the Linux kernel's btrfs filesystem in its handling of dm-verity Merkle tree pages . The root cause is in btrfs_read_merkle_tree_page(), which treats a not-uptodate folio found in the page cache as a permanent read error (-EIO). This makes a prior transient I/O failure stic...

CVE-2026-90261

CVE-2026-90261 affects the Linux kernel 's btrfs zoned filesystem . The vulnerability resides in btree_writepages() and the active block group pivot logic (btrfs_check_meta_write_pointer() ). During ascending-address writeback, if the active metadata block group sits at a higher logical address t...

CVE-2026-90260

CVE-2026-90260 is a btrfs zoned filesystem vulnerability in the Linux kernel . The root cause is that btree_csum_one_bio() memzeroed the extent buffer's own folios before submission to advance the zone write pointer, destroying in-memory data while it was still referenced. When btrfs_free_tree_bl...

CVE-2026-90259

CVE-2026-90259 affects the btrfs qgroup subsystem of the Linux kernel . The bug is in qgroup_free_reserved_data(), where the length calculation incorrectly uses round_up(start + len, sectorsize)—yielding the rounded-up end position rather than the rounded-up length . This produces an erroneously ...

CVE-2026-90258

This vulnerability affects the Linux kernel pinctrl airoha driver. The root cause is a missing .irq_request_resources callback, which prevents gpiolib from setting GPIOD_FLAG_USED_AS_IRQ. As a result, pin direction locking is broken, allowing userspace or another driver to reconfigure an active I...

CVE-2026-90257

CVE-2026-90257 affects the Linux kernel 's Bluetooth virtio_bt driver. The function virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and passes the response to bt_dev_info() and hci_set_fw_info() as an unbounded "%s" string starting at skb->data + 1, withou...

CVE-2026-90256

This is a Use-After-Free (UAF) vulnerability in the Linux kernel's Bluetooth L2CAP subsystem. The hci_conn::l2cap_data field is accessed without adequate locking in l2cap_disconn_ind, reached via the path hci_conn_timeout → hci_proto_disconn_ind → l2cap_disconn_ind. If the l2cap_conn is deleted c...

CVE-2026-90255

CVE-2026-90255 is a Linux kernel vulnerability in the Bluetooth HCI subsystem affecting the SCO setup context lifetime. The root cause is twofold: hci_setup_sync() queues a conn_handle_t with a NULL destroy callback, causing a memory leak when the pending entry is cancelled (e.g., during controll...

CVE-2026-90254

CVE-2026-90254 is a memory leak in the Linux kernel's Bluetooth HCI sync subsystem. The function adv_timeout_expire() passes a kmalloc()ed advertising instance byte to hci_cmd_sync_queue() with a NULL destroy callback , causing the buffer to leak on two paths: (1) when hci_cmd_sync_queue() fails ...