CVE-2026-90253

In the Linux kernel Bluetooth MGMT subsystem , mesh_send_cancel() queues a pending command with a NULL destroy callback , meaning it is only freed if send_cancel() actually runs. When the entry is cancelled (e.g., by hci_cmd_sync_clear() on controller unregistration), _hci_cmd_sync_cancel_entry()...

CVE-2026-90251

CVE-2026-90251 affects the Linux kernel's Bluetooth MSFT driver . In read_supported_features(), the evt_prefix_len field (an unvalidated u8) is used to call kmemdup without checking it against the actual response length. A malicious or buggy Bluetooth controller can declare evt_prefix_len = 255 i...

CVE-2026-90252

CVE-2026-90252 is a memory and socket-reference leak in the Linux kernel's Bluetooth MGMT subsystem. The root cause is that mgmt_hci_cmd_sync() queues a pending HCI command with a NULL destroy callback , meaning a cancelled entry is never freed. When a controller is unregistered, hci_cmd_sync_cle...

CVE-2026-90250

CVE-2026-90250 is a null pointer dereference vulnerability in the Linux kernel's BPF/cgroup subsystem . The issue occurs when a BPF program using BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE replaces an empty prog via link_update. The root cause is that __cgroup_bpf_replace fails to allocate and assign the...

CVE-2026-90248

This Linux kernel vulnerability affects the net/sched: cls_api (traffic control classifier) subsystem. In tc_new_tfilter(), when a caller loses the insert race in tcf_chain_tp_insert_unique(), the tp_created flag is never cleared. The loser's error path then treats the winner's live proto as its ...

CVE-2026-90249

This Linux kernel vulnerability affects the gp2ap002 IIO light/proximity sensor driver. The root cause is that the IIO core does not filter duplicate writes to the event enable attribute, causing write_event_config() to be invoked twice. Enabling an event twice leaks a runtime PM reference, preve...

CVE-2026-90247

CVE-2026-90247 affects the Linux kernel BPF subsystem . The vulnerability resides in the per-CPU mmap_unlock_work irq_work slot shared by stack_map_get_build_id_offset() and bpf_find_vma(). Because both callers only check whether the work is busy before taking mmap_lock, a nested caller can reuse...

CVE-2026-90246

AppArmor in the Linux kernel contains an integer overflow in the verify_tags() bounds check during policy blob validation. The 32-bit addition i + cnt wraps when an attacker-supplied count is near U32_MAX , bypassing the guard and causing an out-of-bounds read past a kcalloc allocation in the set...

CVE-2026-90245

CVE-2026-90245 affects the Linux kernel fbdev kyro driver. Overlay viewport end coordinates are computed using 32-bit unsigned arithmetic from the viewport origin and dimensions. Large input values can cause these calculations to wrap around before the results are passed to SetOverlayViewPort(), ...

CVE-2026-90244

CVE-2026-90244 is a race condition in the Linux kernel's iommu/dma subsystem affecting the VFIO type1 legacy container . When an IOMMU publishes IOMMU_RESV_SW_MSI (e.g., ARM SMMU ), two devices sharing the same merged domain can concurrently enter iommu_dma_get_msi_page() under different group mu...

CVE-2026-90243

CVE-2026-90243 is a race condition in the Linux kernel's VT-d IOMMU driver. The function copied_context_tear_down() zeroes a 128-bit context entry while the Present bit is still set , creating a window where the IOMMU hardware can fetch a torn entry —some fields zeroed while Present remains set. ...

CVE-2026-90241

CVE-2026-90241 is a use-after-free vulnerability in the Linux kernel 's Intel VT-d IOMMU driver (iommu/vt-d). When intel_pasid_setup_sm_context() fails partway through programming scalable-mode context entries for a PCI device's DMA aliases, the probe failure path in intel_iommu_probe_device() fr...

CVE-2026-90242

CVE-2026-90242 affects the Linux kernel iommu/vt-d subsystem. When an IOMMU domain is replaced at RID level , the iopf_refcount for the old domain is never decremented. Both intel_iommu_attach_device() and identity_domain_attach_dev() enable IOPF for the new domain but fail to disable it for the ...

CVE-2026-90240

CVE-2026-90240 is a Linux kernel vulnerability in the Intel VT-d IOMMU driver. When tearing down DMA aliases, the functions domain_context_clear_one() and device_pasid_table_teardown() issued a context-cache invalidation using the device's own requester ID rather than the alias's bus/devfn . This...

CVE-2026-90239

CVE-2026-90239 is a memory leak in the Linux kernel 's AMD ISP4 media driver . The function isp4if_alloc_fw_gpumem() allocates several GPU memory pools in sequence; if one allocation fails, the function returns -ENOMEM without releasing the pools already successfully allocated, leaking them . The...

CVE-2026-90238

CVE-2026-90238 affects the Linux kernel AMD ISP4 media driver. The isp4sd_pwron_and_init() function holds ops_mutex via a guard and, on any initialization failure, calls isp4sd_pwroff_and_deinit() , which attempts to re-acquire the same non-recursive mutex already held by the current thread — cau...

CVE-2026-90237

CVE-2026-90237 affects the Linux kernel in the netfilter nft_ct module. The root cause is that early insertion of expectations into the expectations list for unconfirmed conntracks leads to stale entries pointing to the wrong hlist_head through .pprev due to conntrack extension reallocation. The ...

CVE-2026-90235

CVE-2026-90235 affects the Linux kernel 's SUNRPC transport socket layer (xprtsock ). The root cause is that xprtsock replaces and restores the shared sk->sk_data_ready and sk->sk_write_space callback pointers using plain stores, and xs_udp_do_set_buffer_size() invokes sk->sk_write_space...

CVE-2026-90236

CVE-2026-90236 affects the Linux kernel NFSD (NFS server daemon). The bug is a reference-counting flaw in NFSv4 state ID teardown: free_ol_stateid_reaplist() frees open and lock stateids via ->sc_free() without releasing the svc_export reference, unlike nfs4_put_stid(). This pins the export an...

CVE-2026-90234

CVE-2026-90234 is a Linux kernel NFS client vulnerability in nfs_inode_set_delegation(). Three error paths in this function return without sending DELEGRETURN , silently dropping a delegation the server still believes the client holds. When the server later recalls that delegation, the client res...