CVE-2026-90222

CVE-2026-90222 is a use-after-free race condition in the Linux kernel's NFC PN533 driver (nfc/pn533). When __pn533_send_async() publishes a command and invokes send_frame(), an incoming I2C frame can trigger command completion, which frees the request skb via consume_skb(). On the I2C transport, ...

CVE-2026-90220

CVE-2026-90220 is a kernel pointer leak in the Linux kernel's ALSA: seq subsystem. The function bounce_error_event() embeds a failed event into the bounce payload by pointing data.ext.ptr at it. For queued variable-length events, this pointer holds the kernel address of the first extension cell (...

CVE-2026-90219

This vulnerability affects the Linux kernel 's RDMA/cxgb4 driver. The root cause is a debugfs dentry leak : c4iw_alloc() creates a per-device debugfs tree via setup_debugfs(), but the tree was only removed in c4iw_remove(), not in c4iw_dealloc(). When RDMA device registration fails, the err_deall...

CVE-2026-90218

CVE-2026-90218 affects the Linux kernel RDMA subsystem, specifically the rdma_restrack_add() path in drivers/infiniband/core/cma.c. During asynchronous address resolution in addr_handler(), if cma_acquire_dev_by_src_ip() fails, the resource is still unconditionally passed to rdma_restrack_add() w...

CVE-2026-90217

This Linux kernel BPF verifier vulnerability (CVE-2026-90217) occurs because an iterator stack slot can hold either MEM_RCU or PTR_UNTRUSTED pointer types, and the verifier fails to distinguish them during state pruning, potentially pruning an unsafe path. The fix compares the pointer type for ST...

CVE-2026-90215

CVE-2026-90215 is a reference-count leak in the Linux kernel's MTD UBI (Unsorted Block Images) subsystem. The function ubi_detach_mtd_dev() obtains a device reference via ubi_get_device() before checking whether the UBI device is busy; on the busy return path it drops ubi->ref_count but leaves...

CVE-2026-90216

CVE-2026-90216 affects the UBI (Unsorted Block Images) module in the Linux kernel . The vulnerability resides in ubi_init_attach(), which rolls back module initialization failures by scanning only ubi_devices[0..i-1], where i is the mtd= parameter index. This logic incorrectly assumes the paramet...

CVE-2026-90214

CVE-2026-90214 affects the Linux kernel ASoC Xilinx formatter_pcm driver. In xlnx_formatter_pcm_open(), stream_data is allocated and the corresponding stream pointer (adata->play_stream or adata->capture_stream) is assigned early. If a subsequent step such as snd_pcm_hw_constraint_step() or...

CVE-2026-90213

CVE-2026-90213 is a memory leak in the Linux kernel 's firewire: core subsystem. The bug occurs in the error path of build_tree(): when an invalid value is detected in the self ID sequence, the function returns early while previously allocated node instances remain in a local linked list, leaking...

CVE-2026-90212

CVE-2026-90212 affects the Linux kernel on arm64 systems that enable software PAN (CONFIG_ARM64_SW_TTBR0_PAN=y) and use EFI runtime services. The fpsimd context management code called from __efi_fpsimd_begin() can voluntarily preempt, causing the code to return to the EFI runtime service call wit...

CVE-2026-90211

CVE-2026-90211 affects the Linux kernel on the s390x architecture. The vulnerability resides in the BPF JIT compiler's handling of read-modify-write (RMW) atomics on arena pointers. Specifically, bpf_jit_probe_atomic_pre() leaves probe->reg at -1 (the sentinel from bpf_jit_probe_init()), so wh...

CVE-2026-90210

CVE-2026-90210 is a Use-After-Free (UAF) in the Linux kernel's BPF trampoline subsystem , specifically in bpf_trampoline_multi_attach_free. When bpf_trampoline_update() fails before modify_fentry_multi() or unregister_fentry_multi() is called, cur_image remains equal to old_image and ftrace conti...

CVE-2026-90209

CVE-2026-90209 affects the Linux kernel s390dbf debug subsystem . A deadlock occurs when a debug area is unregistered (e.g., via rmmod) while an associated debugfs file is simultaneously being written to. Both the unregister path (debug_unregister() → debugfs_remove() → waiting for debugfs_file_p...

CVE-2026-90208

CVE-2026-90208 affects the Linux kernel's Samsung PWM clocksource driver (clocksource/drivers/samsung_pwm). On legacy systems where the Samsung PWM timer serves as a clock source, the samsung_pwm_lock regular spinlock is converted to a sleeping (mutex-based) lock when PREEMPT_RT is enabled on ARM...

CVE-2026-90206

CVE-2026-90206 is a race condition in the Linux kernel's nvmet (NVM Express Target) subsystem. The function nvmet_alloc_ctrl() allocates queue memory based on the subsystem's current max_qid , but a concurrent write via configfs can increase max_qid before the new controller is added to the subsy...

CVE-2026-90207

CVE-2026-90207 is a race condition in the Linux kernel ALSA seq midi subsystem (snd_seq_midi). During input teardown, snd_midi_input_event() can still execute while a rawmidi substream is closing, causing the trigger state to become out-of-step. After rawmidi_release_priv() sets rfile->rmidi t...

CVE-2026-90205

CVE-2026-90205 affects the Linux kernel OCFS2 filesystem . During inode read, ocfs2_validate_inode_block() validates i_suballoc_slot but leaves the active ordinary orphan slot (i_orphaned_slot) unchecked. A corrupted dinode with OCFS2_ORPHANED_FL can therefore carry a slot value outside the mount...

CVE-2026-90204

A use-after-free vulnerability in the Linux kernel OCFS2 filesystem is triggered when a corrupted append-DIO dinode (high byte at offset 0xa1 corrupted from 0 to 1) carries an i_dio_orphaned_slot value outside the mounted filesystem's slot range. The dinode validator fails to check this active sl...

CVE-2026-90203

CVE-2026-90203 is a Linux kernel vulnerability in the Squashfs filesystem driver. A negative block offset read from disk (e.g., the offset into a decompressed fragment block) causes squashfs_copy_data() to perform an out-of-bounds access . The fix checks whether the offset is negative and returns...

CVE-2026-90202

This vulnerability affects the mpt3sas SCSI driver in the Linux kernel . The root cause is in _base_release_memory_pools(), which unconditionally frees every ioc->pcie_sg_lookup[] entry, including entries that were never allocated by the setup loop after a partial failure. This leads to a "bad...