CVE-2026-90047

This vulnerability affects the Linux kernel's drm/xe driver (Intel Xe GPU driver). The get_flat_ccs_offset() function incorrectly rounds up the flat CCS (Compressed Caching System) storage boundary to 128 KiB instead of rounding down to the allocator's page size, exposing a small region of memory...

CVE-2026-90045

CVE-2026-90045 is a use-after-free vulnerability in the Linux kernel 's USB gadget FunctionFS (ffs) driver. The io_data structure stores a pointer to the submitting task's mm_struct but fails to hold a reference while asynchronous requests remain pending. If the task exits before completion handl...

CVE-2026-90044

CVE-2026-90044 is a Use-After-Free vulnerability in the Linux kernel USB gadget f_fs (function filesystem) module, specifically in ffs_epfile_write_iter() and ffs_epfile_read_iter(). When ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed, but for AIO oper...

CVE-2026-90043

CVE-2026-90043 affects the zram module in the Linux kernel on 64-bit big-endian systems. The root cause is a bit-position aliasing bug: the slot lock bit is computed over the entire __lock word, where flags and ac_time alias as two u32 values. On big-endian, the lock bit lands in the ac_time half...

CVE-2026-90042

CVE-2026-90042 affects the Linux kernel's Ceph filesystem client . The root cause is that the messenger client uses kvmalloc() to allocate message buffers, which can place them in the vmalloc() region when physical memory fragmentation prevents a sufficiently large kmalloc(). The fscrypt subsyste...

CVE-2026-90041

CVE-2026-90041 is a use-after-free vulnerability in the Linux kernel's HID Sony driver (hid-sony). When input_register_device() fails after sony_input_configured() has already linked a controller to sony_device_list, the probe unwind path frees the devres-managed sony_sc structure while its list ...

CVE-2026-90040

CVE-2026-90040 affects the Linux kernel KVM SEV-SNP (AMD Secure Nested Paging) subsystem. When the backing guest_memfd page for the guest-provided VMSA (Virtual Machine State Area) is invalidated (e.g., via PUNCH_HOLE or memslot deletion/move), KVM fails to invalidate the vCPU's cached control.vm...

CVE-2026-90039

This Linux kernel vulnerability affects the NFSD subsystem. Writing to /proc/fs/nfsd/unlock_filesystem or sending the NFSD_CMD_UNLOCK_FILESYSTEM/NFSD_CMD_UNLOCK_EXPORT netlink commands walks NFSv4 client hash tables, but the existing guard (nn->nfsd_serv) is set before nn->conf_id_hashtbl i...

CVE-2026-90038

A use-after-free in the Linux kernel NFSD component affects nfsd4_revoke_export_states() , which drops nn->client_lock across revoke_one_stid() and a subsequent read of clp->cl_minorversion without pinning the client. A teardown racing the dropped lock can free the client while it is still ...

CVE-2026-90037

CVE-2026-90037 is a use-after-free in the Linux kernel's NFSD (NFS server daemon) component. An nfs4_openowner left on the close_lru list after its final CLOSE holds a raw pointer to its nfs4_client. When the laundromat reaps timed-out entries and drops client_lock, a concurrent force_expire_clie...

CVE-2026-90035

CVE-2026-90035 affects the Linux kernel AMD display driver (drm/amd/display ). The root cause is a division by zero in the get_estimated_bw() function, which divides by link->dpia_bw_alloc_config.bw_granularity—a value zeroed by reset_bw_alloc_struct() and only populated after DP_TUNNELING_BW_...

CVE-2026-90036

This is a use-after-free in the Linux kernel NFSD (NFS server daemon) subsystem. A bare lock owner holds a raw pointer to its nfs4_client without a reference keeping the client alive. When the per-net laundromat reaps a blocked lock, the owner reference is dropped via flc_owner, and a concurrent ...

CVE-2026-90034

CVE-2026-90034 affects the Linux kernel's usb_mdc800 driver (USB Image MDC800). The root cause is the use of kmalloc() instead of kzalloc() for the irq_urb_buffer and download_urb_buffer allocations in usb_mdc800_init(). Because the memory is not zero-initialized, a shorter-than-expected message ...

CVE-2026-90032

This is a use-after-free vulnerability in the Linux kernel's usbtv (USB TV) media driver. The ALSA PCM callbacks store driver state in pcm->private_data, and because usbtv_audio_free() uses snd_card_free_when_closed(), an open PCM file can outlive a USB disconnect. The disconnect path can then...

CVE-2026-90033

CVE-2026-90033 is an out-of-bounds write in the Linux kernel 's ALSA usb-audio subsystem, specifically in the snd_usbmidi_us122l_output() function. The root cause is that the function uses a fixed transfer count of 2 on speeds below high-speed without checking ep->max_transfer. When a device (...

CVE-2026-90031

CVE-2026-90031 affects the Linux kernel's ene_ub6250 USB storage driver. The root cause is a race condition on the shared us->current_urb field: the delayed scan work (via usb_stor_Bulk_max_lun()) and the probe path (via ene_get_card_type()) both access it concurrently, with only the scan path...

CVE-2026-90029

CVE-2026-90029 is a use-after-free vulnerability in the Linux kernel 's USB storage realtek_cr driver, triggered on device disconnect . The root cause is that realtek_cr_destructor() calls timer_delete() before the chip containing the timer is freed, allowing the timer callback to rearm itself ag...

CVE-2026-90030

CVE-2026-90030 affects the Linux kernel USB DWC3 driver on DWC_usb31 v2.00a and v2.10a controllers. The root cause is the forceRM bit of the DEPCMD register being set to 1 when issuing the EndTransfer command, as recommended by older DWC3 programming guide revisions. With forceRM=1, a transfer ab...

CVE-2026-90028

CVE-2026-90028 affects the Linux kernel USB Type-C driver for the hd3ss3220 controller. The root cause is that regulator_is_enabled() reports the aggregate regulator state rather than whether this particular consumer holds an enable reference. When another consumer enables VBUS first, the driver ...

CVE-2026-90027

CVE-2026-90027 affects the Linux kernel's qcom-pmic-typec USB Type-C driver. A use-after-free race occurs when port_stop() returns before tcpm_unregister_port() destroys the TCPM kthread worker; flushing that worker during unregister can run a callback (set_cc() or start_toggling()) that re-queue...