CVE-2026-90421

• CVE-2024-36894
  • usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
• CVE-2026-97447
  • ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
• CVE-2026-93822
  • PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
• CVE-2026-93826
  • HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• CVE-2026-97954
  • net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
• CVE-2026-97949
  • configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• CVE-2026-97931
  • ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• CVE-2026-97940
  • ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• CVE-2026-97539
  • usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• CVE-2026-74510
  • Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• CVE-2026-72084
  • scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-90321
  • ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-74637
  • perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• CVE-2026-74752
  • sctp: validate cookie AUTH state before use {CVE-2026-74752}
• CVE-2026-74387
  • ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• CVE-2026-80536
  • xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• CVE-2026-89659
  • NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• CVE-2026-80576
  • drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• CVE-2026-90223
  • nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
• CVE-2026-80994
  • net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• CVE-2026-72398
  • sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• CVE-2026-74583
  • net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• CVE-2026-72322
  • ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• CVE-2026-93095
  • hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
• CVE-2026-72472
  • nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-90421
  • PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• CVE-2026-64583
  • usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
• CVE-2026-68329
  • iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
• CVE-2026-89448
  • iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• CVE-2026-64001
  • ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
• CVE-2026-64305
  • crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• CVE-2026-64348
  • usb: free iso schedules on failed submit {CVE-2026-64348}
• CVE-2026-64422
  • net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• CVE-2026-90180
  • block:…

• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
• wifi: libipw: reject too-short association responses {CVE-2026-98348}
• net: lock the socket in sock_gettstamp() {CVE-2026-98276}
• ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
• wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
• wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• ALSA: usb-audio: fix OOB write in…

• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
• wifi: libipw: reject too-short association responses {CVE-2026-98348}
• net: lock the socket in sock_gettstamp() {CVE-2026-98276}
• ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
• wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
• wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• ALSA: usb-audio: fix OOB write in…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• dm array: validate array block headers on read {CVE-2026-89574}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• nvmet-rdma: handle inline…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• dm array: validate array block headers on read {CVE-2026-89574}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• nvmet-rdma: handle inline…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• dm array: validate array block headers on read {CVE-2026-89574}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• nvmet-rdma: handle inline…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• net: Introduce skb tc depth field to track packet loops {CVE-2026-63983}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• ata: libata-core: Reject an invalid concurrent positioning ranges count {CVE-2026-72030}
• wifi: mac80211: validate extension-frame layout before RX {CVE-2026-68470}
• wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() {CVE-2026-68470}
• drm/amd/pm: fix pptable use-after-free {CVE-2026-74450}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: clear ce->tgthint in free_tgts() {CVE-2026-89636}
• smb: client: harden DFS cache against invalid target hints {CVE-2026-93210}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• HID: sony: clean up device list on probe failure {CVE-2026-90041}
• drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
• hwrng: core - fix rng list on registration error {CVE-2026-93163}
• RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104}
• fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() {CVE-2026-93100}
• bpf: Fix potential UAF when reading bpf link info {CVE-2026-90392}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171}
• netfilter: cttimeout: prevent UAF during module unload {CVE-2026-97609}
• thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367}
• ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312}
• scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887}
• scsi: target: Fix hexadecimal CHAP_I handling {CVE-2026-63886}
• scsi: target: iscsi: Validate CHAP_R length before base64 decode {CVE-2026-63886}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• nfsd: RCU-protect cl_cb_session to fix…

• net: bridge: fix vlan tunnel dst refcnt when egressing {CVE-2021-47222}
• net: bridge: fix vlan tunnel dst null pointer dereference {CVE-2021-47223}
• writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378}
• writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
• writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
• fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount {CVE-2026-64378}
• libceph: validate banner payload length {CVE-2026-90067}
• drm/virtio: release the GEM object on virtio_gpu_vram_create() errors {CVE-2026-98606}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs {CVE-2026-74390}
• nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685}
• vdpa_sim_blk: reject out-of-range sector starts {CVE-2026-97991}
• Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
• HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
• nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482}
• nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386}
• bpf: mark a NULL call argument precise {CVE-2026-98019}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get {CVE-2026-72262}
• ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes() {CVE-2026-72262}
• Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• fs/resctrl: Fix UAF from worker threads when domains are removed {CVE-2026-93099}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
• openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• sctp: diag: reject stale associations in dump_one path {CVE-2026-52917}
• sctp: Hold sock lock while iterating over address list {CVE-2026-52917}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• nfsd: gate nfs3…

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix UAF when probe runs concurrent to dyn ID removal

Dynamic IDs are only guaranteed to be valid when dynids.lock is held, as remove_id_store() can free the node. Thus, make a copy in pci_match_device(). Also, clarify that the id parameter is only valid during probe.

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when dynids.lock is held, as remove_id_store() can free the node. Thus, make a copy in pci_match_device(). Also, clarify that the id parameter is only valid during probe.

These are all security issues fixed in the kernel-devel-7.2.8-1.1 package on the GA media of openSUSE Tumbleweed.

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when dynids.lock is held, as remove_id_store() can free the node. Thus, make a copy in pci_match_device(). Also, clarify that the id parameter is only valid during probe.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…