A vulnerability in the Linux kernel's btrfs zoned filesystem handling has been resolved. The issue involved the kernel forcing a read-only state on transient -EAGAIN errors from reloc merge operations, which could abort transactions unnecessarily. This was due to improper handling of the -EAGAIN return code from btrfs_delayed_refs_rsv_refill() during metadata block-group reclaim operations. The fix treats -EAGAIN as a soft, retryable condition to avoid premature transaction aborts.
A vulnerability in the Linux kernel md/raid1 subsystem caused the array_frozen flag to be set and never cleared during raid1_takeover(), leading to permanent I/O stalls on the affected RAID1 arrays. This issue arose after a prior kernel change removed a call that cleared this flag, causing the stall condition to persist. The fix avoids setting the array_frozen flag unnecessarily during takeover.
A vulnerability in the Linux kernel's iommu/tegra241-cmdqv driver could cause the error interrupt service routine (ISR) to run before the probe function properly initializes required data structures. This occurs because the error IRQ is requested before the vintfs array is allocated and zeroed. As a result, a latched error interrupt firing early can cause the ISR to access uninitialized memory, potentially leading to undefined behavior. The issue is resolved by requesting the IRQ only after the vintfs array is safely allocated and initialized.
A vulnerability in the Linux kernel's virtio-net driver allows crafted TCP packets with a gso_size smaller than the minimum TCP GSO size to cause an overflow in the 16-bit gso_segs field. This occurs when a user crafts packets using an AF_PACKET PACKET_VNET_HDR socket with gso_size values less than 8, potentially leading to incorrect segmentation calculations. The issue has been resolved by enforcing a minimum gso_size of 8 for TCP packets while maintaining valid UDP GSO packet handling.
Since early May 2026, a large-scale phishing campaign has targeted individuals with fraudulent text messages claiming their T-Mobile rewards points are about to expire. The messages create urgency by stating that point balances, typically cited as 18,400 points, will expire imminently if not redeemed. Recipients are directed to click on phishing links using rotating domains designed to mimic legitimate T-Mobile websites. The campaign has generated over 1,000 closely related message templates with only superficial variations in salutations, dates, and point balances. The operation experienced two major spikes in activity before declining. The criminals employed at least 81 domains over four months, all following a recognizable pattern. These messages use generic greetings and formal language to appear legitimate, exploiting social engineering tactics to trick recipients into divulging login credentials, personal information, or payment details.
CVE-2026-90427 is a high-severity vulnerability in the Linux kernel affecting version 6.12. It involves improper handling of a memory reallocation function in the iommu/tegra241-cmdqv driver, where a fallback path incorrectly uses a freed pointer after devm_krealloc() fails. This flaw could lead to serious impacts on confidentiality, integrity, and availability of the system. The issue has been fixed in specific commits identified by their hashes.
A use-after-free vulnerability exists in the Linux kernel's drm/msm driver when the KMS initialization fails. The issue arises because the KMS teardown function is called twice during error handling, leading to a crash. This has been fixed by adjusting the error cleanup logic to ensure the KMS state is only torn down once.
CVE-2026-90260 is a vulnerability in the Linux kernel's btrfs zoned filesystem code where zeroing out an extent buffer incorrectly clobbers the in-memory buffer. This causes corruption of the extent tree due to invalid references when the buffer is still in use. The issue has been fixed in specific Linux kernel commits.
A vulnerability in the Linux kernel's AMT (Alternate MAC/PHY Transport) device handling allows a problematic cross-network namespace (netns) setup. When a lower device is unregistered, the kernel attempts to unregister its upper AMT device but only looks up upper devices within the same netns. This causes issues if the AMT device is created on a lower device in a different netns, leading to a kernel warning and a hang during device removal. The vulnerability is addressed by forbidding cross-netns setups for AMT devices.
A vulnerability in the Linux kernel ALSA sequencer subsystem could leak kernel memory addresses to unprivileged userspace. This occurs when a variable-length event is bounced back to userspace with an embedded pointer to kernel memory. The issue affects multiple Linux kernel versions and has been fixed in later releases.
A vulnerability in the Linux kernel's vsock subsystem causes vsock_accept() to incorrectly reject valid incoming connections due to stale error state (sk_err) from previous failed connection attempts. This leads to resource leaks on certain transports because child sockets are not freed after rejection. The issue arises from checking the listener's sk_err in vsock_accept(), which is unnecessary and causes connection failures and resource leaks.
A vulnerability in the Linux kernel ALSA control subsystem could cause a NULL pointer dereference due to invalid kcontrol elements being added to the LED state layer. This occurs when write-only elements without get callbacks are present, leading to a potential kernel Oops. The issue has been fixed by adding sanity checks to skip invalid kcontrols before assignment.
A vulnerability in the Linux kernel's dma-heap subsystem allowed file descriptors (fd) to be published to other threads before a copy_to_user() operation succeeded, potentially leaking fds and dma-buf references for the lifetime of the process. The flaw was fixed by restructuring the allocation path to ensure the fd is only published after copy_to_user() succeeds, preventing leaks without unsafe close operations.
A vulnerability in the Linux kernel's KVM arm64 vgic-its component could cause a host crash when migrating a guest virtual machine. The issue arises from dereferencing a NULL collection pointer during ITT save operations, triggered by a specific sequence of MAPC, MAPD, and MAPTI commands from the guest. This flaw has been resolved by saving a zeroed entry instead of dereferencing the NULL pointer.
WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version 1.1.0.651412
WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root on the underlying operating system.
This issue has been fixed in firmware version 1.1.0.651412