Linux Kernel: 25 Vulnerabilities Disclosed, Including Critical Network and File System Flaws
A batch of 25 Linux kernel vulnerabilities, including critical flaws in networking, file systems, and USB, were disclosed on September 16, 2026.
Key findings
- 25 Linux kernel vulnerabilities disclosed on September 16, 2026, with multiple critical and high-severity flaws.
- Critical vulnerabilities found in networking (CVE-2026-90049), file systems (CVE-2026-90048, CVE-2026-90042), and NFSD (CVE-2026-90038, CVE-2026-90037, CVE-2026-90036).
- Multiple USB subsystem vulnerabilities disclosed, including use-after-free errors and improper state handling.
- Issues span various subsystems: net, fs/ntfs3, drm/xe, mm, USB, HID, KVM, NFSD, ALSA, media, and typec.
- Users are urged to update to the latest kernel versions to patch these disclosed vulnerabilities.
On September 16, 2026, a significant batch of 25 vulnerabilities was disclosed in the Linux kernel, spanning various subsystems including networking, file systems, graphics, memory management, USB, and more. These vulnerabilities range in severity, with several critical flaws carrying CVSSv3 scores up to 9.8, and numerous high-severity issues. The disclosures highlight potential risks in how the kernel handles data integrity, memory allocation, and device interactions.
Several vulnerabilities are concentrated in the networking and file system components. CVE-2026-90049 addresses a critical issue in the skb_zerocopy() function within the net subsystem, where an incorrect call to skb_tx_error() on the source skb could lead to data corruption. Another critical vulnerability, CVE-2026-90048, lies in the NTFS3 file system, specifically in ni_create_attr_list(), which could result in a slab-out-of-bounds write due to improper buffer handling. Additionally, CVE-2026-90042 points to a critical flaw in the Ceph file system client where filenames in vmalloc() buffers were not properly decrypted, potentially exposing sensitive data. The NFSD subsystem also saw multiple critical disclosures: CVE-2026-90038, CVE-2026-90037, and CVE-2026-90036 all relate to use-after-free vulnerabilities during export state revocation and reaping of closed or blocked locks, posing risks to NFSv4 client stability and security.
The USB subsystem is another area with a notable number of disclosed vulnerabilities. CVE-2026-90045 and CVE-2026-90044, both high severity, address use-after-free issues in the USB gadget function filesystem (ffs) related to memory management and asynchronous request handling. Other USB-related issues include CVE-2026-90030, a high-severity flaw in the dwc3 controller where forceRM was not cleared correctly when issuing EndTransfer, and CVE-2026-90032, a high-severity vulnerability in the usbtv driver that could lead to a use-after-free if an ALSA card existed after a USB disconnect. Further USB-related fixes include CVE-2026-90016, CVE-2026-90033, CVE-2026-90019, CVE-2026-90021, CVE-2026-90022, CVE-2026-90027, and CVE-2026-90026, addressing various memory management, race conditions, and state tracking issues.
The graphics and memory management subsystems were also affected. CVE-2026-90043, a high-severity bug in zram, fixed a slot lock bit position error on big-endian 64-bit systems. CVE-2026-90035 addresses a division-by-zero error in the AMD display driver's get_estimated_bw() function. CVE-2026-90046, a high-severity issue in mm/page_alloc, prevents spin_trylock() from being called in NMI on UP systems.
The Linux kernel community has addressed these issues through patches integrated into subsequent kernel releases. Users are advised to update to the latest stable kernel versions to incorporate these fixes. The wide range of affected subsystems underscores the importance of maintaining up-to-date kernel installations and applying security patches promptly to mitigate potential risks associated with these vulnerabilities.
This coordinated disclosure event emphasizes the ongoing efforts to identify and resolve security flaws within the Linux kernel, ensuring the stability and security of a vast array of systems that rely on it.
Key findings include:
- A critical vulnerability (CVE-2026-90048) in the NTFS3 file system leading to a slab-out-of-bounds write.
- Multiple critical use-after-free vulnerabilities in the NFSD subsystem (CVE-2026-90038, CVE-2026-90037, CVE-2026-90036).
- Several high-severity use-after-free vulnerabilities within the USB subsystem, impacting gadget and storage drivers.
- A critical networking vulnerability (CVE-2026-90049) in
skb_zerocopy()due to incorrect error handling. - A critical flaw in Ceph's filename decryption (CVE-2026-90042) within
vmalloc()buffers. - A broad impact across multiple kernel subsystems, including networking, file systems, USB, and graphics.