CVE-2026-92489

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability occurs in the xfrmdevdirectoutput function due to incorrect handling of network packet buffer skb ownership. When netfilter drops a packet, the skb can be freed twice, leading to a double-free condition. This memory...

CVE-2026-92487

A flaw was found in the exfat filesystem within the Linux kernel. A race condition can occur when a shared writable memory mapping has its validsize extended by a buffered write or a page fault. During this process, the kernel zeroes out a page-cache gap, and a concurrent write operation through...

CVE-2026-92485

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. Incorrect handling of trampoline flags during the release of a BPF tracing link can lead to corruption of the trampoline. This corruption prevents the proper restoration of program instructions, which may result in a...

CVE-2026-92484

A flaw was found in the Linux kernel's cxl/region component. This use-after-free vulnerability occurs when an error path releases a reference to a switch decoder prematurely. If this is the last reference, the decoder can be freed before its name is accessed for error logging, potentially leading...

CVE-2026-92483

A flaw was found in the Linux kernel's liveupdate component. When a retrieval attempt for a File List Block FLB fails, the system does not record this failure. Consequently, if a user attempts to retrieve another file associated with the same FLB, the system may retry the failed retrieval. This...

CVE-2026-92482

A flaw was found in the Linux kernel's pinctrl Mediatek driver. This vulnerability occurs because the gpiochip memory is freed prematurely while it is still registered, leading to a use-after-free condition. This can happen when the driver is built as a module and then unloaded. A local attacker...

CVE-2026-92481

A flaw was found in the Linux kernel's pinctrl: mediatek driver. When the driver is unloaded, it fails to properly release External Interrupt EINT resources. This oversight can result in the system attempting to access memory that has already been freed, potentially leading to system instability ...

CVE-2026-92480

A flaw was found in the Linux kernel's SCSI Universal Flash Storage UFS core. This vulnerability arises from improper validation of string descriptors, which can lead to an out-of-bounds read when processing UTF-16 payloads. A local attacker or a malicious UFS device could exploit this to...

CVE-2026-92479

A flaw was found in the Linux kernel's Universal Flash Storage UFS host controller driver. When an invalid completion queue entry CQE tag is reported, the driver attempts to dereference a NULL pointer, which can lead to a system crash. This vulnerability could allow a local attacker to cause a...

CVE-2026-92478

A flaw was found in the Linux kernel. The Universal Flash Storage UFS core component does not properly validate connected lane counts. This could allow a local attacker to provide specially crafted input, leading to out-of-range memory access when processing Universal Flash Storage UFS commands...

CVE-2026-92477

A flaw was found in the Linux kernel, specifically within the scsi: ufs: debugfs component. The ufssavederrwrite function copies user-provided input into a stack buffer without ensuring sufficient space for a string terminator. If the input completely fills the buffer, it overwrites the terminato...

CVE-2026-92476

A flaw was found in the Linux kernel's crypto: keembay driver. This vulnerability occurs because a critical component, irqcompletion, is not fully prepared before the system starts processing interrupts. If an interrupt happens during this brief window, it can attempt to use an uninitialized...

CVE-2026-90435

A flaw was found in the Linux kernel's RDMA/mlx5 component. A local attacker could exploit an integer overflow vulnerability when processing user-supplied buffer size values. This flaw occurs because large user inputs can cause an integer overflow during buffer size calculation, leading to a...

CVE-2026-90433

A flaw was found in the Linux kernel's spi: oc-tiny driver. This vulnerability arises from a timing issue where the system attempts to free memory associated with a Serial Peripheral Interface SPI controller before ensuring that all related interrupt handling has ceased. This can lead to a...

CVE-2026-90432

A flaw was found in the Linux kernel's schedext component, specifically within its hardlockup handler. An unnecessary deferral of abort operations could prevent the system from properly recovering from a CPU hardlockup, where a CPU becomes unresponsive. This could lead to system unresponsiveness ...

CVE-2026-90431

A flaw was found in the Linux kernel's remoteproc component. A race condition exists between the crash handling and removal functions due to a lack of synchronization. This could allow a local attacker to trigger a use-after-free vulnerability. Successful exploitation of this flaw may lead to...

CVE-2026-90429

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv component. A synchronization issue exists between the error Interrupt Service Routine ISR and the Virtual Interrupt Function VINTF de-initialization process. A concurrent error could lead to the ISR attempting to access a VINTF that is...

CVE-2026-90426

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv component. During the teardown process of Virtual Interrupt Functions VINTFs, the error interrupt IRQ is freed after the VINTFs are torn down. This incorrect order can lead to a scenario where an error occurring in this window causes the...

CVE-2026-90425

A flaw was found in the Linux kernel, specifically within the IOMMU Input/Output Memory Management Unit Tegra241 command queue driver. This vulnerability arises from improper handling of virtual Stream IDs vSID when a device has either multiple or no physical Stream IDs. A malicious guest operati...

CVE-2026-90423

A flaw was found in the Linux kernel's RDMA/rxe component. An error in the On-Demand Paging ODP initialization path can lead to a Use-After-Free UAF vulnerability. During error handling, memory is prematurely released, but a pointer to it is not properly cleared. This allows subsequent operations...