CVE-2026-93092

A flaw was found in the armscmi firmware component of the Linux kernel. A race condition can occur during the unregistration of device notifiers and the teardown of the activeprotocols IDR ID allocator. This timing issue could potentially lead to system instability or a denial of service DoS due ...

CVE-2026-93086

A flaw was found in the Linux kernel's armscmi firmware component. During the cleanup of transmit and receive channels, the scmicleanupchannels function performs an unsafe operation by removing entries from a kernel data structure IDR while it is being iterated. This can lead to an invalid iterat...

CVE-2026-93085

A flaw was found in the ARM System Control and Management Interface SCMI firmware within the Linux kernel. This vulnerability occurs because the system fails to properly reject out-of-range Device Tree DT protocol identifiers. A local attacker could exploit this by providing a malformed 32-bit DT...

CVE-2026-93084

A flaw was found in the Linux kernel's armscmi firmware. When the SCMI bus notifier acquires a handle, but the device link cannot be properly established or a protocol driver probe fails, the SCMI instance's reference count may not be correctly released. This can lead to a resource leak...

CVE-2026-93080

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs because the scmidevicedestroy function, responsible for tearing down SCMI transport devices, uses an incorrect lookup mechanism. Malformed firmware with duplicate protocol...

CVE-2026-93081

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs due to improper handling of device reference counts during the device destruction process. A concurrent unregister operation can release a device while its pointer is still ...

CVE-2026-93079

A flaw was found in the Linux kernel's CXL Compute Express Link feature handling. The cxlctlgetfeature function does not properly validate the size of the output buffer against a user-controlled count value. This oversight allows a local attacker to provide a count larger than the allocated buffe...

CVE-2026-93078

A flaw was found in the Linux kernel's CXL Compute Express Link feature handling. The cxlctlsetfeature function, responsible for setting CXL features, does not properly validate the size of the output buffer provided by a user. If a local attacker provides an output buffer of zero length, it can...

CVE-2026-93077

A flaw was found in the Linux kernel's cxl/features component. The cxlgetfeature function, when reading feature data, uses a fixed output buffer size in a loop. This can lead to a buffer overflow if a connected device returns more data than the remaining buffer capacity, potentially allowing for...

CVE-2026-93076

A flaw was found in the Linux kernel's Direct Access DAX subsystem. When a static DAX device is reconfigured, an outdated memory mapping value can persist. This prevents the system from correctly building its virtual memory map, which is essential for proper operation. This issue could lead to...

CVE-2026-93075

A flaw was found in the Linux kernel's dax/fsdev component. When a static device is unbound, the pgmap operations and owner are not properly cleared. This can lead to a use-after-free vulnerability where a subsequent memory failure event might dispatch through a stale or freed handler, potentiall...

CVE-2026-93074

A flaw was found in the Linux kernel's dax/fsdev component. An error in calculating kernel virtual addresses within the fsdevdaxdirectaccess function, specifically for multi-range devices with physical gaps, can lead to incorrect memory addressing. This issue could result in memory corruption,...

CVE-2026-93073

A flaw was found in the Linux kernel's Direct Access DAX subsystem. A race condition in the daxholdernotifyfailure function allows a concurrent operation to clear a critical pointer holderops between two reads. This can lead to a null pointer dereference, potentially enabling a local attacker to...

CVE-2026-93070

A flaw was found in the ipu6 media driver of the Linux kernel. This vulnerability arises from incorrect handling of auxiliary device private data during initialization, leading to a double free condition. A local attacker could potentially exploit this to cause a denial of service or other memory...

CVE-2026-93069

A flaw was found in the Linux kernel's Optimized Power Management OPP subsystem. An incorrect cleanup ordering during the initialization of internal pointers can lead to a use-after-free error. This occurs when the system attempts to release a reference to an already freed memory region. Such an...

CVE-2026-93067

A flaw was found in the Linux kernel's drm/bridge: tc358767 component. An issue in the tcauxtransfer function, specifically within tcauxreaddata, allows a connected DisplayPort DP AUX controller to report a read size larger than requested. This can lead to a buffer overflow when reading data into...

CVE-2026-93066

A flaw was found in the Linux kernel. A race condition in the x86/mm/pat component, specifically between cpacollapselargepages and changepageattr, can lead to a use-after-free vulnerability. A local attacker, by concurrently loading and unloading modules, could exploit this to write into freed...

CVE-2026-93065

A flaw was found in the iwlwifi driver of the Linux kernel. An integer overflow vulnerability exists where a loop counter, declared as an 8-bit unsigned integer, can wrap around if the firmware advertises more than 255 program counter entries. This can lead to an infinite loop, causing a denial o...

CVE-2026-93064

A flaw was found in the iwlwifi driver of the Linux kernel. An off-by-one error in the iwlmvmfrobtxfkeyiter function, responsible for sanitizing transmit TXF keys, incorrectly calculates the memory clear operation's starting point. This error results in one byte before the intended key being...

CVE-2026-93063

A flaw was found in the Linux kernel's iwlwifi component. This vulnerability allows an attacker to cause a buffer overflow by sending a specially crafted Service Advertisement Protocol SAP message that exceeds the allocated buffer size. This could lead to memory corruption, potentially causing th...