CVE-2026-93110

A flaw was found in the Linux kernel's RDMA core component. A race condition exists where RCU Read-Copy-Update callbacks, specifically putgidndev, can be invoked after the ibcore module has been unloaded. This occurs because stopping workqueues does not drain already queued callbacks, allowing RC...

CVE-2026-93109

A flaw was found in the Linux kernel's RDMA/mlx5 component. A race condition during module teardown can occur when the mlx5ib module unloads before all Read-Copy-Update RCU callbacks, such as devxfreesubscription, have completed. This premature unloading while callbacks are still pending can lead...

CVE-2026-93108

A flaw was found in the Linux kernel's RDMA/ipoib module. A race condition during module teardown allows the ibipoib module to be unloaded while its code is still executing. This can occur when IPoIB reclamation completions are signaled from within an RCU Read-Copy-Update callback, or during clie...

CVE-2026-93107

A flaw was found in the Linux kernel's RDMA/rxe component. When a Queue Pair QP transitions to an error state during packet completion, the system may reprocess an already-completed packet. This can lead to duplicate data being delivered to user applications, causing data stream corruption...

CVE-2026-93106

A flaw was found in the Linux kernel's crashdump functionality, specifically in how it handles dm-crypt keys. When multiple dm-crypt keys are restored, a reference to the user keyring is incorrectly dropped multiple times. This can lead to a reference count underflow or a use-after-free condition...

CVE-2026-93105

A flaw was found in the Linux kernel. Specifically, a component responsible for handling network packet fragments espssgunref incorrectly manages memory page references. This error can cause the system to release a memory page that is still actively in use. Such an issue can lead to memory...

CVE-2026-93100

A flaw was found in the Linux kernel's resctrl filesystem. A race condition exists in the rdtgroupknput function during the handling of rdtgroup structure reference counts. This allows a local attacker to trigger a use-after-free vulnerability, where memory is accessed after it has been...

CVE-2026-93104

A flaw was found in the Linux kernel RDMA/rvt component. The rvtallocdevice function incorrectly returns a pointer to memory that has already been deallocated after a port allocation failure. This allows callers to dereference the freed memory, leading to a use-after-free vulnerability. This issu...

CVE-2026-93099

A flaw was found in the Linux kernel's fs/resctrl component. This use-after-free UAF vulnerability occurs when worker threads attempt to access memory that has already been released during CPU hotplug operations. A local attacker could potentially exploit this flaw to cause a system crash, leadin...

CVE-2026-93098

A flaw was found in the Linux kernel. A deadlock can occur in the rpmsg: glink component during driver detachment. This issue arises when a redundant device unregistration attempts to acquire a mutex that is already held, causing the system to hang indefinitely. This can lead to a Denial of Servi...

CVE-2026-93096

A flaw was found in the Linux kernel's CXL features. A concurrency vulnerability exists where multi-part Get/Set Feature transfers are not properly serialized. This allows two concurrent transfers to the same mailbox to interleave their parts, which can corrupt the device's transfer context. A...

CVE-2026-93095

A flaw was found in the HFS Plus HFS+ filesystem in the Linux kernel. A local attacker could provide a specially crafted, corrupted HFS+ image that, when processed during a delete key rebuild operation, would cause the system to write past an allocated memory buffer. This out-of-bounds write coul...

CVE-2026-93094

A flaw was found in the ath12k Wi-Fi driver of the Linux kernel. This vulnerability occurs during the rollback of an Access Point AP virtual device vdev creation. If a peer creation step fails, the system can improperly free memory while still holding references to it, leading to a use-after-free...

CVE-2026-93091

A flaw was found in the armscmi firmware component of the Linux kernel. A race condition exists during the teardown of notifications or on the probe error path. This can allow an attacker to trigger a use-after-free vulnerability, where the system attempts to access memory that has already been...

CVE-2026-93092

A flaw was found in the armscmi firmware component of the Linux kernel. A race condition can occur during the unregistration of device notifiers and the teardown of the activeprotocols IDR ID allocator. This timing issue could potentially lead to system instability or a denial of service DoS due ...

CVE-2026-93086

A flaw was found in the Linux kernel's armscmi firmware component. During the cleanup of transmit and receive channels, the scmicleanupchannels function performs an unsafe operation by removing entries from a kernel data structure IDR while it is being iterated. This can lead to an invalid iterat...

CVE-2026-93085

A flaw was found in the ARM System Control and Management Interface SCMI firmware within the Linux kernel. This vulnerability occurs because the system fails to properly reject out-of-range Device Tree DT protocol identifiers. A local attacker could exploit this by providing a malformed 32-bit DT...

CVE-2026-93084

A flaw was found in the Linux kernel's armscmi firmware. When the SCMI bus notifier acquires a handle, but the device link cannot be properly established or a protocol driver probe fails, the SCMI instance's reference count may not be correctly released. This can lead to a resource leak...

CVE-2026-93080

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs because the scmidevicedestroy function, responsible for tearing down SCMI transport devices, uses an incorrect lookup mechanism. Malformed firmware with duplicate protocol...

CVE-2026-93081

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs due to improper handling of device reference counts during the device destruction process. A concurrent unregister operation can release a device while its pointer is still ...