SUSE CVE-2026-91957

FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference...

EUVD-2026-82296

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index konekeepvaluesuptodate and koneprofileactivated use an 8-bit, device-supplied profile value as an index into the 5-element kone-profiles array without a range check. A malicious US...

CVE-2026-93188 HID: roccat: bound device-supplied profile index

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index konekeepvaluesuptodate and koneprofileactivated use an 8-bit, device-supplied profile value as an index into the 5-element kone-profiles array without a range check. A malicious US...

CVE-2026-93169 dmaengine: zynqmp_dma: fix race between runtime PM and device removal

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmpdma: fix race between runtime PM and device removal In zynqmpdmaremove, runtime PM was disabled only after checking state and doing a manual suspend. This can race with runtime PM in the remove/unbind rmmod path...

CVE-2026-93136

CVE-2026-93136 affects the Linux kernel's MHI (Modem Host Interface) bus endpoint driver (bus: mhi: ep). The vulnerability is a device reference count leak in the error path of MHI device creation. When dev_set_name() or device_add() fails during device creation, the error path incorrectly drops ...

CVE-2026-93136 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation mhiepcreatedevice takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references...

EUVD-2026-82244

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation mhiepcreatedevice takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references...

CVE-2026-93119 usb: ljca: bound bank_num in ljca_enumerate_gpio()

In the Linux kernel, the following vulnerability has been resolved: usb: ljca: bound banknum in ljcaenumerategpio ljcaenumerategpio reads desc-banknum from the device and loops validpini = getunalignedle32... for i banknum. validpin holds only LJCAMAXGPIONUM / 32 = 2 entries. Two checks run befor...

EUVD-2026-82211

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Preserve unit 0 on allocation failure hfi1freedevdata assumes that the device was inserted into the unit table and unconditionally erases dd-unit. If xaallocirq fails, the zero-initialized unit remains zero, so full...

CVE-2026-93098 rpmsg: glink: fix deadlock in endpoint destroy during driver detach

In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that...

CVE-2026-93098 rpmsg: glink: fix deadlock in endpoint destroy during driver detach

In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that...

CVE-2026-93098

CVE-2026-93098 is a deadlock in the Linux kernel's rpmsg: glink subsystem. During driver detach, the device core holds the device mutex throughout the remove callback chain. When the GLINK endpoint destroy path redundantly unregisters the underlying rpmsg device, it calls device_del() , which att...

CVE-2026-93092 firmware: arm_scmi: Unregister device notifier before IDR teardown

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unregister device notifier before IDR teardown The requested-devices notifier looks up protocol fwnodes from the activeprotocols IDR. During remove, unregister the notifier before releasing and destroying...

CVE-2026-93092

A race condition in the Linux kernel arm_scmi firmware driver could occur during device removal. The requested-devices notifier looks up protocol fwnodes from the active_protocols IDR , and if the notifier was not unregistered before the IDR was released and destroyed, a notifier callback could r...

CVE-2026-93080 firmware: arm_scmi: Fix transport device teardown lookup

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix transport device teardown lookup SCMI transport devices are deliberately excluded from normal SCMI bus matching so protocol drivers cannot bind to the internal transport children. However, scmidevicedestroy...

CVE-2026-93080 firmware: arm_scmi: Fix transport device teardown lookup

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix transport device teardown lookup SCMI transport devices are deliberately excluded from normal SCMI bus matching so protocol drivers cannot bind to the internal transport children. However, scmidevicedestroy...

CVE-2026-93080

CVE-2026-93080 affects the arm_scmi firmware driver in the Linux kernel . SCMI transport devices are deliberately excluded from normal bus matching so protocol drivers cannot bind to them, but scmi_device_destroy() reused the same protocol/name lookup to locate devices for channel teardown. The f...

EUVD-2026-82190

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix transport device teardown lookup SCMI transport devices are deliberately excluded from normal SCMI bus matching so protocol drivers cannot bind to the internal transport children. However, scmidevicedestroy...

CVE-2026-93070 media: ipu6: Do not free aux device pdata after init

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6businitializedevice stores the isys/psys pdata pointer in struct ipu6busdevice and initializes the auxiliary device. After that point, error unwinding must drop the auxilia...

EUVD-2026-82180

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6businitializedevice stores the isys/psys pdata pointer in struct ipu6busdevice and initializes the auxiliary device. After that point, error unwinding must drop the auxilia...