CVE-2026-93150

CVE-2026-93150 affects the Linux kernel cgroup/cpuset subsystem. The root cause is a race condition on the nr_deadline_tasks variable in the cpuset structure: it can be concurrently modified by inc_dl_tasks_cs() (under rq->lock) and cpuset_attach() (under cpuset_mutex), leading to data corrupt...

CVE-2026-93149 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

EUVD-2026-82258

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Make nrdeadlinetasks an atomict The nrdeadlinetasks variable in the cpuset structure was introduced by commit 6c24849f5515 "sched/cpuset: Keep track of SCHEDDEADLINE task in cpusets". It is reported by sashiko 1 th...

CVE-2026-93150

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Make nrdeadlinetasks an atomict The nrdeadlinetasks variable in the cpuset structure was introduced by commit 6c24849f5515 "sched/cpuset: Keep track of SCHEDDEADLINE task in cpusets". It is reported by sashiko 1 th...

CVE-2026-93149

This Linux kernel vulnerability affects the mac80211_hwsim (hardware-simulated WiFi) driver. In mac80211_hwsim_stop(), a race condition exists between the skb_queue_empty() check and the subsequent skb_dequeue() call. Because TX status handling can remove a pending frame under the queue lock betw...

EUVD-2026-82257

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

CVE-2026-93149

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

EUVD-2026-82256

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEMALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTRTOBTFID | MEMALLOC values point...

CVE-2026-93148 bpf: Reject MEM_ALLOC BTF accesses past object bounds

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEMALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTRTOBTFID | MEMALLOC values point...

CVE-2026-93148

CVE-2026-93148 is a Linux kernel vulnerability in the BPF subsystem . The root cause lies in how BTF struct walks relax the struct-size check for accesses through a trailing flexible array. While valid for ordinary BTF type walking, PTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with...

CVE-2026-93148

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEMALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTRTOBTFID | MEMALLOC values point...

CVE-2026-93148 bpf: Reject MEM_ALLOC BTF accesses past object bounds

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEMALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTRTOBTFID | MEMALLOC values point...

EUVD-2026-82254

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93147 s390/bpf: Replace ly instruction with llgf

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-93146 time/namespace: Validate nanosecond field in proc_timens_set_offset()

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93147

CVE-2026-93147 affects the Linux kernel on the s390 architecture within the BPF (Berkeley Packet Filter) subsystem. The root cause is that the ly instruction loads the 32-bit value cpu_nr into the 64-bit register BPF_REG_0 without zeroing the upper 32 bits, leaving stale data that can corrupt sub...

CVE-2026-93146

CVE-2026-93146 is a Linux kernel vulnerability in the time/namespace subsystem. The function proc_timens_set_offset() validates the tv_sec field but fails to validate that tv_nsec is within the required range [0, NSEC_PER_SEC-1] before passing it to timespec64_add() , which expects normalized val...

CVE-2026-93146

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93147 s390/bpf: Replace ly instruction with llgf

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-93146 time/namespace: Validate nanosecond field in proc_timens_set_offset()

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...