CVE-2026-93148 bpf: Reject MEM_ALLOC BTF accesses past object bounds

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEMALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTRTOBTFID | MEMALLOC values point...

EUVD-2026-82254

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93147 s390/bpf: Replace ly instruction with llgf

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-93146 time/namespace: Validate nanosecond field in proc_timens_set_offset()

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93147

CVE-2026-93147 affects the Linux kernel on the s390 architecture within the BPF (Berkeley Packet Filter) subsystem. The root cause is that the ly instruction loads the 32-bit value cpu_nr into the 64-bit register BPF_REG_0 without zeroing the upper 32 bits, leaving stale data that can corrupt sub...

CVE-2026-93146

CVE-2026-93146 is a Linux kernel vulnerability in the time/namespace subsystem. The function proc_timens_set_offset() validates the tv_sec field but fails to validate that tv_nsec is within the required range [0, NSEC_PER_SEC-1] before passing it to timespec64_add() , which expects normalized val...

CVE-2026-93147 s390/bpf: Replace ly instruction with llgf

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-93146

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93146 time/namespace: Validate nanosecond field in proc_timens_set_offset()

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93147

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

EUVD-2026-82255

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-93145 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdscunregister gdscunregister removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove on the individual genericpmdomain structures...

CVE-2026-93145

A vulnerability in the Linux kernel Qualcomm GDSC (Generic Dynamic Switch Controller) clock driver. The function gdsc_unregister() removed the OF provider entry and tore down parent/subdomain wiring but never called pm_genpd_remove() on the individual generic_pm_domain structures registered by gd...

EUVD-2026-82253

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdscunregister gdscunregister removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove on the individual genericpmdomain structures...

CVE-2026-93145

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdscunregister gdscunregister removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove on the individual genericpmdomain structures...

CVE-2026-93145 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdscunregister gdscunregister removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove on the individual genericpmdomain structures...

EUVD-2026-82252

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

CVE-2026-93143 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix pmruntime refcount leak in ipu7resume ipu7resume calls pmruntimegetsync before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without...

CVE-2026-93144 bpf: Reject writes through untrusted BTF pointers

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

CVE-2026-93143

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix pmruntime refcount leak in ipu7resume ipu7resume calls pmruntimegetsync before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without...