DEBIAN-CVE-2026-90319

In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...

DEBIAN-CVE-2026-90313

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

AZL-102483 CVE-2026-90313 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

CVE-2026-93192 drm/v3d: Clear queue->active_job when v3d_fence_create() fails

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Clear queue-activejob when v3dfencecreate fails The runjob callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue-activejob before calling v3dfencecreate. If v3dfencecreate fails, the callback returns NU...

CVE-2026-93192

CVE-2026-93192 is a dangling pointer vulnerability in the Linux kernel's drm/v3d driver (Broadcom VideoCore IV GPU). The run_job() callbacks for the BIN, RENDER, TFU, and CSD queues assign a job to queue->active_job before calling v3d_fence_create(). If that call fails, the callback returns NU...

CVE-2026-93192 drm/v3d: Clear queue->active_job when v3d_fence_create() fails

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Clear queue-activejob when v3dfencecreate fails The runjob callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue-activejob before calling v3dfencecreate. If v3dfencecreate fails, the callback returns NU...

EUVD-2026-82300

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Clear queue-activejob when v3dfencecreate fails The runjob callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue-activejob before calling v3dfencecreate. If v3dfencecreate fails, the callback returns NU...

CVE-2026-93176 drm/amd/display: Fix dangling pointer in plane reset function

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in plane reset function amdgpudmplanedrmplanereset frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangli...

CVE-2026-93176

CVE-2026-93176 is a dangling pointer vulnerability in the Linux kernel's DRM/AMD display driver, specifically in amdgpu_dm_plane_drm_plane_reset(). The function frees the old plane state before allocating a replacement; if the subsequent kzalloc() call fails, the state pointer is left pointing to...

EUVD-2026-82284

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in plane reset function amdgpudmplanedrmplanereset frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangli...

CVE-2026-93176 drm/amd/display: Fix dangling pointer in plane reset function

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in plane reset function amdgpudmplanedrmplanereset frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangli...

CVE-2026-93175 drm/amd/display: Fix dangling pointer in CRTC reset function

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in CRTC reset function amdgpudmcrtcresetstate frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangling...

CVE-2026-93175

CVE-2026-93175 is a dangling pointer (use-after-free) in the Linux kernel's DRM/AMD display driver. The function amdgpu_dm_crtc_reset_state() freed the old CRTC state before allocating a replacement; if kzalloc() failed, the function returned early, leaving a pointer to already-freed memory. The ...

EUVD-2026-82283

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in CRTC reset function amdgpudmcrtcresetstate frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangling...

CVE-2026-93175 drm/amd/display: Fix dangling pointer in CRTC reset function

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in CRTC reset function amdgpudmcrtcresetstate frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangling...

CVE-2026-92521 ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root

In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driverdata on all paths that free the acpipciroot acpipcirootadd assigns the freshly allocated root to device-driverdata before dmardeviceadd and pciacpiscanroot. Both failure paths reach the end: label where roo...

CVE-2026-92521 ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root

In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driverdata on all paths that free the acpipciroot acpipcirootadd assigns the freshly allocated root to device-driverdata before dmardeviceadd and pciacpiscanroot. Both failure paths reach the end: label where roo...

CVE-2026-92491 firmware: arm_scmi: Roll back partial protocol table registration

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Roll back partial protocol table registration scmiprotocoltableregister can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID...

CVE-2026-92491

CVE-2026-92491 affects the arm_scmi firmware driver in the Linux kernel. The root cause is that scmi_protocol_table_register() can leave earlier protocol requests registered when a later entry in the same ID table fails. Since each request retains a pointer to the driver's ID table, a failed modu...

EUVD-2026-82112

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Roll back partial protocol table registration scmiprotocoltableregister can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID...