CVE-2026-92491 firmware: arm_scmi: Roll back partial protocol table registration

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Roll back partial protocol table registration scmiprotocoltableregister can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID...

CVE-2026-90357

CVE-2026-90357 is a memory-corruption bug in the Linux kernel's mt76 mt7915 WiFi driver. When the MCU (firmware) rejects a TWT (Target Wake Time) agreement, the error path fails to unlink the flow from dev->twt_list while leaving flowid_mask unset. The flow slot can then be reused and memset w...

EUVD-2026-81980

In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...

EUVD-2026-81974

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

CVE-2026-90313 bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

CVE-2026-93175: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in CRTC reset function amdgpudmcrtcresetstate frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangling...

CVE-2026-92521: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driverdata on all paths that free the acpipciroot acpipcirootadd assigns the freshly allocated root to device-driverdata before dmardeviceadd and pciacpiscanroot. Both failure paths reach the end: label where roo...

CVE-2026-92491: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Roll back partial protocol table registration scmiprotocoltableregister can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID...

CVE-2026-90313: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

CVE-2026-93192: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Clear queue-activejob when v3dfencecreate fails The runjob callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue-activejob before calling v3dfencecreate. If v3dfencecreate fails, the callback returns NU...

CVE-2026-92481: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: free EINT resources on unbind mtkeintdoinit creates an IRQ domain, populates it with a mapping for every EINT line and installs a chained handler on the parent interrupt, but none of these are ever released. Th...

CVE-2026-93176: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in plane reset function amdgpudmplanedrmplanereset frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangli...

CVE-2026-89994

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsledmaengine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no...

CVE-2026-89877

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164devsetup adds the device to the global saa7164devlist before requesting the PCI BAR memory regions. If getresources fails, saa7164devsetup decrements the device...

CVE-2026-89777 vfio/pci: clear vdev->msi_perm after freeing it on init failure

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

SUSE CVE-2026-89504

In the Linux kernel, the following vulnerability has been resolved: regulator: as3722getregulatordtdata: fix premature ofnodeput leaving dangling ofnode pointer In as3722getregulatordtdata, ofgetchildbyname acquires a reference on np, which is then assigned to pdev-dev.ofnode. The function...

PT-2026-93383

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vfio/pci component where the vdev-msi perm pointer is not cleared after being freed during an initialization failure. When the init pci cap msi perm function which...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: gve: Clearing napi-skb before devkfreeskbany In gverxfreeskb, napi-skb is incorrectly left referencing an skb after it is freed using devkfreeskbany. This can result in a subsequent call to napigetfrags returning a dangling...

Astra Linux – Vulnerability in NBD

In nbd-server in nbd before 3.24, there is an integer overflow that leads to a heap-based buffer overflow. A value of 0xffffffff in the name length field causes a zero-sized buffer to be allocated for the name, resulting in a write to a dangling pointer. This issue occurs for the NBDOPTINFO,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: The initialization of the dangling pointer that occurs in vsk-trans has been addressed. During loopback communication, a dangling pointer can be created in vsk-trans, potentially leading to a Use-After-Free conditio...