CVE-2026-93274 pinctrl: bcm2835: Don't remove an unregistered GPIO chip

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

EUVD-2026-86146

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

CVE-2026-93274

A null pointer dereference vulnerability exists in the Linux kernel within the pinctrl: bcm2835 component. The issue occurs when the devm_pinctrl_register() function fails; the bcm2835_pinctrl_probe() function incorrectly calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO ...

CVE-2026-93253 sched/isolation: Defer freeing of cpumask memblock memory to initcall

In the Linux kernel, the following vulnerability has been resolved: sched/isolation: Defer freeing of cpumask memblock memory to initcall When testing a linux-next kernel with commit 59bd1d914bb5 "memblock: warn when freeing reserved memory before memory map is initialized", the following warning...

CVE-2026-93247 Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

EUVD-2026-86255

In the Linux kernel, the following vulnerability has been resolved: apparmor: policyint make sure list heads are initialized before fail path If profile create fails before policyinit is complete the list heads are not properly initialized causing profilefree sanity checks to trigger the followin...

CVE-2026-93227 mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: deferredgrowzone: fix out-of-range firstdeferredpfn With CONFIGDEFERREDSTRUCTPAGEINIT enabled, deferredgrowzone initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, th...

CVE-2026-93227

The Linux kernel contains a vulnerability in deferred_grow_zone() when CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled. With a large CMA reservation , the function may initialize the memory map of an entire zone; however, if the node's RAM end is not aligned on PAGES_PER_SECTION boundaries, the updat...

CVE-2026-93227 mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: deferredgrowzone: fix out-of-range firstdeferredpfn With CONFIGDEFERREDSTRUCTPAGEINIT enabled, deferredgrowzone initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, th...

EUVD-2026-86232

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: deferredgrowzone: fix out-of-range firstdeferredpfn With CONFIGDEFERREDSTRUCTPAGEINIT enabled, deferredgrowzone initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, th...

CVE-2026-93218 mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

EUVD-2026-85946

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

CVE-2026-93217

The Linux kernel contains a vulnerability in mm/madvise where madvise_cold_or_pageout_pte_range() can trigger a kernel panic. The issue occurs because pmd_is_huge() returns true for device-private PMDs, causing a VM_BUG_ON() assertion to trip when the PMD is not present. This is potentially trigg...

CVE-2026-97485: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: omfs: handle setblocksize failures omfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-93218: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2026-93274: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

PT-2026-97894

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2 Description An issue exists in the memory management initialization where the deferred grow zone function may cause an overflow of the pgdat-first deferred pfn variable. This occurs when CONFIG DEFERRED STRUC...

PT-2026-97934

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the Bluetooth management component. The uuid count member of the discovery state structure is accessed and modified without proper locking, creating ...

PT-2026-98093

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iwlwifi component of the Linux kernel related to Multi-Link Device MLD handling. A kernel panic can occur during a reconfiguration failure when a firmware error...

PT-2026-104999

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: purge async notifications upon nic error This fixes a kernel panic in reconfig failure: 1. we have a BSS connection 2. we have a NAN connection 3. FW error occurs 4. reconfig restores the BSS connection 5...