CVE-2026-93124

CVE-2026-93124 affects the asus-wireless platform/x86 driver in the Linux kernel . The root cause is that asus_wireless_probe() returns success even when acpi_match_acpi_device() finds no match, storing a NULL companion pointer . When the driver is force-bound to a device without an ACPI companio...

CVE-2026-93124 platform/x86: asus-wireless: Fail probe when there is no ACPI match

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver can be forced to match a device that does not match its list of device IDs because of devicematchdriveroverride, so platform drivers that...

EUVD-2026-82226

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: check endpoint DMA allocation astudcprobe allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep derives per-endpoint buffer pointers from udc-ep0buf, so a failed...

CVE-2026-93115 platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL

In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPICOMPANION against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on...

EUVD-2026-82223

In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPICOMPANION against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on...

CVE-2026-93115

CVE-2026-93115 affects the Linux kernel 's platform/mellanox: mlxbf-pmc driver. The root cause is a NULL pointer dereference : mlxbf_pmc_probe() passes the result of ACPI_COMPANION() to acpi_device_hid(), which dereferences it. Because any platform driver can be force-bound to a device outside it...

EUVD-2026-82222

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely...

CVE-2026-93114

CVE-2026-93114 affects the Linux kernel's platform/surface: acpi-notify driver. The root cause is a NULL pointer dereference in san_probe(), which dereferences the result of ACPI_COMPANION() when installing the GSBUS address space handler without verifying its presence. This flaw was introduced w...

CVE-2026-93114 platform/surface: acpi-notify: Check ACPI companion before use

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely...

CVE-2026-93107 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-93107

CVE-2026-93107 affects the Linux kernel RDMA/rxe (Soft-RoCE) subsystem. The root cause is a regression from commit 49dc9c1f0c7e, which removed the error-state branch from check_resource() but retained the error-state return in do_complete(). When a QP enters the error state while a packet is bein...

EUVD-2026-82215

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-93107 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-93093 firmware: arm_scmi: Publish channel state before callbacks

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailboxchansetup registers the mailbox client with mboxrequestchannel, and the mailbox controller...

CVE-2026-93093 firmware: arm_scmi: Publish channel state before callbacks

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailboxchansetup registers the mailbox client with mboxrequestchannel, and the mailbox controller...

EUVD-2026-82183

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

CVE-2026-93073 dax: read holder_ops once in dax_holder_notify_failure()

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

EUVD-2026-82178

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

CVE-2026-93068 drm/amd/display: Fix DM I2C teardown race

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

CVE-2026-93068 drm/amd/display: Fix DM I2C teardown race

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...