DEBIAN-CVE-2026-90192

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

EUVD-2026-82253

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdscunregister gdscunregister removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove on the individual genericpmdomain structures...

CVE-2026-93145

A vulnerability in the Linux kernel Qualcomm GDSC (Generic Dynamic Switch Controller) clock driver. The function gdsc_unregister() removed the OF provider entry and tore down parent/subdomain wiring but never called pm_genpd_remove() on the individual generic_pm_domain structures registered by gd...

CVE-2026-93145 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdscunregister gdscunregister removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove on the individual genericpmdomain structures...

CVE-2026-93145 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdscunregister gdscunregister removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove on the individual genericpmdomain structures...

CVE-2026-93123 serial: qcom-geni: do not advance stale DMA completions

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: do not advance stale DMA completions The qcom GENI serial DMA TX completion path advances the transmit fifo by the number of bytes recorded in port-txremaining. If uartflushbuffer runs after the hardware has...

CVE-2026-93123

CVE-2026-93123 affects the qcom GENI serial driver in the Linux kernel. The vulnerability exists in the DMA TX completion path: when uart_flush_buffer() executes after hardware completes a DMA transfer but before the completion interrupt is processed, the stale completion can advance the transmit...

EUVD-2026-82231

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: do not advance stale DMA completions The qcom GENI serial DMA TX completion path advances the transmit fifo by the number of bytes recorded in port-txremaining. If uartflushbuffer runs after the hardware has...

CVE-2026-93113

CVE-2026-93113 affects the Linux kernel clock driver camcc-sc8280xp for the Qualcomm SC8280XP SoC. With the introduction of sync_state support in the clk and pmdomain subsystems, the titan_top_gdsc power domain gets stuck in the 'on' state when unused clocks are shut down, triggering a kernel WAR...

CVE-2026-90406

CVE-2026-90406 affects the Linux kernel 's qcom iris media driver . The vulnerability resides in iris_core_deinit(), where the return value of pm_runtime_resume_and_get() was not checked. If the runtime PM resume fails, the driver would proceed with hardware power-off operations and call pm_runti...

CVE-2026-90406 media: qcom: iris: handle runtime PM resume failure in core deinit

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: handle runtime PM resume failure in core deinit Check the return value of pmruntimeresumeandget in iriscoredeinit. If runtime PM resume fails, skip hardware power-off operations but still perform software...

CVE-2026-90406 media: qcom: iris: handle runtime PM resume failure in core deinit

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: handle runtime PM resume failure in core deinit Check the return value of pmruntimeresumeandget in iriscoredeinit. If runtime PM resume fails, skip hardware power-off operations but still perform software...

CVE-2026-90397

CVE-2026-90397 affects the Qualcomm SCM (Secure Channel Manager) driver in the Linux kernel . The root cause is a race condition in qcom_scm_probe(): devm_request_threaded_irq() is called before __scm is published via smp_store_release(), allowing two code paths (the IRQ handler and non-atomic SM...

EUVD-2026-82058

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...

CVE-2026-90397 firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...

CVE-2026-90282 phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because...

CVE-2026-90282

CVE-2026-90282 affects the QCOM QMP USB legacy PHY driver in the Linux kernel. The root cause is a NULL pointer dereference of qmp->phy when the runtime suspend callback executes in a narrow window between pm_runtime_enable() and pm_runtime_forbid(), before the PHY pointer is initialized. The ...

EUVD-2026-81873

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...

CVE-2026-90281 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phycreate only enables runtime PM on the PHY device if it is already enabled on this parent...

CVE-2026-90280

CVE-2026-90280 is a NULL pointer dereference in the Linux kernel 's Qualcomm QMP USB PHY driver (phy: qcom: qmp-usb). A small timing window exists where the runtime suspend callback executes after pm_runtime_enable() but before pm_runtime_forbid(), causing a crash because the qmp->phy pointer ...