CVE-2026-90280 phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...

CVE-2026-90193 mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

CVE-2026-90193 mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

EUVD-2026-81786

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

CVE-2026-90193

This CVE affects the qcom-cpucp mailbox driver in the Linux kernel under PREEMPT_RT configurations. The root cause is a lock re-entrancy deadlock : qcom_cpucp_mbox_irq_fn() invokes mbox_chan_received_data() while holding chan->lock. Under PREEMPT_RT, spin_lock_irqsave() is converted to an rt_s...

EUVD-2026-81785

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90192 mailbox: qcom-cpucp: handle NULL data in send_data callback

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90192

CVE-2026-90192 affects the Linux kernel 's Qualcomm qcom-cpucp mailbox driver. The root cause is a NULL pointer dereference in qcom_cpucp_mbox_send_data(), which blindly dereferenced the data pointer when mailbox_clear_channel() invoked mbox_send_message() with NULL data to signal an RX channel c...

CVE-2026-90192 mailbox: qcom-cpucp: handle NULL data in send_data callback

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: socinfo: Avoid out of bounds read of serial number On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual devices. It's always: db410c:/sys/devices/soc0$ cat serialnumb...

CVE-2026-90281: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phycreate only enables runtime PM on the PHY device if it is already enabled on this parent...

CVE-2026-90193: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

CVE-2026-93123: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: do not advance stale DMA completions The qcom GENI serial DMA TX completion path advances the transmit fifo by the number of bytes recorded in port-txremaining. If uartflushbuffer runs after the hardware has...

CVE-2026-90406: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: handle runtime PM resume failure in core deinit Check the return value of pmruntimeresumeandget in iriscoredeinit. If runtime PM resume fails, skip hardware power-off operations but still perform software...

CVE-2026-90192: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90027

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop ccdebouncedwork is queued from the setcc and starttoggling callbacks, which run from TCPM's kthread worker. portstop returns before tcpmunregisterport destroys that...

DEBIAN-CVE-2026-90027

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop ccdebouncedwork is queued from the setcc and starttoggling callbacks, which run from TCPM's kthread worker. portstop returns before tcpmunregisterport destroys that...

AZL-101666 CVE-2026-90027 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop ccdebouncedwork is queued from the setcc and starttoggling callbacks, which run from TCPM's kthread worker. portstop returns before tcpmunregisterport destroys that...

AZL-101655 CVE-2026-90026 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel resetwork on stop pdphystop disables IRQs but leaves resetwork pending. If the IRQ handler schedules it just before disableirq, the work runs after remove frees the struct via devm. Call cancelworksy...

CVE-2026-90026

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel resetwork on stop pdphystop disables IRQs but leaves resetwork pending. If the IRQ handler schedules it just before disableirq, the work runs after remove frees the struct via devm. Call cancelworksy...