CVE-2026-93040

CVE-2026-93040 is a race condition in the Linux kernel's dw-edma DMA engine driver. The pause() and resume() functions read and update channel state without holding vc.lock , while interrupt handlers update the same state under that lock. This allows a scenario where pause() observes the channel ...

EUVD-2026-82150

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

CVE-2026-93040 dmaengine: dw-edma: Serialize channel state checks

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

CVE-2026-92525

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

EUVD-2026-82127

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix requested device removal race scmiprotocoldeviceunrequest drops scmirequesteddevicesmtx while notifying listeners but continues to retain the per-protocol list head. When two SCMI drivers for the same...

CVE-2026-92506 firmware: arm_scmi: Fix requested device removal race

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix requested device removal race scmiprotocoldeviceunrequest drops scmirequesteddevicesmtx while notifying listeners but continues to retain the per-protocol list head. When two SCMI drivers for the same...

CVE-2026-92506

CVE-2026-92506 affects the Linux kernel in the firmware: arm_scmi driver. The root cause is a race condition in scmi_protocol_device_unrequest(): the function drops scmi_requested_devices_mtx while notifying listeners but retains the per-protocol list head. When two SCMI drivers for the same prot...

CVE-2026-92500 ext4: use fsdata to track inline data write state and fix race

In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the live inode state ext4hasinlinedatainode and ext4testinodestateinode, EXT4STATEMAYINLINEDATA in the writeend handlers, use the fsdata parameter...

CVE-2026-92500

This CVE affects the Linux kernel ext4 filesystem . A race condition exists between write_begin and write_end handlers: a concurrent thread (such as ext4_page_mkwrite) can convert inline data to an extent during this window, causing the write_end handlers to fall through to extent-based logic wit...

CVE-2026-92501

CVE-2026-92501 is a race condition in the Linux kernel's ext4 filesystem, affecting the direct I/O (DIO) to buffered write fallback path in ext4_dio_write_iter(). On no-extent inodes (e.g., ext3), DIO writes to holes cause a fallback to buffered I/O. An unprotected window exists between ext4_buff...

EUVD-2026-82122

In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write fallback generic/746 started failing intermittently on ext3 no-extent inodes. The test triggers 'Page cache invalidation failure on direct I/O' warnings and subsequent fsync returns...

EUVD-2026-82121

In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the live inode state ext4hasinlinedatainode and ext4testinodestateinode, EXT4STATEMAYINLINEDATA in the writeend handlers, use the fsdata parameter...

CVE-2026-92501 ext4: drain in-flight DIO before buffered write fallback

In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write fallback generic/746 started failing intermittently on ext3 no-extent inodes. The test triggers 'Page cache invalidation failure on direct I/O' warnings and subsequent fsync returns...

CVE-2026-92487 exfat: fix valid_size extension over a shared writable mapping

In the Linux kernel, the following vulnerability has been resolved: exfat: fix validsize extension over a shared writable mapping When a shared writable mapping has its validsize extended by a buffered write or a page fault, exfat zeroes the page-cache gap below the new validsize. A store through...

CVE-2026-92487

CVE-2026-92487 is a race condition in the Linux kernel's exfat filesystem . When a shared writable mapping has its valid_size extended (via a buffered write or page fault), exfat zeroes the page-cache gap below the new valid_size. A concurrent store through the mapping can race with this zeroing ...

EUVD-2026-82108

In the Linux kernel, the following vulnerability has been resolved: exfat: fix validsize extension over a shared writable mapping When a shared writable mapping has its validsize extended by a buffered write or a page fault, exfat zeroes the page-cache gap below the new validsize. A store through...

EUVD-2026-82097

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Initialize completion before requesting IRQ kmbocsaesprobe requests the device IRQ before initializing irqcompletion. Once the handler is registered it can run immediately, and ocsaesirqhandler unconditionally...

CVE-2026-90431

CVE-2026-90431 is a use-after-free vulnerability in the Linux kernel remoteproc subsystem. The root cause is a race condition between rproc_crash_handler_work() and rproc_del(): a driver can be removed while crash-handler work is scheduled or executing, with no synchronization between the two cod...

EUVD-2026-82091

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241vintfinitlvcmdq stores the freshly allocated vcmdq pointer to the vintf-lvcmdqs array, before tegra241vcmdqallocsmmucmdq builds the vcmdq-cmdq. Th...

CVE-2026-90429 iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the...