CVE-2026-93789

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGNtlvlen, 4 against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs...

CVE-2026-93788

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: acpi: validate WGDS table revision index Check tblrev bounds before BITtblrev to avoid undefined shifts when firmware reports an invalid revision value...

CVE-2026-93787

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

CVE-2026-93786

In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and...

CVE-2026-93784

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...

CVE-2026-93785

In the Linux kernel, the following vulnerability has been resolved: cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key-datalen, which is limited to U16MAX. Accepting a larger key payload truncates the recorded length and can make later users interpret...

CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

CVE-2026-93782

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replac...

CVE-2026-93781

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Do not block on tag allocation in scsiehlockdoor scsiehlockdoor is called from scsirestartoperations while the host is still in the SHOSTRECOVERY state, i.e. before the host is switched back to SHOSTRUNNING and...

CVE-2026-93288

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: wait for rcu grace period before freeing pernet state sashiko reports: "nfnllognetexit calls nflogunset, which clears the logger pointer without an RCU grace period. Immediately after, opsfreelist frees t...

CVE-2026-93287

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

CVE-2026-93286

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarpsendddp aarpsendddp calls atalkfinddevaddrdev in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured dev-atalkptr == NULL,...

CVE-2026-93285

In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fsgckthread in f2fssbinfo Instead of allocating f2fsgckthread dynamically, embed it in f2fssbinfo. This simplifies lifetime management and prepares for fixing race conditions during teardown. - sbistore -...

CVE-2026-93284

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drmpagemapmigrateunmappages relies on the pages array to determine which pages require DMA unmapping. However, drmpagemapmigrationunlockputpages clears the array as pa...

CVE-2026-93541

An out-of-bounds read in libXi's XQueryDeviceState in libXi before 1.8.4 could be used by a...

expat: Expat: XML Injection via Malformed UTF-16 Input

A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enabl...

CVE-2026-93283

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix deviceregister error path When deviceregister fails in i3cmasterregisternewi3cdevs, putdevice is called to drop the reference taken by deviceregister. That drops the last reference, so the device's release callba...

CVE-2026-93282

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated sessi...

CVE-2026-93281

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...

CVE-2026-93279

In the Linux kernel, the following vulnerability has been resolved: staging: octeon: add missing taskletkill in cvmocttxshutdown The TX cleanup tasklet can be scheduled by the watchdog IRQ handler to execute cvmocttxdocleanup. There can be a pending tasklet in the queue which might run after the...