CVE-2026-93073 dax: read holder_ops once in dax_holder_notify_failure()

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

CVE-2026-93052 misc: bcm-vk: Use acquire/release for msgq_inited

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...

EUVD-2026-82162

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...

CVE-2026-93041 dmaengine: dw-edma: Serialize abort state updates

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dwedmaabortinterrupt drops vc.lock before changing request and status. issuepending can acquire the lock in that small window, observe the old busy state, and skip starting queued...

CVE-2026-93041 dmaengine: dw-edma: Serialize abort state updates

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dwedmaabortinterrupt drops vc.lock before changing request and status. issuepending can acquire the lock in that small window, observe the old busy state, and skip starting queued...

CVE-2026-93041

CVE-2026-93041 is a race condition in the Linux kernel's dw-edma (DesignWare eDMA) DMA engine driver. The function dw_edma_abort_interrupt() drops vc.lock before updating the request and status fields. In that window, issue_pending() can acquire the lock, observe the stale busy state, and skip st...

EUVD-2026-82151

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dwedmaabortinterrupt drops vc.lock before changing request and status. issuepending can acquire the lock in that small window, observe the old busy state, and skip starting queued...

CVE-2026-93040 dmaengine: dw-edma: Serialize channel state checks

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

CVE-2026-93040 dmaengine: dw-edma: Serialize channel state checks

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

CVE-2026-93040

CVE-2026-93040 is a race condition in the Linux kernel's dw-edma DMA engine driver. The pause() and resume() functions read and update channel state without holding vc.lock , while interrupt handlers update the same state under that lock. This allows a scenario where pause() observes the channel ...

EUVD-2026-82150

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

EUVD-2026-82127

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix requested device removal race scmiprotocoldeviceunrequest drops scmirequesteddevicesmtx while notifying listeners but continues to retain the per-protocol list head. When two SCMI drivers for the same...

CVE-2026-92506 firmware: arm_scmi: Fix requested device removal race

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix requested device removal race scmiprotocoldeviceunrequest drops scmirequesteddevicesmtx while notifying listeners but continues to retain the per-protocol list head. When two SCMI drivers for the same...

CVE-2026-92506

CVE-2026-92506 affects the Linux kernel in the firmware: arm_scmi driver. The root cause is a race condition in scmi_protocol_device_unrequest(): the function drops scmi_requested_devices_mtx while notifying listeners but retains the per-protocol list head. When two SCMI drivers for the same prot...

CVE-2026-92506 firmware: arm_scmi: Fix requested device removal race

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix requested device removal race scmiprotocoldeviceunrequest drops scmirequesteddevicesmtx while notifying listeners but continues to retain the per-protocol list head. When two SCMI drivers for the same...

CVE-2026-92500 ext4: use fsdata to track inline data write state and fix race

In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the live inode state ext4hasinlinedatainode and ext4testinodestateinode, EXT4STATEMAYINLINEDATA in the writeend handlers, use the fsdata parameter...

CVE-2026-92501 ext4: drain in-flight DIO before buffered write fallback

In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write fallback generic/746 started failing intermittently on ext3 no-extent inodes. The test triggers 'Page cache invalidation failure on direct I/O' warnings and subsequent fsync returns...

CVE-2026-92501 ext4: drain in-flight DIO before buffered write fallback

In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write fallback generic/746 started failing intermittently on ext3 no-extent inodes. The test triggers 'Page cache invalidation failure on direct I/O' warnings and subsequent fsync returns...

CVE-2026-92500 ext4: use fsdata to track inline data write state and fix race

In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the live inode state ext4hasinlinedatainode and ext4testinodestateinode, EXT4STATEMAYINLINEDATA in the writeend handlers, use the fsdata parameter...

EUVD-2026-82122

In the Linux kernel, the following vulnerability has been resolved: ext4: drain in-flight DIO before buffered write fallback generic/746 started failing intermittently on ext3 no-extent inodes. The test triggers 'Page cache invalidation failure on direct I/O' warnings and subsequent fsync returns...