CVE-2026-93163 hwrng: core - fix rng list on registration error

In the Linux kernel, the following vulnerability has been resolved: hwrng: core - fix rng list on registration error hwrngregisterrng does the following: 1. Checks if rng has name and read methods set 2. Checks if the name already exists 3. Adds rng to global rnglist 4. May try to set rng to...

CVE-2026-93155 crypto: keembay - Fix AEAD unregister count in error path

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Fix AEAD unregister count in error path registeraesalgs registers the AEAD algorithms before registering the skcipher algorithms. If skcipher registration fails, the function unwinds the earlier AEAD registratio...

CVE-2026-93155

In the Linux kernel , the Keembay crypto driver contains a bug in the register_aes_algs() function's error handling path. When skcipher algorithm registration fails, the function unwinds the earlier AEAD registration by calling crypto_engine_unregister_aeads() but incorrectly passes ARRAY_SIZE(al...

CVE-2026-93142

CVE-2026-93142 affects the Linux kernel 's RCAR thermal driver (thermal/drivers/rcar). The root cause is an error pointer dereference of priv->zone: the code calls thermal_zone_device_enable() before verifying that thermal_zone_device_register_with_trips() succeeded, so a failed registration l...

CVE-2026-93142 thermal/drivers/rcar: Fix error checking in probe()

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fix error checking in probe This code accidentally calls thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. Move the call until later to avoid an error pointer...

CVE-2026-93142 thermal/drivers/rcar: Fix error checking in probe()

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fix error checking in probe This code accidentally calls thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. Move the call until later to avoid an error pointer...

EUVD-2026-82250

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fix error checking in probe This code accidentally calls thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. Move the call until later to avoid an error pointer...

EUVD-2026-82249

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: r8a66597: avoid double free of ep0req in probe error path If usbaddgadgetudc fails, r8a66597probe jumps to erraddudc and frees ep0req, then falls through to cleanup2 where ep0req is freed again when it is non-NULL...

EUVD-2026-82244

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation mhiepcreatedevice takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references...

CVE-2026-93116 platform/x86: asus-wmi: fix resource leaks on probe failure

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: fix resource leaks on probe failure During driver initialization in asuswmiadd, various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration...

CVE-2026-93107 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-93070

CVE-2026-93070 is a double-free vulnerability in the Linux kernel's Intel IPU6 media driver (media: ipu6). After ipu6_bus_initialize_device() stores the isys/psys pdata pointer and initializes the auxiliary device, error-unwinding paths in the callers perform an extra kfree(pdata). Since the auxi...

CVE-2026-93070 media: ipu6: Do not free aux device pdata after init

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6businitializedevice stores the isys/psys pdata pointer in struct ipu6busdevice and initializes the auxiliary device. After that point, error unwinding must drop the auxilia...

EUVD-2026-82147

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-93037

CVE-2026-93037 affects the Linux kernel in the RDMA/hfi1 driver. The function set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg(). When that call fails, it returns before initializing tx->txreq, yet the error is discarded and the caller continues processing the request as thou...

CVE-2026-93037 RDMA/hfi1: Propagate sdma_txinit_ahg() errors

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-93037 RDMA/hfi1: Propagate sdma_txinit_ahg() errors

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-92524 irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in itsvpeirqdomainalloc When itsirqgicdomainalloc fails, the following itsvpeirqdomainfree fails to invoke itsvepteardown for the corresponding interrupt, which leaks the resource. Invoke...

CVE-2026-92484

CVE-2026-92484 is a use-after-free vulnerability in the Linux kernel 's cxl/region subsystem, specifically in the find_pos_and_ways() error path. The bug occurs because the error handling code releases its reference to a switch decoder before logging an error message that includes the decoder's n...

CVE-2026-90429

CVE-2026-90429 is a race condition in the Linux kernel's iommu/tegra241-cmdqv driver (NVIDIA Tegra 241 IOMMU). The error interrupt service routine (ISR) can read a cmdqv->vintfs[] slot concurrently with VINTF teardown or initialization, leading to a NULL dereference , a use-after-free , or a s...