CVE-2026-93183

CVE-2026-93183 affects the Linux kernel 's DRM Lima GPU driver (drivers/gpu/drm). The root cause is an ordering bug: lima_vm_create() is invoked before va_start and va_end are initialized, so both are zero when passed to drm_mm_init() . When DRM_DEBUG_MM is enabled, the DRM_MM_BUG_ON check fires,...

CVE-2026-93183 drm/lima: call drm_mm_init() with a valid allocation range

In the Linux kernel, the following vulnerability has been resolved: drm/lima: call drmmminit with a valid allocation range limavmcreate is currently run before vastart and vaend are set up, meaning they are both 0. limavmcreate runs drmmminit with them as arguments for the allocator, and if...

CVE-2026-93173 bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks

In the Linux kernel, the following vulnerability has been resolved: bpf,lsm: Drop bpfprogfree from sleepablelsmhooks bpfprogputrcu is the callrcu callback for non-sleepable programs. securitybpfprogfree called from there fires bpfprogfree in softirq; if a sleepable LSM prog is attached to that...

CVE-2026-93044 bpf: Disallow interpreter fallback for arena-related insns

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

CVE-2026-93043 bpf: Disallow interpreter fallback for gotox insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for gotox insn The interpreter does not recognize the BPFJMP|BPFJA|BPFX insn, which is used for insnarray map. Thereafter, it would hit the BUGON in bpfprogrun at run time. 2.563726 BPF...

CVE-2026-90418 nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfscopydirtypages on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfscopydirtypages, which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved...

EUVD-2026-82079

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfscopydirtypages on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfscopydirtypages, which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved...

CVE-2026-90418

CVE-2026-90418 affects the Linux kernel's nilfs2 filesystem in the function nilfs_copy_dirty_pages() , which copies dirty DAT file folios/pages to a shadow page cache. The root cause is that the 'dirty' flag of a folio/page can be cleared asynchronously after the filesystem detects metadata corru...

CVE-2026-90418 nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfscopydirtypages on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfscopydirtypages, which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved...

EUVD-2026-81999

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: keep console clock enabled for atomic writes pl011consolewriteatomic runs from nbcon atomic context, where sleeping is not allowed. It calls clkenable, which takes the common-clk enablelock. Under PREEMPTRT th...

CVE-2026-90338 serial: amba-pl011: keep console clock enabled for atomic writes

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: keep console clock enabled for atomic writes pl011consolewriteatomic runs from nbcon atomic context, where sleeping is not allowed. It calls clkenable, which takes the common-clk enablelock. Under PREEMPTRT th...

CVE-2026-90299 bpf: Fix sleepable check for tracing/lsm prog

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols. It is because the verifier does not verify whether the symb...

EUVD-2026-81892

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols. It is because the verifier does not verify whether the symb...

CVE-2026-90299

CVE-2026-90299 affects the Linux kernel BPF subsystem. When CONFIG_FUNCTION_ERROR_INJECTION is disabled, the BPF verifier fails to distinguish whether an attachment target symbol is a kernel function or a BPF program , allowing a sleepable tracing program to attach to a non-kernel BPF program who...

CVE-2026-90299 bpf: Fix sleepable check for tracing/lsm prog

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols. It is because the verifier does not verify whether the symb...

PT-2026-94686

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the amba-pl011 serial driver where the pl011 console write atomic function is called from an atomic context that prohibits sleeping. The function invokes clk enable,...

CVE-2026-93044: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

PT-2026-94647

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the verifier fails to distinguish between kernel functions and BPF programs when checking for sleepable tracing or LSM...

CVE-2026-90299: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols. It is because the verifier does not verify whether the symb...

PT-2026-94979

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/lima component where the lima vm create function is executed before the va start and va end variables are properly initialized. Consequently, these variables a...