CVE-2026-93813

The Linux kernel contains a vulnerability in the btrfs file system where a crafted image with a corrupted INODE_REF item can trigger an out-of-boundary access. This occurs because the namelen can exceed the BTRFS_NAME_LEN limit of 255, while the allocated memory for @name remains only 255 bytes. ...

CVE-2026-93813 btrfs: tree-checker: validate INODE_REF's namelen

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

EUVD-2026-86201

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

CVE-2026-93813 btrfs: tree-checker: validate INODE_REF's namelen

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

CVE-2026-93274 pinctrl: bcm2835: Don't remove an unregistered GPIO chip

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

CVE-2026-93274 pinctrl: bcm2835: Don't remove an unregistered GPIO chip

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

CVE-2026-93274

A null pointer dereference vulnerability exists in the Linux kernel within the pinctrl: bcm2835 component. The issue occurs when the devm_pinctrl_register() function fails; the bcm2835_pinctrl_probe() function incorrectly calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO ...

EUVD-2026-86146

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

CVE-2026-93253 sched/isolation: Defer freeing of cpumask memblock memory to initcall

In the Linux kernel, the following vulnerability has been resolved: sched/isolation: Defer freeing of cpumask memblock memory to initcall When testing a linux-next kernel with commit 59bd1d914bb5 "memblock: warn when freeing reserved memory before memory map is initialized", the following warning...

CVE-2026-93247 Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

EUVD-2026-86255

In the Linux kernel, the following vulnerability has been resolved: apparmor: policyint make sure list heads are initialized before fail path If profile create fails before policyinit is complete the list heads are not properly initialized causing profilefree sanity checks to trigger the followin...

CVE-2026-93227 mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: deferredgrowzone: fix out-of-range firstdeferredpfn With CONFIGDEFERREDSTRUCTPAGEINIT enabled, deferredgrowzone initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, th...

CVE-2026-93227 mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: deferredgrowzone: fix out-of-range firstdeferredpfn With CONFIGDEFERREDSTRUCTPAGEINIT enabled, deferredgrowzone initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, th...

EUVD-2026-86232

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: deferredgrowzone: fix out-of-range firstdeferredpfn With CONFIGDEFERREDSTRUCTPAGEINIT enabled, deferredgrowzone initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, th...

CVE-2026-93227

The Linux kernel contains a vulnerability in deferred_grow_zone() when CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled. With a large CMA reservation , the function may initialize the memory map of an entire zone; however, if the node's RAM end is not aligned on PAGES_PER_SECTION boundaries, the updat...

CVE-2026-93218 mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2026-93217

The Linux kernel contains a vulnerability in mm/madvise where madvise_cold_or_pageout_pte_range() can trigger a kernel panic. The issue occurs because pmd_is_huge() returns true for device-private PMDs, causing a VM_BUG_ON() assertion to trip when the PMD is not present. This is potentially trigg...

EUVD-2026-85946

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

PT-2026-98013

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs tree-checker where the namelen of an INODE REF item is not properly validated. A crafted btrfs image containing a corrupted INODE REF item with a namelen...

CVE-2026-93274

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...