CVE-2026-93139

A flaw was found in the AMDGPU driver within the Linux kernel. An issue with the hungqueuedbarray loop limit for multi-XCC Cross-Chiplet Interconnect GPUs can leave array entries uninitialized. This can lead to a null pointer dereference when accessing arrays indexed by XCC ID greater than or equ...

CVE-2026-93138

A flaw was found in the Linux kernel. Specifically, a race condition exists within the Berkeley Packet Filter BPF subsystem when preparing vmlinux BPF Type Format BTF data. This issue occurs because the system can publish a pointer to the BTF data before its contents are fully visible, allowing...

CVE-2026-93137

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. A use-after-free vulnerability exists in the bpffindvma function. This occurs when bpffindvma attempts to access memory management structures mmstruct of a different process. A race condition can arise where the target...

CVE-2026-93135

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF. When the Just-In-Time JIT compiler is unavailable or fails, BPF programs that use inlined helper functions are processed by the interpreter with unpatched helper identifiers. This incorrect processing can lead to an instruction...

CVE-2026-93134

A flaw was found in the Linux kernel. When the printk function handles legacy console printing, a specific scenario involving context handover can lead to a use-after-free vulnerability. This occurs because the system fails to verify if a memory area has been freed after a handover, potentially...

CVE-2026-93129

A flaw was found in the Linux kernel's dell-wmi-base driver. This vulnerability occurs due to an incorrect index used when accessing data fields related to the ultra performance key, which can lead to a potential buffer over-read. A local attacker could potentially exploit this to read sensitive...

CVE-2026-93123

A flaw was found in the Linux kernel's qcom-geni serial driver. When the uartflushbuffer function is called after a Direct Memory Access DMA transfer completes but before its completion interrupt is processed, the transmit buffer can be reset. If new data is written to the buffer before the stale...

CVE-2026-93115

A flaw was found in the Linux kernel's Mellanox mlxbf-pmc driver. A local attacker could exploit this by forcing the driver to bind to a device lacking an ACPI Advanced Configuration and Power Interface companion object. This action triggers a NULL pointer dereference, which can lead to a system...

CVE-2026-93103

A flaw was found in the Linux kernel's RDMA/hfi1 component. During an allocation failure, the hfi1freedevdata function can incorrectly attempt to free a device that was not properly initialized. This can lead to the removal of an unrelated device from the system's unit table. The consequence of...

CVE-2026-93097

A flaw was found in the Linux kernel's CXL mailbox cxl/mbox component. A malicious or malfunctioning device could exploit a vulnerability where an empty payload with a specific flag causes an infinite loop. This issue can lead to a system hang, preventing further poison operations and resulting i...

CVE-2026-93093

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. During the SCMI channel setup, a race condition can occur where callbacks are enabled before the channel state is fully initialized. If a callback fires in this window, it can lead to a null pointer...

CVE-2026-93068

A flaw was found in the Linux kernel's AMD display DM I2C adapter. A race condition exists where the DM I2C adapters remain visible to userspace while the DM teardown is in progress. A local attacker could exploit this by initiating a concurrent i2c-dev transfer, causing a NULL pointer dereferenc...

CVE-2026-93062

A flaw was found in the Linux kernel's iwlwifi driver. This vulnerability is caused by a division-by-zero error within the iwldbgtlvallocfragments function when the number of fragments is zero. This could lead to a system crash, resulting in a Denial of Service DoS...

CVE-2026-93122

A flaw was found in the Linux kernel's USB Audio Class UAC gadget driver. This vulnerability occurs when processing a list of sampling rates, where the driver fails to properly validate the length of the input list. An attacker could provide an overly long list, causing the system to write data...

CVE-2026-93118

A flaw was found in the Linux kernel's USB gadget driver for Aspeed UDC. During the device initialization process, a failure to allocate a Direct Memory Access DMA buffer is not properly handled. This can lead to the driver attempting to use an invalid memory address, potentially causing a system...

CVE-2026-93114

A flaw was found in the Linux kernel. A vulnerability exists in the platform/surface: acpi-notify component where a platform driver can be forced to match a device lacking an ACPI companion object. This can lead to a NULL pointer dereference when the sanprobe function attempts to access a...

CVE-2026-93113

A flaw was found in the Linux kernel, specifically within the camcc-sc8280xp component of its clock clk and power management domain pmdomain subsystems. This issue arises when unused clocks are shut down, leading to a synchronization problem where the titantopgdsc status remains 'on'. This can...

CVE-2026-93110

A flaw was found in the Linux kernel's RDMA core component. A race condition exists where RCU Read-Copy-Update callbacks, specifically putgidndev, can be invoked after the ibcore module has been unloaded. This occurs because stopping workqueues does not drain already queued callbacks, allowing RC...

CVE-2026-93109

A flaw was found in the Linux kernel's RDMA/mlx5 component. A race condition during module teardown can occur when the mlx5ib module unloads before all Read-Copy-Update RCU callbacks, such as devxfreesubscription, have completed. This premature unloading while callbacks are still pending can lead...

CVE-2026-93108

A flaw was found in the Linux kernel's RDMA/ipoib module. A race condition during module teardown allows the ibipoib module to be unloaded while its code is still executing. This can occur when IPoIB reclamation completions are signaled from within an RCU Read-Copy-Update callback, or during clie...