CVE-2026-93046

A flaw was found in the Linux kernel's software node component. A local attacker could exploit a failing bounds check in the softwarenodegetreferenceargs function when an index of UINTMAX is passed. This could lead to an out-of-bounds access in the property array, potentially resulting in memory...

CVE-2026-93045

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF arena component. The bpfarenafreepages function incorrectly handles scalar arena addresses. When a scalar value is below the arena base, it can lead to an out-of-range memory offset. This issue could allow a local attacker to reuse...

CVE-2026-93044

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. This vulnerability occurs when the BPF interpreter attempts to process specific arena-related instructions that it does not support, particularly when a BPF program uses an arena map. This can lead to a kernel bug and an...

CVE-2026-93043

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. A local attacker could craft a BPF program that uses an insnarray map with a specific instruction BPFJMP|BPFJA|BPFX not recognized by the BPF interpreter. This misinterpretation leads to a kernel bug, causing a system...

CVE-2026-93041

A flaw was found in the Linux kernel's dw-edma component. A race condition exists where the dwedmaabortinterrupt function prematurely releases a lock, allowing the issuepending function to access outdated Direct Memory Access DMA channel status information. This can lead to new DMA descriptors...

CVE-2026-93042

A flaw was found in the Linux kernel's dmaengine: dw-edma component. This vulnerability occurs because the dw-edma driver incorrectly calls a callback function after a Direct Memory Access DMA descriptor has been terminated. This can lead to a use-after-free condition, where the system attempts t...

CVE-2026-93040

A flaw was found in the Linux kernel's dmaengine: dw-edma component. A race condition exists where the pause and resume functions can access and modify the channel state without proper synchronization, while interrupt handlers update the same state under a lock. This inconsistency can lead to a...

CVE-2026-93037

A flaw was found in the Linux kernel's RDMA/hfi1 component. The settxreqheaderahg function fails to properly handle errors returned by sdmatxinitahg. This oversight allows the system to continue processing requests as if they were successfully initialized, even when an error occurred. This could...

CVE-2026-92525

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe component. A local, unprivileged user can exploit this vulnerability by submitting malformed work queue entries WQE. This can lead to an out-of-bounds read operation, resulting in a syst...

CVE-2026-92522

A flaw was found in the Linux kernel's handling of ACPI Advanced Configuration and Power Interface tables, specifically within the IOAPIC I/O Advanced Programmable Interrupt Controller hotplug lookup. The system did not properly validate the bounds of MADT Multiple APIC Description Table and MAT...

CVE-2026-92521

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface ACPI PCI subsystem. This use-after-free vulnerability occurs because the driverdata pointer is not properly cleared when an acpipciroot object is freed during certain error handling paths or removal operations. A...

CVE-2026-92520

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. When BPF queue and stack pop/peek helpers fail to acquire a lock, they can return without properly initializing the output buffer. This allows a local attacker, by running a specially crafted BPF program, to observe...

CVE-2026-92518

A flaw was found in the Linux kernel's RISC-V BPF JIT compiler. When Control-Flow Integrity CFI with Clang is enabled, an error in calculating the tail call jump offset can lead to kernel stack corruption. This issue causes the system to improperly adjust the stack pointer, which can result in...

CVE-2026-92517

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem, specifically in the handling of extable entries for arena loadacquire operations on RISC-V architecture. Due to improper exception handling, a stale register value on fault can be leaked through a map, potentially leadin...

CVE-2026-92514

A flaw was found in the Linux kernel. When the RDMA/erdma component's Completion Event Queue CEQ tasklet is being removed, it can attempt to access memory that has already been released. This 'use-after-free' vulnerability can lead to memory corruption, which might allow an attacker to cause the...

CVE-2026-92513

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access manaib component. The manatablestoreudqp function can incorrectly manage queue pair QP references during partial table insertions. This can lead to a use-after-free vulnerability, where a freed memory region is accessed,...

CVE-2026-92512

A flaw was found in the Linux kernel's RDMA core component. A local attacker could exploit a use-after-free vulnerability due to improper synchronization during the Query Packet QP destruction process. This could lead to a system crash, resulting in a denial of service, or potentially allow for...

CVE-2026-92511

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access core. A timing issue during the cleanup of a Completion Queue CQ when accessed through the netlink path can lead to a use-after-free vulnerability. This could allow an attacker to cause memory corruption, potentially leading ...

CVE-2026-92510

A flaw was found in the Linux kernel. When a Shared Receive Queue SRQ is accessed via the netlink path, the rdmarestrackdel function is called too late during the ibdestroysrquser process. This timing issue can lead to a use-after-free vulnerability, where previously freed memory resources might...

CVE-2026-92509

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access core component. When a counter is accessed via the netlink path, the rdmarestrackdel function is invoked too late during the counterrelease process. This timing issue can lead to a use-after-free vulnerability, where...