CVE-2026-93080

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs because the scmidevicedestroy function, responsible for tearing down SCMI transport devices, uses an incorrect lookup mechanism. Malformed firmware with duplicate protocol...

CVE-2026-93081

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs due to improper handling of device reference counts during the device destruction process. A concurrent unregister operation can release a device while its pointer is still ...

CVE-2026-93079

A flaw was found in the Linux kernel's CXL Compute Express Link feature handling. The cxlctlgetfeature function does not properly validate the size of the output buffer against a user-controlled count value. This oversight allows a local attacker to provide a count larger than the allocated buffe...

CVE-2026-93078

A flaw was found in the Linux kernel's CXL Compute Express Link feature handling. The cxlctlsetfeature function, responsible for setting CXL features, does not properly validate the size of the output buffer provided by a user. If a local attacker provides an output buffer of zero length, it can...

CVE-2026-93077

A flaw was found in the Linux kernel's cxl/features component. The cxlgetfeature function, when reading feature data, uses a fixed output buffer size in a loop. This can lead to a buffer overflow if a connected device returns more data than the remaining buffer capacity, potentially allowing for...

CVE-2026-93076

A flaw was found in the Linux kernel's Direct Access DAX subsystem. When a static DAX device is reconfigured, an outdated memory mapping value can persist. This prevents the system from correctly building its virtual memory map, which is essential for proper operation. This issue could lead to...

CVE-2026-93075

A flaw was found in the Linux kernel's dax/fsdev component. When a static device is unbound, the pgmap operations and owner are not properly cleared. This can lead to a use-after-free vulnerability where a subsequent memory failure event might dispatch through a stale or freed handler, potentiall...

CVE-2026-93074

A flaw was found in the Linux kernel's dax/fsdev component. An error in calculating kernel virtual addresses within the fsdevdaxdirectaccess function, specifically for multi-range devices with physical gaps, can lead to incorrect memory addressing. This issue could result in memory corruption,...

CVE-2026-93073

A flaw was found in the Linux kernel's Direct Access DAX subsystem. A race condition in the daxholdernotifyfailure function allows a concurrent operation to clear a critical pointer holderops between two reads. This can lead to a null pointer dereference, potentially enabling a local attacker to...

CVE-2026-93070

A flaw was found in the ipu6 media driver of the Linux kernel. This vulnerability arises from incorrect handling of auxiliary device private data during initialization, leading to a double free condition. A local attacker could potentially exploit this to cause a denial of service or other memory...

CVE-2026-93069

A flaw was found in the Linux kernel's Optimized Power Management OPP subsystem. An incorrect cleanup ordering during the initialization of internal pointers can lead to a use-after-free error. This occurs when the system attempts to release a reference to an already freed memory region. Such an...

CVE-2026-93067

A flaw was found in the Linux kernel's drm/bridge: tc358767 component. An issue in the tcauxtransfer function, specifically within tcauxreaddata, allows a connected DisplayPort DP AUX controller to report a read size larger than requested. This can lead to a buffer overflow when reading data into...

CVE-2026-93066

A flaw was found in the Linux kernel. A race condition in the x86/mm/pat component, specifically between cpacollapselargepages and changepageattr, can lead to a use-after-free vulnerability. A local attacker, by concurrently loading and unloading modules, could exploit this to write into freed...

CVE-2026-93065

A flaw was found in the iwlwifi driver of the Linux kernel. An integer overflow vulnerability exists where a loop counter, declared as an 8-bit unsigned integer, can wrap around if the firmware advertises more than 255 program counter entries. This can lead to an infinite loop, causing a denial o...

CVE-2026-93064

A flaw was found in the iwlwifi driver of the Linux kernel. An off-by-one error in the iwlmvmfrobtxfkeyiter function, responsible for sanitizing transmit TXF keys, incorrectly calculates the memory clear operation's starting point. This error results in one byte before the intended key being...

CVE-2026-93063

A flaw was found in the Linux kernel's iwlwifi component. This vulnerability allows an attacker to cause a buffer overflow by sending a specially crafted Service Advertisement Protocol SAP message that exceeds the allocated buffer size. This could lead to memory corruption, potentially causing th...

CVE-2026-93061

A flaw was found in the Linux kernel's graphics processing unit GPU host1x debug output. This vulnerability, a type of memory corruption, could allow a local attacker with access to debug files to read beyond the allocated memory buffer. This could potentially lead to information disclosure or...

CVE-2026-93060

A flaw was found in the Linux kernel's Adreno GPU driver. This use-after-free vulnerability occurs in the a6xxgpuinit function. Specifically, the a6xxdestroy function frees the a6xxgpu memory, but adrenogpu continues to point to the freed memory. An attacker could potentially exploit this to caus...

CVE-2026-93058

A flaw was found in the Linux kernel's drm/msm component. When the drmschedinit function fails to complete the scheduler initialization, the system attempts to finalize a partially initialized scheduler. This can lead to an unstable state or a denial of service, as the teardown process assumes...

CVE-2026-93057

A flaw was found in the Linux kernel. When the Universal Flash Storage UFS tagset is quiesced during devfreq gear scaling, the Transmit Event Queue Tail Register TX EQTR can attempt memory allocations. If direct memory reclaim is triggered in this state, it can lead to a deadlock because I/O...