CVE-2026-93153

In the Linux kernel, the following vulnerability has been resolved: RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and bngrercfwsendmessage already marks the firmware as stalled when the...

CVE-2026-93153 RDMA/bng_re: return a timeout when firmware responses stall

In the Linux kernel, the following vulnerability has been resolved: RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and bngrercfwsendmessage already marks the firmware as stalled when the...

CVE-2026-93153 RDMA/bng_re: return a timeout when firmware responses stall

In the Linux kernel, the following vulnerability has been resolved: RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and bngrercfwsendmessage already marks the firmware as stalled when the...

CVE-2026-93153

CVE-2026-93153 affects the Linux kernel in the RDMA/bng_re subsystem. The root cause is that __wait_for_resp() ignores wait_event_timeout() expiry: if the response slot remains in use after the timeout and after the polled CREQ service attempt, the loop starts another full timeout period and can ...

CVE-2026-93094

A use-after-free vulnerability in the Linux kernel's ath12k Wi-Fi driver affects the AP vdev creation rollback path. When a step after ath12k_peer_create() fails, the err_peer_del path omits a call to ath12k_dp_link_peer_unassign() before the dp_link_peer is freed by ath12k_dp_link_peer_unmap_eve...

CVE-2026-93094 wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dplinkpeer dangling references on AP vdev rollback ath12kmacvdevcreate for an AP vdev creates the bss self-peer via ath12kpeercreate, which finishes by calling ath12kdplinkpeerassign to publish the dplinkpeer in...

EUVD-2026-82202

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dplinkpeer dangling references on AP vdev rollback ath12kmacvdevcreate for an AP vdev creates the bss self-peer via ath12kpeercreate, which finishes by calling ath12kdplinkpeerassign to publish the dplinkpeer in...

CVE-2026-93094

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dplinkpeer dangling references on AP vdev rollback ath12kmacvdevcreate for an AP vdev creates the bss self-peer via ath12kpeercreate, which finishes by calling ath12kdplinkpeerassign to publish the dplinkpeer in...

CVE-2026-93094 wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dplinkpeer dangling references on AP vdev rollback ath12kmacvdevcreate for an AP vdev creates the bss self-peer via ath12kpeercreate, which finishes by calling ath12kdplinkpeerassign to publish the dplinkpeer in...

CVE-2026-93051 misc: ad525x_dpot: use driver core groups for sysfs files

In the Linux kernel, the following vulnerability has been resolved: misc: ad525xdpot: use driver core groups for sysfs files addpotprobe creates per-RDAC sysfs files manually and then optionally creates the command sysfs group. This leaves probe responsible for rolling back partial sysfs state an...

CVE-2026-93051

In the Linux kernel, the following vulnerability has been resolved: misc: ad525xdpot: use driver core groups for sysfs files addpotprobe creates per-RDAC sysfs files manually and then optionally creates the command sysfs group. This leaves probe responsible for rolling back partial sysfs state an...

CVE-2026-93051

This vulnerability affects the ad525x_dpot driver (I2C and SPI) in the Linux kernel's misc subsystem. The root cause is that ad_dpot_probe() manually created per-RDAC sysfs files, making probe responsible for rolling back partial sysfs state on failure and the remove callback responsible for matc...

CVE-2026-93051 misc: ad525x_dpot: use driver core groups for sysfs files

In the Linux kernel, the following vulnerability has been resolved: misc: ad525xdpot: use driver core groups for sysfs files addpotprobe creates per-RDAC sysfs files manually and then optionally creates the command sysfs group. This leaves probe responsible for rolling back partial sysfs state an...

EUVD-2026-82161

In the Linux kernel, the following vulnerability has been resolved: misc: ad525xdpot: use driver core groups for sysfs files addpotprobe creates per-RDAC sysfs files manually and then optionally creates the command sysfs group. This leaves probe responsible for rolling back partial sysfs state an...

CVE-2026-92488 RDMA/erdma: complete object teardown when the destroy command fails

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdmadestroyqp, erdmadestroycq, erdmaderegmr, and erdmadestroyah returned early when erdmapostcmdwait failed, leaking the queue buffers, MTTs, doorbells and the...

CVE-2026-92488

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdmadestroyqp, erdmadestroycq, erdmaderegmr, and erdmadestroyah returned early when erdmapostcmdwait failed, leaking the queue buffers, MTTs, doorbells and the...

CVE-2026-92488 RDMA/erdma: complete object teardown when the destroy command fails

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdmadestroyqp, erdmadestroycq, erdmaderegmr, and erdmadestroyah returned early when erdmapostcmdwait failed, leaking the queue buffers, MTTs, doorbells and the...

EUVD-2026-82109

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdmadestroyqp, erdmadestroycq, erdmaderegmr, and erdmadestroyah returned early when erdmapostcmdwait failed, leaking the queue buffers, MTTs, doorbells and the...

CVE-2026-92488

CVE-2026-92488 is a resource-leak vulnerability in the Linux kernel's RDMA/erdma subsystem. The destructor functions erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() returned early when erdma_post_cmd_wait() failed, leaking queue buffers, MTTs, doorbells, and hardw...

CVE-2026-92479 scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags The single-doorbell completion path can call ufshcdcomplonecqe with a NULL CQE. If no command is associated with the completion tag, the warning message dereferenc...