CVE-2026-93130

CVE-2026-93130 affects the Linux kernel's dell-wmi-base platform driver (under platform/x86). The root cause is a resource leak : when the module load fails, the SMBIOS request and the privacy driver are not properly cleaned up. The fix ensures proper release of these resources on the failure pat...

EUVD-2026-82238

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-base: Fix resource leak on module load failure We need to properly clean up the SMBIOS request and the privacy driver when the module load fails...

CVE-2026-93130 platform/x86: dell-wmi-base: Fix resource leak on module load failure

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-base: Fix resource leak on module load failure We need to properly clean up the SMBIOS request and the privacy driver when the module load fails...

CVE-2026-93110 RDMA/core: Wait for RCU callbacks before unloading ib_core

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Wait for RCU callbacks before unloading ibcore putgidndev is queued with callrcu and implemented in ibcore. Stopping the workqueues does not drain callbacks already queued, so RCU could invoke it after the module code...

CVE-2026-93109 RDMA/mlx5: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

CVE-2026-93109 RDMA/mlx5: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

EUVD-2026-82217

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

CVE-2026-93110

CVE-2026-93110 affects the Linux kernel 's RDMA/core subsystem, specifically the ib_core module. The vulnerability arises because put_gid_ndev() is queued via call_rcu(), but stopping workqueues during module unload does not drain already-queued RCU callbacks. Since synchronize_rcu() does not wai...

CVE-2026-93110 RDMA/core: Wait for RCU callbacks before unloading ib_core

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Wait for RCU callbacks before unloading ibcore putgidndev is queued with callrcu and implemented in ibcore. Stopping the workqueues does not drain callbacks already queued, so RCU could invoke it after the module code...

CVE-2026-93108

CVE-2026-93108 affects the Linux kernel 's RDMA/ipoib subsystem. During module teardown, RCU callbacks may still be executing when ib_ipoib is unloaded, because IPoIB reclamation completions can be signaled from inside an RCU callback. Additionally, a client registration failure can remove alread...

EUVD-2026-82216

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93108 RDMA/ipoib: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93108 RDMA/ipoib: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-92491

CVE-2026-92491 affects the arm_scmi firmware driver in the Linux kernel. The root cause is that scmi_protocol_table_register() can leave earlier protocol requests registered when a later entry in the same ID table fails. Since each request retains a pointer to the driver's ID table, a failed modu...

EUVD-2026-82112

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Roll back partial protocol table registration scmiprotocoltableregister can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID...

CVE-2026-92482

CVE-2026-92482 affects the MediaTek pinctrl driver in the Linux kernel. The use-after-free occurs because the gpio_chip is allocated with device-managed memory (devm) but registered using the non-managed gpiochip_add_data(). While harmless for built-in drivers, once the driver is built as a modul...

CVE-2026-92481

CVE-2026-92481 affects the Linux kernel MediaTek pinctrl driver (EINT subsystem). The function mtk_eint_do_init() creates an IRQ domain , populates it with a mapping for every EINT line, and installs a chained handler on the parent interrupt, but none of these resources are ever released. While h...

CVE-2026-90291

CVE-2026-90291 is a use-after-free in the Linux kernel's module/dups subsystem, specifically in the lifetime handling of kmod_dup_req instances. The root cause is that the code relied on RCU to protect concurrent access, but kmod_dup_request_exists_wait() may hold a reference across a blocking wa...

EUVD-2026-81884

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...

CVE-2026-90291 module/dups: Fix use-after-free in kmod_dup_req lifetime handling

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...