EUVD-2026-82201

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailboxchansetup registers the mailbox client with mboxrequestchannel, and the mailbox controller...

CVE-2026-93073

This TOCTOU race condition affects the Linux kernel DAX subsystem in the dax_holder_notify_failure() function. The function reads dax_dev->holder_ops twice without READ_ONCE()—once for a NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops ...

CVE-2026-93073 dax: read holder_ops once in dax_holder_notify_failure()

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

CVE-2026-93056 usb: gadget: f_uac1_legacy: remove broken string configfs attributes

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

EUVD-2026-82166

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

CVE-2026-92500 ext4: use fsdata to track inline data write state and fix race

In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the live inode state ext4hasinlinedatainode and ext4testinodestateinode, EXT4STATEMAYINLINEDATA in the writeend handlers, use the fsdata parameter...

EUVD-2026-82113

In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreqcpuget returns NULL when no cpufreq policy is associated with the requested CPU, for example because the CPU is offline or the policy has already been torn...

CVE-2026-92479 scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags The single-doorbell completion path can call ufshcdcomplonecqe with a NULL CQE. If no command is associated with the completion tag, the warning message dereferenc...

EUVD-2026-82100

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags The single-doorbell completion path can call ufshcdcomplonecqe with a NULL CQE. If no command is associated with the completion tag, the warning message dereferenc...

CVE-2026-92479

CVE-2026-92479 affects the Linux kernel's UFS (Universal Flash Storage) SCSI driver . In the single-doorbell completion path , the function ufshcd_compl_one_cqe() can be invoked with a NULL CQE (Command Queue Entry). When no command is associated with the completion tag, the error-reporting warni...

CVE-2026-90430 iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241vintfinitlvcmdq stores the freshly allocated vcmdq pointer to the vintf-lvcmdqs array, before tegra241vcmdqallocsmmucmdq builds the vcmdq-cmdq. Th...

CVE-2026-90430

CVE-2026-90430 is a race condition in the Linux kernel's Tegra241 IOMMU command queue virtualization (iommu/tegra241-cmdqv) driver. The function tegra241_vintf_init_lvcmdq() stored a freshly allocated vcmdq pointer into the vintf->lvcmdqs[] array before the underlying arm_smmu_cmdq was fully b...

CVE-2026-90405 media: stm32: dcmi: fix some error handling bugs in probe()

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: fix some error handling bugs in probe There are a few issues here: 1 After we assign: chan = dmarequestchan&pdev-dev, "tx"; Then the error paths need to clean up before returning. The first error path does a...

CVE-2026-90397 firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...

CVE-2026-90397

CVE-2026-90397 affects the Qualcomm SCM (Secure Channel Manager) driver in the Linux kernel . The root cause is a race condition in qcom_scm_probe(): devm_request_threaded_irq() is called before __scm is published via smp_store_release(), allowing two code paths (the IRQ handler and non-atomic SM...

EUVD-2026-82058

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...

CVE-2026-90374 wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

EUVD-2026-81998

In the Linux kernel, the following vulnerability has been resolved: serial: core: do fallible allocations before the console can be registered serialcoreaddoneport allocates uport-ttygroups after uartconfigureport, which may register the console. If the allocation fails, the driver unwinds the po...

CVE-2026-90337

CVE-2026-90337 is a Linux kernel vulnerability in the serial core . In serial_core_add_one_port(), the uport->tty_groups and uport->name allocations occur after uart_configure_port() registers the console. If an allocation fails, the driver unwinds the port while its console remains registe...

CVE-2026-90337 serial: core: do fallible allocations before the console can be registered

In the Linux kernel, the following vulnerability has been resolved: serial: core: do fallible allocations before the console can be registered serialcoreaddoneport allocates uport-ttygroups after uartconfigureport, which may register the console. If the allocation fails, the driver unwinds the po...