CVE-2026-92492 cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks

In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreqcpuget returns NULL when no cpufreq policy is associated with the requested CPU, for example because the CPU is offline or the policy has already been torn...

CVE-2026-92492 cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks

In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreqcpuget returns NULL when no cpufreq policy is associated with the requested CPU, for example because the CPU is offline or the policy has already been torn...

EUVD-2026-82091

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241vintfinitlvcmdq stores the freshly allocated vcmdq pointer to the vintf-lvcmdqs array, before tegra241vcmdqallocsmmucmdq builds the vcmdq-cmdq. Th...

CVE-2026-90405

CVE-2026-90405 affects the Linux kernel driver media: stm32: dcmi, specifically error handling in its probe() function. Three bugs are identified: (1) after requesting a DMA channel via dma_request_chan(), the first error path returns without cleanup; (2) error paths check dcmi->mdma_chan befo...

CVE-2026-90405 media: stm32: dcmi: fix some error handling bugs in probe()

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: fix some error handling bugs in probe There are a few issues here: 1 After we assign: chan = dmarequestchan&pdev-dev, "tx"; Then the error paths need to clean up before returning. The first error path does a...

EUVD-2026-82066

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: fix some error handling bugs in probe There are a few issues here: 1 After we assign: chan = dmarequestchan&pdev-dev, "tx"; Then the error paths need to clean up before returning. The first error path does a...

CVE-2026-90400

CVE-2026-90400 is a race condition in the Linux kernel's md/raid10 subsystem. In md_start_sync(), the check for whether spare configuration changes are needed can become stale before reconfig_mutex is acquired, because the rdev state may change in the interim. This allows md_choose_sync_action() ...

EUVD-2026-82061

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90400 md: recheck spare changes before starting sync

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90400 md: recheck spare changes before starting sync

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90385

This Linux kernel vulnerability affects the md/raid1 module. When a new rdev is added to an existing RAID1 array with serialize_policy enabled, the condition in mddev_create_serial_pool() skips initialization of rdev->serial. The wait_for_serialization() function then dereferences an uninitial...

CVE-2026-90335 tty: skip cdev_del() when no cdev is registered

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

CVE-2026-90335

CVE-2026-90335 is a NULL-pointer dereference in the Linux kernel's TTY subsystem (serial core). When TTY device registration fails before a cdev is allocated, the serial core retains the port for use by setserial. On later removal, the NULL cdev slot is passed to cdev_del(), triggering the derefe...

EUVD-2026-81996

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

CVE-2026-90335 tty: skip cdev_del() when no cdev is registered

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

CVE-2026-90297 drm/sun4i: crtc: Propagate layer initialization error

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

CVE-2026-90297 drm/sun4i: crtc: Propagate layer initialization error

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

CVE-2026-90293

CVE-2026-90293 is a NULL pointer dereference in the Linux kernel's IB/isert (iSCSI target over RDMA) component. The function isert_put_login_tx() posts full-feature receive buffers before __transport_register_session() completes, so an iSCSI initiator that sends a SCSI command before receiving th...

EUVD-2026-81886

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

EUVD-2026-81887

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...