PT-2026-94642

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IB/isert component where the isert put login tx function sends the final Login Response before the session is registered via transport register session. If an...

PT-2026-94492

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the dpll device ops function during a teardown race condition. This happens when the last owner of a dpll device unregisters while another driver sti...

PT-2026-94645

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/sun4i component where the sun4i crtc init function returns NULL instead of an error pointer when layer initialization fails. Because the caller function sun4i...

CVE-2026-90400: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90426: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241cmdqvremove tears each VINTF down first, then calls freeirq. Tearing a VINTF down frees vintf0 and clears cmdqv-vintfs0. An error in that window makes...

PT-2026-94532

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the null blk driver where attribute store methods generated with NULLB DEVICE ATTR do not use locks when updating device configurations. Because the NULLB DEV ...

PT-2026-94555

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA sequencer MIDI component where the snd midi input event function can run while a rawmidi substream is closing. This creates a race condition in snd rawmidi...

PT-2026-94848

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Multiple issues occur in the ipoctal component when a device is removed while a tty session remains active. These include a Use-After-Free UAF of struct ipoctal because the remove callba...

PT-2026-94854

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f uac1 legacy USB gadget driver where the UAC1 STR ATTRIBUTE macro defines configfs show/store handlers for the fn play, fn cap, and fn cntl string options. The...

PT-2026-94871

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the dax holder notify failure function. The function reads the holder ops variable twice without using READ ONCE, once for a NULL check and once for the indire...

PT-2026-94745

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the qcom SCM driver during the probe process. In qcom scm probe, the function devm request threaded irq is called before the scm variable is publishe...

PT-2026-94748

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the md module where md start sync checks for spare configuration changes before acquiring the reconfig mutex. Because the rdev state can change before the mute...

PT-2026-94778

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where tegra241 vintf init lvcmdq stores a newly allocated vcmdq pointer in the vintf-lvcmdqs array before tegra241 vcmdq alloc smmu cmdq finishes building the vcmdq-cmdq...

PT-2026-94787

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the single-doorbell completion path when the ufshcd compl one cqe function is called with a NULL CQE Completion Queue Entry. If no command is...

PT-2026-94800

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference can occur in the amd-pstate driver of the cpufreq subsystem. This happens when the cpufreq cpu get function returns NULL because no policy is associated with t...

PT-2026-94801

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.6.0-0010.rc1.ctl4 Description A kernel NULL pointer dereference occurs when the amd pstate ut driver is loaded via modprobe on non-AMD platforms, such as Intel platforms. This issue is triggered within the amd pstate ut...

PT-2026-94808

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ext4 file system when handling inline data writes. A concurrent thread, such as ext4 page mkwrite, can convert inline data to an extent between the write...

PT-2026-94889

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm scmi firmware where transport setup may enable callbacks before the setup routine returns. Specifically, mailbox chan setup registers the mailbox client via mb...

CVE-2026-90139: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fuse: check for NULL root inode in fusefillsupersubmount fuseiget can return NULL when its inode allocation fails, but fusefillsupersubmount passed the result straight to getfuseinode and decremented fi-nlookup without checking i...

CVE-2026-93093: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailboxchansetup registers the mailbox client with mboxrequestchannel, and the mailbox controller...