CVE-2026-97418 ALSA: es18xx: check control allocation before private data setup

In the Linux kernel, the following vulnerability has been resolved: ALSA: es18xx: check control allocation before private data setup sndes18xxmixer creates controls with sndctlnew1 and then stores bookkeeping pointers or sets privatefree before calling sndctladd. sndctlnew1 can return NULL on...

CVE-2026-97414 ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365afesuspend mt8365afesuspend allocates the register backup buffer with devmkcalloc, but does not check for allocation failure before using the returne...

EUVD-2026-86027

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365afesuspend mt8365afesuspend allocates the register backup buffer with devmkcalloc, but does not check for allocation failure before using the returne...

CVE-2026-97414 ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365afesuspend mt8365afesuspend allocates the register backup buffer with devmkcalloc, but does not check for allocation failure before using the returne...

CVE-2026-97414

The Linux kernel contains a vulnerability in the ASoC: mediatek: mt8365-afe-pcm driver. The mt8365_afe_suspend() function allocates a register backup buffer using devm_kcalloc() but fails to verify if the allocation succeeded. This lack of checking can lead to a NULL-pointer dereference when acce...

EUVD-2026-86214

In the Linux kernel, the following vulnerability has been resolved: spi: Add NULL check for spigetdeviceid in spigetdevicematchdata Prevent NULL pointer dereference when spigetdeviceid returns NULL, which can happen when using driveroverride without matching SPI ID entry...

CVE-2026-93825

The Linux kernel contains a vulnerability where a NULL pointer dereference can occur within the spi subsystem. Specifically, the function spi_get_device_match_data() fails to perform a NULL check on the return value of spi_get_device_id(). This issue can be triggered when using driver_override wi...

CVE-2026-93825 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()

In the Linux kernel, the following vulnerability has been resolved: spi: Add NULL check for spigetdeviceid in spigetdevicematchdata Prevent NULL pointer dereference when spigetdeviceid returns NULL, which can happen when using driveroverride without matching SPI ID entry...

CVE-2026-93825 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()

In the Linux kernel, the following vulnerability has been resolved: spi: Add NULL check for spigetdeviceid in spigetdevicematchdata Prevent NULL pointer dereference when spigetdeviceid returns NULL, which can happen when using driveroverride without matching SPI ID entry...

CVE-2026-93796 wifi: iwlwifi: pcie: null RX pointers after free

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX pointers after free When iwlpcietxinit fails after RX init, nic init unwinds via iwlpcierxfree. The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touc...

CVE-2026-93796 wifi: iwlwifi: pcie: null RX pointers after free

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX pointers after free When iwlpcietxinit fails after RX init, nic init unwinds via iwlpcierxfree. The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touc...

CVE-2026-93286 net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarpsendddp aarpsendddp calls atalkfinddevaddrdev in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured dev-atalkptr == NULL,...

CVE-2026-93286 net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarpsendddp aarpsendddp calls atalkfinddevaddrdev in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured dev-atalkptr == NULL,...

CVE-2026-93286

The Linux kernel contains a NULL pointer dereference vulnerability in the Appletalk network stack. The aarp_send_ddp() function calls atalk_find_dev_addr(dev) without verifying if the device has an AppleTalk interface configured (i.e., dev->atalk_ptr is NULL). This leads to a crash when access...

EUVD-2026-86165

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarpsendddp aarpsendddp calls atalkfinddevaddrdev in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured dev-atalkptr == NULL,...

CVE-2026-93274 pinctrl: bcm2835: Don't remove an unregistered GPIO chip

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

CVE-2026-93274 pinctrl: bcm2835: Don't remove an unregistered GPIO chip

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

EUVD-2026-86146

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

CVE-2026-93274

A null pointer dereference vulnerability exists in the Linux kernel within the pinctrl: bcm2835 component. The issue occurs when the devm_pinctrl_register() function fails; the bcm2835_pinctrl_probe() function incorrectly calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO ...

CVE-2026-93273

The Linux kernel contains a vulnerability in the tps6594 regulator driver within the tps6594_regulator_probe() function. A multi-phase configuration loop fails to release node references (np, intermediate parent, and np_pmic_parent) via of_node_put(), resulting in a reference leak during each ite...