EUVD-2026-82257

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

CVE-2026-93149

This Linux kernel vulnerability affects the mac80211_hwsim (hardware-simulated WiFi) driver. In mac80211_hwsim_stop(), a race condition exists between the skb_queue_empty() check and the subsequent skb_dequeue() call. Because TX status handling can remove a pending frame under the queue lock betw...

CVE-2026-93149 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

CVE-2026-93149 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

CVE-2026-93139 drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed b...

CVE-2026-93139 drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed b...

EUVD-2026-82247

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed b...

CVE-2026-93139

CVE-2026-93139 affects the Linux kernel's amdgpu driver , specifically the MES (Micro-Engine Scheduler) component. The root cause is a loop in the hung_queue_db_array that iterated only AMDGPU_MAX_MES_PIPES times, leaving entries uninitialized for multi-XCC GPUs. This results in null pointer dere...

CVE-2026-93124

CVE-2026-93124 affects the asus-wireless platform/x86 driver in the Linux kernel . The root cause is that asus_wireless_probe() returns success even when acpi_match_acpi_device() finds no match, storing a NULL companion pointer . When the driver is force-bound to a device without an ACPI companio...

CVE-2026-93124 platform/x86: asus-wireless: Fail probe when there is no ACPI match

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver can be forced to match a device that does not match its list of device IDs because of devicematchdriveroverride, so platform drivers that...

CVE-2026-93124 platform/x86: asus-wireless: Fail probe when there is no ACPI match

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver can be forced to match a device that does not match its list of device IDs because of devicematchdriveroverride, so platform drivers that...

EUVD-2026-82232

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver can be forced to match a device that does not match its list of device IDs because of devicematchdriveroverride, so platform drivers that...

EUVD-2026-82226

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: check endpoint DMA allocation astudcprobe allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep derives per-endpoint buffer pointers from udc-ep0buf, so a failed...

CVE-2026-93118 usb: gadget: aspeed_udc: check endpoint DMA allocation

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: check endpoint DMA allocation astudcprobe allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep derives per-endpoint buffer pointers from udc-ep0buf, so a failed...

CVE-2026-93118

CVE-2026-93118 affects the aspeed_udc USB gadget driver in the Linux kernel . The root cause is an unchecked coherent DMA allocation in ast_udc_probe(); when the allocation fails, ast_udc_init_ep() dereferences the null pointer during probe, leading to a null pointer dereference . The fix adds a ...

CVE-2026-93115

CVE-2026-93115 affects the Linux kernel 's platform/mellanox: mlxbf-pmc driver. The root cause is a NULL pointer dereference : mlxbf_pmc_probe() passes the result of ACPI_COMPANION() to acpi_device_hid(), which dereferences it. Because any platform driver can be force-bound to a device outside it...

CVE-2026-93115 platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL

In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPICOMPANION against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on...

EUVD-2026-82223

In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPICOMPANION against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on...

CVE-2026-93115 platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL

In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPICOMPANION against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on...

CVE-2026-93114

CVE-2026-93114 affects the Linux kernel's platform/surface: acpi-notify driver. The root cause is a NULL pointer dereference in san_probe(), which dereferences the result of ACPI_COMPANION() when installing the GSBUS address space handler without verifying its presence. This flaw was introduced w...