EUVD-2026-82223

In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPICOMPANION against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on...

CVE-2026-93114

CVE-2026-93114 affects the Linux kernel's platform/surface: acpi-notify driver. The root cause is a NULL pointer dereference in san_probe(), which dereferences the result of ACPI_COMPANION() when installing the GSBUS address space handler without verifying its presence. This flaw was introduced w...

CVE-2026-93114 platform/surface: acpi-notify: Check ACPI companion before use

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely...

EUVD-2026-82222

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely...

CVE-2026-93114 platform/surface: acpi-notify: Check ACPI companion before use

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely...

CVE-2026-93107

CVE-2026-93107 affects the Linux kernel RDMA/rxe (Soft-RoCE) subsystem. The root cause is a regression from commit 49dc9c1f0c7e, which removed the error-state branch from check_resource() but retained the error-state return in do_complete(). When a QP enters the error state while a packet is bein...

CVE-2026-93107 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-93107 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

EUVD-2026-82215

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

EUVD-2026-82201

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailboxchansetup registers the mailbox client with mboxrequestchannel, and the mailbox controller...

CVE-2026-93093 firmware: arm_scmi: Publish channel state before callbacks

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailboxchansetup registers the mailbox client with mboxrequestchannel, and the mailbox controller...

CVE-2026-93093 firmware: arm_scmi: Publish channel state before callbacks

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailboxchansetup registers the mailbox client with mboxrequestchannel, and the mailbox controller...

CVE-2026-93093

CVE-2026-93093 affects the Linux kernel's firmware/arm_scmi driver. The root cause is an ordering flaw: transport setup routines (mailbox_chan_setup() and smc_chan_setup()) can enable interrupt delivery or register callbacks before the SCMI channel state (the cinfo pointer and cinfo->handle) i...

CVE-2026-93073 dax: read holder_ops once in dax_holder_notify_failure()

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

EUVD-2026-82183

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

CVE-2026-93073

This TOCTOU race condition affects the Linux kernel DAX subsystem in the dax_holder_notify_failure() function. The function reads dax_dev->holder_ops twice without READ_ONCE()—once for a NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops ...

CVE-2026-93073 dax: read holder_ops once in dax_holder_notify_failure()

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

EUVD-2026-82178

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

CVE-2026-93068 drm/amd/display: Fix DM I2C teardown race

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

CVE-2026-93068 drm/amd/display: Fix DM I2C teardown race

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...