CVE-2026-92493 cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active The crash issue may occur when modprobe amdpstateut on intel platform. amdpstateut: 1 amdpstateutacpicpcvalid success! amdpstateut: 2 amdpstateutcheckenabled...

CVE-2026-92492

CVE-2026-92492 affects the cpufreq/amd-pstate driver in the Linux kernel. The root cause is a missing NULL pointer check in two dynamic EPP callback paths: amd_pstate_power_supply_notifier() and amd_pstate_profile_set(). When cpufreq_cpu_get() returns NULL (e.g., due to a CPU going offline or a p...

CVE-2026-92492 cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks

In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreqcpuget returns NULL when no cpufreq policy is associated with the requested CPU, for example because the CPU is offline or the policy has already been torn...

CVE-2026-92492 cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks

In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreqcpuget returns NULL when no cpufreq policy is associated with the requested CPU, for example because the CPU is offline or the policy has already been torn...

CVE-2026-92490 firmware: arm_scmi: Unrequest devices if driver registration fails

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unrequest devices if driver registration fails scmidriverregister requests protocol devices before registering the driver. If driverregister fails, those requests remain in the global IDR and retain pointers to...

EUVD-2026-82091

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241vintfinitlvcmdq stores the freshly allocated vcmdq pointer to the vintf-lvcmdqs array, before tegra241vcmdqallocsmmucmdq builds the vcmdq-cmdq. Th...

CVE-2026-90405

CVE-2026-90405 affects the Linux kernel driver media: stm32: dcmi, specifically error handling in its probe() function. Three bugs are identified: (1) after requesting a DMA channel via dma_request_chan(), the first error path returns without cleanup; (2) error paths check dcmi->mdma_chan befo...

CVE-2026-90405 media: stm32: dcmi: fix some error handling bugs in probe()

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: fix some error handling bugs in probe There are a few issues here: 1 After we assign: chan = dmarequestchan&pdev-dev, "tx"; Then the error paths need to clean up before returning. The first error path does a...

EUVD-2026-82066

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: fix some error handling bugs in probe There are a few issues here: 1 After we assign: chan = dmarequestchan&pdev-dev, "tx"; Then the error paths need to clean up before returning. The first error path does a...

CVE-2026-90400

CVE-2026-90400 is a race condition in the Linux kernel's md/raid10 subsystem. In md_start_sync(), the check for whether spare configuration changes are needed can become stale before reconfig_mutex is acquired, because the rdev state may change in the interim. This allows md_choose_sync_action() ...

EUVD-2026-82061

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90400 md: recheck spare changes before starting sync

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90400 md: recheck spare changes before starting sync

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90385

This Linux kernel vulnerability affects the md/raid1 module. When a new rdev is added to an existing RAID1 array with serialize_policy enabled, the condition in mddev_create_serial_pool() skips initialization of rdev->serial. The wait_for_serialization() function then dereferences an uninitial...

CVE-2026-90335 tty: skip cdev_del() when no cdev is registered

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

CVE-2026-90335

CVE-2026-90335 is a NULL-pointer dereference in the Linux kernel's TTY subsystem (serial core). When TTY device registration fails before a cdev is allocated, the serial core retains the port for use by setserial. On later removal, the NULL cdev slot is passed to cdev_del(), triggering the derefe...

EUVD-2026-81996

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

CVE-2026-90335 tty: skip cdev_del() when no cdev is registered

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

CVE-2026-90297 drm/sun4i: crtc: Propagate layer initialization error

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

CVE-2026-90297 drm/sun4i: crtc: Propagate layer initialization error

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...