CVE-2026-92491

CVE-2026-92491 affects the arm_scmi firmware driver in the Linux kernel. The root cause is that scmi_protocol_table_register() can leave earlier protocol requests registered when a later entry in the same ID table fails. Since each request retains a pointer to the driver's ID table, a failed modu...

EUVD-2026-82112

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Roll back partial protocol table registration scmiprotocoltableregister can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID...

CVE-2026-92491 firmware: arm_scmi: Roll back partial protocol table registration

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Roll back partial protocol table registration scmiprotocoltableregister can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID...

CVE-2026-92491 firmware: arm_scmi: Roll back partial protocol table registration

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Roll back partial protocol table registration scmiprotocoltableregister can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID...

CVE-2026-92490 firmware: arm_scmi: Unrequest devices if driver registration fails

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unrequest devices if driver registration fails scmidriverregister requests protocol devices before registering the driver. If driverregister fails, those requests remain in the global IDR and retain pointers to...

CVE-2026-92490 firmware: arm_scmi: Unrequest devices if driver registration fails

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unrequest devices if driver registration fails scmidriverregister requests protocol devices before registering the driver. If driverregister fails, those requests remain in the global IDR and retain pointers to...

EUVD-2026-82091

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241vintfinitlvcmdq stores the freshly allocated vcmdq pointer to the vintf-lvcmdqs array, before tegra241vcmdqallocsmmucmdq builds the vcmdq-cmdq. Th...

CVE-2026-90405

CVE-2026-90405 affects the Linux kernel driver media: stm32: dcmi, specifically error handling in its probe() function. Three bugs are identified: (1) after requesting a DMA channel via dma_request_chan(), the first error path returns without cleanup; (2) error paths check dcmi->mdma_chan befo...

CVE-2026-90405 media: stm32: dcmi: fix some error handling bugs in probe()

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: fix some error handling bugs in probe There are a few issues here: 1 After we assign: chan = dmarequestchan&pdev-dev, "tx"; Then the error paths need to clean up before returning. The first error path does a...

EUVD-2026-82066

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: fix some error handling bugs in probe There are a few issues here: 1 After we assign: chan = dmarequestchan&pdev-dev, "tx"; Then the error paths need to clean up before returning. The first error path does a...

CVE-2026-90400

CVE-2026-90400 is a race condition in the Linux kernel's md/raid10 subsystem. In md_start_sync(), the check for whether spare configuration changes are needed can become stale before reconfig_mutex is acquired, because the rdev state may change in the interim. This allows md_choose_sync_action() ...

EUVD-2026-82061

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90400 md: recheck spare changes before starting sync

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90400 md: recheck spare changes before starting sync

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90385

This Linux kernel vulnerability affects the md/raid1 module. When a new rdev is added to an existing RAID1 array with serialize_policy enabled, the condition in mddev_create_serial_pool() skips initialization of rdev->serial. The wait_for_serialization() function then dereferences an uninitial...

CVE-2026-90373 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-90373

A race condition in the Linux kernel mt76 mt7915 WiFi driver allowed mt7915_remove_interface() to clear the wcid mask bit without holding the mutex and before clearing the RCU wcid pointer. On DBDC (dual-band dual-concurrent) configurations, the two wiphys share one mt76_dev, so this raced with a...

CVE-2026-90357

CVE-2026-90357 is a memory-corruption bug in the Linux kernel's mt76 mt7915 WiFi driver. When the MCU (firmware) rejects a TWT (Target Wake Time) agreement, the error path fails to unlink the flow from dev->twt_list while leaving flowid_mask unset. The flow slot can then be reused and memset w...

CVE-2026-90335 tty: skip cdev_del() when no cdev is registered

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

EUVD-2026-81996

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...