CVE-2026-93061 gpu: host1x: Avoid stack over-read in debug output helpers

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

EUVD-2026-82171

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-93061 gpu: host1x: Avoid stack over-read in debug output helpers

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-93055 UDF symlink pathComponent header OOB read

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

EUVD-2026-82165

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

CVE-2026-93055

CVE-2026-93055 affects the Linux kernel's UDF filesystem implementation. The vulnerability is an out-of-bounds (OOB) read in the handling of UDF symlinks: udf_symlink_filler() can pass a partial pathComponent header to udf_pc_to_char(), which then reads beyond the available input. The fix validat...

CVE-2026-93055 UDF symlink pathComponent header OOB read

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

CVE-2026-92525

CVE-2026-92525 is a vulnerability in the Linux kernel RDMA/rxe subsystem. For user-space queue pairs, rxe_post_send() takes the is_user branch and schedules send_task without validating the WQE . When rxe_requester() later calls copy_data(), it indexes wqe->dma.sge[cur_sge] using attacker-cont...

CVE-2026-92525 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92525 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

EUVD-2026-82146

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92522 ACPI: processor: validate MADT IOAPIC entry bounds

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both MADT and MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generi...

CVE-2026-92480 scsi: ufs: core: Validate string descriptors

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16stoutf8s expects a count of UTF-16 code units, not bytes. Passing the payload byt...

CVE-2026-92480

CVE-2026-92480 affects the Linux kernel in the scsi ufs core subsystem. Two related out-of-bounds read issues exist in string descriptor handling: first, utf16s_to_utf8s() expects a count of UTF-16 code units but receives a byte count, which can cause it to read beyond the descriptor buffer; seco...

EUVD-2026-82089

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs tegra241cmdqvprobe requests the error IRQ before it has allocated the cmdqv-vintfs array and set cmdqv-numvintfs. A CMDQV left enabled with a latched error...

CVE-2026-90425

CVE-2026-90425 affects the Linux kernel's iommu/tegra241-cmdqv subsystem (NVIDIA Tegra 241 IOMMU). The vulnerable function tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID taken from master->streams[0]. When a device has multiple streams , only the first is mapped, s...

EUVD-2026-82086

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241vintfinitvsid maps a guest vSID to a single physical Stream ID taken from master-streams0, and only warns when the device does not have exactly one stream. A...

CVE-2026-90425 iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241vintfinitvsid maps a guest vSID to a single physical Stream ID taken from master-streams0, and only warns when the device does not have exactly one stream. A...

CVE-2026-90425 iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241vintfinitvsid maps a guest vSID to a single physical Stream ID taken from master-streams0, and only warns when the device does not have exactly one stream. A...

CVE-2026-90419

CVE-2026-90419 affects the nilfs2 filesystem in the Linux kernel. The root cause is an out-of-bounds read in super-root block parsing: the super-root inode metadata size is trusted before nilfs_read_inode_common() is invoked, allowing a malformed filesystem image to cause a read past the end of t...