CVE-2026-93143 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix pmruntime refcount leak in ipu7resume ipu7resume calls pmruntimegetsync before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without...

EUVD-2026-82251

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix pmruntime refcount leak in ipu7resume ipu7resume calls pmruntimegetsync before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without...

CVE-2026-93143 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix pmruntime refcount leak in ipu7resume ipu7resume calls pmruntimegetsync before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without...

CVE-2026-93136 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation mhiepcreatedevice takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references...

CVE-2026-93136

CVE-2026-93136 affects the Linux kernel's MHI (Modem Host Interface) bus endpoint driver (bus: mhi: ep). The vulnerability is a device reference count leak in the error path of MHI device creation. When dev_set_name() or device_add() fails during device creation, the error path incorrectly drops ...

CVE-2026-93136 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation mhiepcreatedevice takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references...

EUVD-2026-82244

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation mhiepcreatedevice takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references...

CVE-2026-93105 esp: do not unref managed frag pages in esp_ssg_unref()

In the Linux kernel, the following vulnerability has been resolved: esp: do not unref managed frag pages in espssgunref espssgunref releases the page references held on the source scatterlist after the AEAD operation completes. It calls skbpageunref on every frag page for an out-of-place transfor...

EUVD-2026-82213

In the Linux kernel, the following vulnerability has been resolved: esp: do not unref managed frag pages in espssgunref espssgunref releases the page references held on the source scatterlist after the AEAD operation completes. It calls skbpageunref on every frag page for an out-of-place transfor...

CVE-2026-93084 firmware: arm_scmi: Drop handle on protocol bind failures

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Drop handle on protocol bind failures The SCMI bus notifier acquires an SCMI handle when the driver core emits BUSNOTIFYBINDDRIVER, before invoking the protocol driver probe callback. The protocol probe path on...

EUVD-2026-82194

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Drop handle on protocol bind failures The SCMI bus notifier acquires an SCMI handle when the driver core emits BUSNOTIFYBINDDRIVER, before invoking the protocol driver probe callback. The protocol probe path on...

CVE-2026-93084 firmware: arm_scmi: Drop handle on protocol bind failures

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Drop handle on protocol bind failures The SCMI bus notifier acquires an SCMI handle when the driver core emits BUSNOTIFYBINDDRIVER, before invoking the protocol driver probe callback. The protocol probe path on...

CVE-2026-90309 RDMA/erdma: Hold CQ references when processing EQ events

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev-cqxa and invoke CQ completion or error callbacks outside the xarray lock. erdmadestroycq can erase the CQ from the xarray and free its queu...

CVE-2026-90309

CVE-2026-90309 is a use-after-free vulnerability in the Linux kernel's RDMA/erdma subsystem. Event Queue (EQ) handlers look up Completion Queues (CQs) from dev->cq_xa and invoke CQ completion or error callbacks outside the xarray lock. The function erdma_destroy_cq() can erase the CQ from the ...

CVE-2026-90242 iommu/vt-d: Fix iopf_refcount leak on RID domain replacement

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice enables IOPF for the new domain but never disables it for the old one. deviceblocktranslation, called at the start of the function, tears down...

CVE-2026-90242 iommu/vt-d: Fix iopf_refcount leak on RID domain replacement

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice enables IOPF for the new domain but never disables it for the old one. deviceblocktranslation, called at the start of the function, tears down...

CVE-2026-90242

CVE-2026-90242 affects the Linux kernel iommu/vt-d subsystem. When an IOMMU domain is replaced at RID level , the iopf_refcount for the old domain is never decremented. Both intel_iommu_attach_device() and identity_domain_attach_dev() enable IOPF for the new domain but fail to disable it for the ...

EUVD-2026-81817

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in ncidataexchangecomplete nciclosedevice and ncirxwork can both call ncidataexchangecomplete concurrently. After commit 4527025d440ce8 "nfc: nci: fix circular locking dependency in...

CVE-2026-90224 nfc: nci: fix double completion race in nci_data_exchange_complete

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in ncidataexchangecomplete nciclosedevice and ncirxwork can both call ncidataexchangecomplete concurrently. After commit 4527025d440ce8 "nfc: nci: fix circular locking dependency in...

CVE-2026-90061

This Linux kernel netfilter nf_tables vulnerability occurs in both the dynset and newsetelem code paths. When no override expressions are provided for a new set element, the kernel clones the existing set expressions twice —once for the template and again for the new element—leading to a referenc...