CVE-2026-93061

CVE-2026-93061 is a stack over-read in the Linux kernel's host1x GPU driver . The functions host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed to the output callbac...

EUVD-2026-82171

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-93061 gpu: host1x: Avoid stack over-read in debug output helpers

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-92520

CVE-2026-92520 affects the Linux kernel 's BPF subsystem, specifically the queue and stack pop/peek helpers . The verifier expects these helpers to initialize their output buffer, and the empty-map error path does clear it. However, a failed lock acquisition returns -EBUSY without writing the buf...

CVE-2026-92518 riscv, bpf: Fix kernel stack corruption in tailcall with CFI

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIGCFICLANG is enabled, prog-bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an...

CVE-2026-92518

CVE-2026-92518 affects the Linux kernel on RISC-V when CONFIG_CFI_CLANG is enabled. The root cause is in the BPF tailcall implementation: prog->bpf_func already skips the kcfi instruction during setup, but including it again in the tailcall jump offset causes the jump to skip an extra 4 bytes,...

EUVD-2026-82139

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIGCFICLANG is enabled, prog-bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an...

CVE-2026-92518 riscv, bpf: Fix kernel stack corruption in tailcall with CFI

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIGCFICLANG is enabled, prog-bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an...

CVE-2026-90416 RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-90416

This stack out-of-bounds read affects the RDMA/mlx5 driver's cc_params debugfs interface in the Linux kernel . The root cause is a format-string mismatch: get_param() reads a congestion control parameter as a u32 but formats it with the signed "%d" specifier into an 11-byte stack buffer . When a ...

EUVD-2026-82077

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-90358 bpf, x86: Fix trampoline stack size for 128-bit arguments

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

CVE-2026-90358

CVE-2026-90358 affects the Linux kernel BPF subsystem on x86 . The root cause is in the x86 trampoline: when a BPF program is called with a 128-bit scalar argument (e.g., __int128, arg_size == 16), the trampoline incorrectly assumes it needs only one register. This under-allocates the register sa...

CVE-2026-90358 bpf, x86: Fix trampoline stack size for 128-bit arguments

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

CVE-2026-90316

CVE-2026-90316 affects the drm/omap DSI driver in the Linux kernel. The root cause is a Use-After-Free (UAF) risk: the ISR (interrupt service routine) table was copied to allow unregistration of ISRs, but stack-allocated objects passed to those ISRs may be freed if IRQs are unregistered while sti...

EUVD-2026-81977

In the Linux kernel, the following vulnerability has been resolved: drm/omap: dsi: Do not copy isr table To be able to unregister stuff from isrs, the corresponding table was copied. Nobody seems to unregister stuff that way, so it does not help. But there are stack-allocated objects passed to...

CVE-2026-90231

CVE-2026-90231 is a flaw in the Linux kernel's AppArmor subsystem. When a task is already confined by a profile stack , the unprivileged user-namespace transition restriction on the unconfined profile is not correctly enforced. This allows a confinement escape if two transitions through an unconf...

EUVD-2026-81824

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...

CVE-2026-90070

CVE-2026-90070 affects the Linux kernel TPM driver for the st33zp24 chip. The st33zp24_status() function ignores the result of the transport read, returning data even when no byte was received. With the I2C transport , for example, the function skips i2c_master_recv() when the register-select wri...

CVE-2026-90070 tpm: st33zp24: Return zero on status read failure

In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Return zero on status read failure st33zp24status ignores the result of the transport read and returns data even when no byte was received. The I2C transport, for example, skips i2cmasterrecv when the register-sele...