CVE-2026-92505

CVE-2026-92505 addresses an undefined behavior bug in the Linux kernel's iommu/amd module, specifically in the devid_write debugfs function. The root cause is that when for_each_pci_segment() completes without finding a matching segment, the pci_seg pointer is left pointing to an invalid memory l...

CVE-2026-92505 iommu/amd: Fix undefined behavior in devid_write debugfs function

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix undefined behavior in devidwrite debugfs function When foreachpcisegment loop completes without finding a matching segment, the pciseg pointer is not NULL but points to an invalid memory location the list head...

EUVD-2026-81962

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix call to hardware monitoring event handler The first parameter of hwmonnotifyevent is supposed to be the hardware monitoring device. The bnxt driver calls it with the platform device as first parameter instead. This AP...

CVE-2026-90101

CVE-2026-90101 affects the bnxt_en driver in the Linux kernel. The driver calls hwmon_notify_event() with the platform device as its first parameter instead of the expected hardware monitoring device . This API contract violation results in undefined behavior and may lead to a crash . The fix pas...

CVE-2026-90101 bnxt_en: Fix call to hardware monitoring event handler

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix call to hardware monitoring event handler The first parameter of hwmonnotifyevent is supposed to be the hardware monitoring device. The bnxt driver calls it with the platform device as first parameter instead. This AP...

CVE-2026-90055 usb: atm: usbatm: fix invalid ci_range initialization

In the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid cirange initialization syzbot reported a shift-out-of-bounds in vccconnect: UBSAN: shift-out-of-bounds in net/atm/common.c:382:32 shift exponent -1 is negative CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18...

CVE-2026-92523: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

CVE-2026-92505: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix undefined behavior in devidwrite debugfs function When foreachpcisegment loop completes without finding a matching segment, the pciseg pointer is not NULL but points to an invalid memory location the list head...

CVE-2026-93146: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93147: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-90056: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: fec: only stop PTP if it was initialized fecptpinit is only called when fep-bufdescex is available. However, fecprobe unconditionally calls fecptpstop on the failedinit path, and fecdrvremove unconditionally calls fecptpstop...

CVE-2026-90055: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid cirange initialization syzbot reported a shift-out-of-bounds in vccconnect: UBSAN: shift-out-of-bounds in net/atm/common.c:382:32 shift exponent -1 is negative CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18...

PT-2026-94403

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usbatm atm init function where the ci range.vpi bits and ci range.vci bits fields are incorrectly initialized to a sentinel value of -1. These fields are...

CVE-2026-93121: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix fence cleanup in ffsdmabuftransfer error paths The error paths for endpoint-disabled ESHUTDOWN and request-allocation failure ENOMEM in ffsdmabuftransfer jump to errfenceput which calls dmafenceput on the...

CVE-2026-90101: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix call to hardware monitoring event handler The first parameter of hwmonnotifyevent is supposed to be the hardware monitoring device. The bnxt driver calls it with the platform device as first parameter instead. This AP...

CVE-2026-90300: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear buf on error in bpfgettaskstack Both bpfgettaskstack and bpfgettaskstacksleepable helpers that use bpfgettaskstack have buf defined as ARGPTRTOUNINITMEM argument and we should initialize the buf on every return path...

CVE-2026-93037: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-89943

In the Linux kernel, the following vulnerability has been resolved: ASoC: loongson: Fix error handling in ACPI property parsing In loongsoncardparseacpi, the return value of devicepropertyreadstring for the codec-dai-name property was ignored. If the property is missing or invalid, an uninitializ...

CVE-2026-89876

In the Linux kernel, the following vulnerability has been resolved: media: tda18250: fix possible integer overflow Integer overflow may occur, when variable exp equals to zero. Result of shift 1 exp - 1 may then leads to undefined behavior...

DEBIAN-CVE-2026-89876

In the Linux kernel, the following vulnerability has been resolved: media: tda18250: fix possible integer overflow Integer overflow may occur, when variable exp equals to zero. Result of shift 1 exp - 1 may then leads to undefined behavior...