CVE-2026-28326

SolarWinds Access Rights Manager (ARM) is affected by an unauthenticated remote code execution vulnerability caused by a hardcoded static key . The CVSS v3.1 score is 8.8 (HIGH) , with an adjacent network attack vector, no required privileges, and no user interaction. Impact is High across confid...

CVE-2026-93296

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views . The event General card (event_general.ctp) and server/feed preview card (preview_general.ctp) constructed donut chart legend labels by directly concatenating object names or category keys in...

CVE-2026-93292

SigNoz versions 0.88.0 through 0.142.0 contain a SQL injection vulnerability in the trace-funnel analytics endpoints. The root cause is the interpolation of service_name and span_name fields into ClickHouse string literals without escaping, as seen in the query builder code. An authenticated atta...

CVE-2026-93295

MISP (Malicious Intelligence Sharing Platform) is vulnerable to remote code execution via its background job dispatch mechanism. User-controlled fields (person and message) from the events/contact endpoint are passed unvalidated into the CakePHP console process argv. An attacker sets person to a ...

CVE-2026-85716

CVE-2026-85716 affects the AsyncHttpClient (AHC) Java library in versions 3.0.8 through 3.0.12 . The functions processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but, upon a mismatch, only log the discrepancy and st...

CVE-2026-93204

This vulnerability affects the batman-adv module (DAT component) in the Linux kernel . In batadv_dat_entry_add(), a MAC address is updated using a simple copy operation. A concurrent reader may observe only a partially updated MAC address , which can be transported over the network or used to cra...

CVE-2026-93202

CVE-2026-93202 is a deadlock vulnerability in the Linux kernel i3c master driver. The function i3c_master_register_new_i3c_devs() calls device_register() while holding i3c_bus_normaluse_lock() (a read-side rwsem). The resulting device probe callback may invoke I3C helpers that re-acquire the same...

CVE-2026-93203

CVE-2026-93203 is a race condition in the Linux kernel's batman-adv mesh networking module, specifically in the Bridge Loop Avoidance (BLA) subsystem. The function batadv_bla_add_claim() can corrupt the CRC16 of backbone gateway entries when a new claim and a backbone ownership change execute in ...

CVE-2026-93201

CVE-2026-93201 affects the Linux kernel dm-pcache (persistent cache) subsystem. The functions cache_pos_decode(), cache_key_decode(), and the last-kset branches of cache_replay(), the writeback worker, and the GC worker index cache->segments[] using a segment ID read from on-disk metadata with...

CVE-2026-93199

Linux kernel i3c master driver contains a logic flaw in the function i3c_master_search_i3c_dev_duplicate(). The function searches the I3C bus for another device sharing the same PID as a reference device, but can incorrectly match master->this—the I3C controller itself. Since the controller is...

CVE-2026-93200

CVE-2026-93200 affects the Linux kernel's i3c (Improved Inter-chip) master controller driver. The root cause is a use-after-free of the master->this pointer: it is freed in i3c_master_detach_free_devs() before the master device itself is released, yet sysfs attribute callbacks still dereferenc...

CVE-2026-93198

CVE-2026-93198 affects the Linux kernel component dm-pcache (device-mapper persistent cache). The writeback worker follows the persisted dirty_tail chain, which is decoded from the cache device independently of the key_tail chain that cache_replay() validates. Because on-media fields are authenti...

CVE-2026-93197

This Linux kernel vulnerability affects memory cgroup (memcg) LRU size accounting . When a memcg is offlined, lruvec_reparent_lru() and lru_gen_reparent_memcg() copy the per-zone lru_zone_size[] to the parent without clearing the child's copy, leaving phantom counters on the dying cgroup. Because...

CVE-2026-93196

A slab-use-after-free vulnerability in the Linux kernel's nvdimm: virtio_pmem subsystem occurs when virtio_pmem_host_ack() wakes a request already freed by the submitter. This happens because the request token remains reachable via the virtqueue after virtio_pmem_flush() returns and frees it. The...

CVE-2026-93195

CVE-2026-93195 affects the Linux kernel component drm/bridge: synopsys: dw-dp (Synopsys DesignWare DisplayPort driver). The DisplayPort AUX channel is initialized and registered during dw_dp_bind() but is never unregistered , which may lead to resource leaks and/or use-after-free when the bridge ...

CVE-2026-93194

CVE-2026-93194 affects the drm/rockchip: dw_dp (DesignWare DisplayPort) driver in the Linux kernel . The root cause is that core resources such as the DisplayPort AUX channel are initialized and registered during dw_dp_bind() but are never unregistered, leading to memory leaks and a confirmed sla...

CVE-2026-93193

CVE-2026-93193 affects the Linux kernel drm/rockchip analogix_dp driver. The vulnerability is a device node reference leak in rockchip_dp_drm_encoder_enable(), caused by of_get_child_by_name() not calling of_node_put() in a symmetric manner. The fix introduces __free(device_node) to automatically...

CVE-2026-93192

CVE-2026-93192 is a dangling pointer vulnerability in the Linux kernel's drm/v3d driver (Broadcom VideoCore IV GPU). The run_job() callbacks for the BIN, RENDER, TFU, and CSD queues assign a job to queue->active_job before calling v3d_fence_create(). If that call fails, the callback returns NU...

CVE-2026-93191

CVE-2026-93191 affects the Linux kernel's SMACK (Security Markup and Labeling Kernel) module. The root cause is in smack_msg_queue_msgrcv(), which incorrectly checks the permissions of the current task rather than the target task. When the pipelined_send() optimization in the msgsnd() syscall pat...

CVE-2026-93190

CVE-2026-93190 affects the Linux kernel platform/chrome: cros_ec_typec driver. The function cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into a fixed 7-element stack array without validating that source_cap_count or sink_cap_count (8-bit fields from the...

CVE-2026-93189

CVE-2026-93189 is a use-after-free in the Linux kernel HID core subsystem. When a driver's probe calls hid_device_io_start() and then fails at a later initialization step, the unwind path hid_hw_stop() frees struct hidraw via hidraw_disconnect() while in-flight HID reports on another CPU may stil...

CVE-2026-93188

CVE-2026-93188 affects the Linux kernel's HID roccat driver . The functions kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device claiming the Ro...

CVE-2026-93187

CVE-2026-93187 affects the Linux kernel in the ASoC SOF ipc4-topology driver. When the number of input or output audio formats is zero, the functions sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() print an error and jump to the cleanup label, but the return variable ret re...

CVE-2026-93186

CVE-2026-93186 affects the Linux kernel CXL mailbox (cxl/mbox) subsystem. The CXL_MEM_SEND_COMMAND ioctl bounds the user-supplied in.size to the mailbox payload size but leaves out.size unbounded. The subsequent call to kvzalloc(out.size) in cxl_mbox_cmd_ctor() allows a user-controlled oversized ...

CVE-2026-93185

CVE-2026-93185 affects the Linux kernel ASoC rt700-sdw driver (Realtek RT700 SoundWire audio codec). The root cause is a work-object lifecycle bug : rt700_sdw_remove() only drains jack_detect_work and jack_btn_check_work when hw_init is true, but that flag is cleared when the SoundWire slave tran...

CVE-2026-93184

CVE-2026-93184 affects the Linux kernel ASoC fsl_audmix driver's runtime PM handling during probe. After pm_runtime_enable(), the AUDMIX audio mixer block remains powered off until the first runtime resume. Register writes issued between probe() and that first resume—originating from DAPM or ALSA...

CVE-2026-93183

CVE-2026-93183 affects the Linux kernel 's DRM Lima GPU driver (drivers/gpu/drm). The root cause is an ordering bug: lima_vm_create() is invoked before va_start and va_end are initialized, so both are zero when passed to drm_mm_init() . When DRM_DEBUG_MM is enabled, the DRM_MM_BUG_ON check fires,...

CVE-2026-93182

CVE-2026-93182 is a u32 overflow in the Linux kernel's CFS scheduler (sched/fair), specifically in update_tg_cfs_runnable(). The overflow occurs when se->avg.runnable_avg * divider exceeds the 32-bit range, corrupting the runnable sum and cascading through load-average propagation to produce a...

CVE-2026-93180

CVE-2026-93180 affects the Linux kernel's drm/panthor GPU driver. A NULL pointer dereference occurs when a GPU memory mapping is split during a partial unmap of an evicted Buffer Object (BO) . The root cause is that the logic handling partial unmap of huge pages was not fully skipped for the VMA ...

CVE-2026-93181

CVE-2026-93181 affects the Linux kernel in the perf/x86/intel/uncore subsystem. The root cause is an incorrect call ordering: in the CPU online path, uncore_box_ref() was invoked before uncore_change_context(), so the gate on box->cpu >= 0 always failed and the uncore box was never initiali...

CVE-2026-93179

This vulnerability affects the Linux kernel in the drm/amd/powerplay subsystem. When the VBIOS supplies a malformed VoltageObjectInfo table, voltage objects whose usSize is smaller than the header or would advance the cursor past the table end are not rejected, causing either an infinite loop (ze...

CVE-2026-93178

A missing bounds check in the Linux kernel's drm/amdgpu/pm/powerplay subsystem (SMU7) allows the vddInd and vddcInd fields parsed from VBIOS tables to index into voltage lookup tables without validation, potentially causing out-of-bounds reads with high impact on confidentiality and availability ...

CVE-2026-93177

CVE-2026-93177 affects the Linux kernel 's drm/amdgpu/pm/powerplay driver for Vega10 GPUs. The vddInd, vddciInd, and mvddInd indices parsed from VBIOS tables are used to access vddc, vddci, and vddmem lookup tables without bounds checks across nine code sites, allowing an out-of-range index to re...

CVE-2026-93176

CVE-2026-93176 is a dangling pointer vulnerability in the Linux kernel's DRM/AMD display driver, specifically in amdgpu_dm_plane_drm_plane_reset(). The function frees the old plane state before allocating a replacement; if the subsequent kzalloc() call fails, the state pointer is left pointing to...

CVE-2026-93175

CVE-2026-93175 is a dangling pointer (use-after-free) in the Linux kernel's DRM/AMD display driver. The function amdgpu_dm_crtc_reset_state() freed the old CRTC state before allocating a replacement; if kzalloc() failed, the function returned early, leaving a pointer to already-freed memory. The ...

CVE-2026-93174

CVE-2026-93174 affects the Linux kernel BPF subsystem. In copy_map_value_long(), the function passes map->value_size to bpf_obj_memcpy() instead of the correctly padded round_up(map->value_size, 8). When a per-CPU map contains special fields, bpf_obj_memcpy() copies around those fields with...

CVE-2026-93173

CVE-2026-93173 affects the Linux kernel BPF LSM subsystem. When a non-sleepable BPF program is freed via __bpf_prog_put_rcu() (a call_rcu() callback), it invokes security_bpf_prog_free(), which in turn calls bpf_prog_free in softirq context. If a sleepable LSM program is attached to the sleepable...

CVE-2026-93172

CVE-2026-93172 affects the Linux kernel in the mm/mm_init subsystem. The vulnerability is a missing allocation failure check for pgdat->per_cpu_nodestats in free_area_init_core_hotplug(), which results in a NULL pointer dereference when the code attempts to offset into the per-cpu area. The fi...

CVE-2026-93170

CVE-2026-93170 is a race condition in the Linux kernel's dmaengine: xilinx_dma driver, affecting the AXIDMA and MCDMA interrupt handlers. When multiple descriptors are queued, an interrupt after partial completion causes the channel to be incorrectly marked idle and start_transfer() to be called ...

CVE-2026-93171

CVE-2026-93171 affects the Linux kernel's lp5860 LED driver . The root cause is a potential double-unlock of a mutex in lp5860_device_init(): when lp5860_init_dt() fails, an already-unlocked mutex is unlocked a second time. The fix reworks how the lock is taken and released to avoid this. The fix...

CVE-2026-93169

CVE-2026-93169 is a race condition in the Linux kernel's zynqmp_dma DMA engine driver (Zynq MP platform). In the zynqmp_dma_remove() function, runtime PM was disabled only after checking device state and performing a manual suspend. This ordering could race with runtime PM activity during the mod...

CVE-2026-93167

CVE-2026-93167 affects the Linux kernel on C-SKY ABIv2 architectures. In the syscall trace path , the code adjusts the stack pointer (sp ) before loading the 5th and 6th syscall arguments (a4/a5) from pt_regs . Because those register-save offsets are relative to the original pt_regs base, reading...

CVE-2026-93168

In the Linux kernel , the Xilinx DMA engine driver (xilinx_dma) can cause a CPU stall lasting several minutes when xilinx_dma_poll_timeout is called with delay_us=0 and the polled condition is never met. The root cause is a severe underestimation of wall-clock time in poll_timeout_us_atomic after...

CVE-2026-93166

This Linux kernel vulnerability affects the rtw89 Wi-Fi driver, specifically the debug function rtw89_ppdu_str() . The root cause is an off-by-one error : a > comparison should have been >=, allowing an out-of-bounds memory access when processing PDU strings. The fix is provided in kernel p...

CVE-2026-93164

CVE-2026-93164 affects the Linux kernel uprobes/x86 subsystem. The root cause is that optimized uprobes installed on a 5-byte NOP could clobber the x86 redzone area : the call instruction used to jump to the uprobe trampoline stores the return address on the stack, potentially overwriting tempora...

CVE-2026-93165

A memory overread in the Linux kernel's Chrome sensorhub driver (platform/chrome/sensorhub) occurs when a malfunctioning EC firmware causes msg->insize to be clamped in cros_ec_cmd_xfer() because it exceeds max_response. The resulting shorter-than-expected read causes a subsequent memcpy() in ...

CVE-2026-93163

CVE-2026-93163 is a use-after-free vulnerability in the Linux kernel's hardware random number generator (hwrng) core subsystem. The root cause is in hwrng_register(): after adding a new RNG to the global rng_list, if the subsequent attempt to set it as current_rng fails, the function returns an e...

CVE-2026-93162

CVE-2026-93162 affects the Linux kernel crypto: qat subsystem. The root cause is a use-after-free condition: the QAT reset worker queues an SR-IOV re-enable operation using a work_struct and completion embedded in an on-stack adf_sriov_dev_data structure. If the completion wait times out, the res...

CVE-2026-93161

CVE-2026-93161 affects the Linux kernel 's crypto: qat subsystem (Intel Quick Assist Technology crypto driver). The function qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack; the resulting key schedule contains sensitive key material that can remain in the stack frame after ...

CVE-2026-93160

CVE-2026-93160 affects the atmel-ecc crypto driver in the Linux kernel . The hardware ECDH path in atmel_ecdh_compute_shared_secret() could use a private key stored in the device that was not generated for the current tfm , because the function lacked the public-key-cache check already present in...