CVE-2026-93155

In the Linux kernel , the Keembay crypto driver contains a bug in the register_aes_algs() function's error handling path. When skcipher algorithm registration fails, the function unwinds the earlier AEAD registration by calling crypto_engine_unregister_aeads() but incorrectly passes ARRAY_SIZE(al...

CVE-2026-93153

CVE-2026-93153 affects the Linux kernel in the RDMA/bng_re subsystem. The root cause is that __wait_for_resp() ignores wait_event_timeout() expiry: if the response slot remains in use after the timeout and after the polled CREQ service attempt, the loop starts another full timeout period and can ...

CVE-2026-93152

CVE-2026-93152 is a memory ordering bug in the Linux kernel's nvme-apple driver. The function apple_nvme_init_queue() initializes queue state and then marks the queue as enabled using WRITE_ONCE(enabled, true) followed by wmb(). However, a wmb() does not guarantee that the earlier initialization ...

CVE-2026-93151

CVE-2026-93151 is a memory leak in the Linux kernel's nvmet-rdma module. When an NVMe target using the RDMA transport is removed while I/Os are in flight, posted responses never receive their send completions before the connection is torn down, causing RDMA read/write contexts and request SGLs to...

CVE-2026-93150

CVE-2026-93150 affects the Linux kernel cgroup/cpuset subsystem. The root cause is a race condition on the nr_deadline_tasks variable in the cpuset structure: it can be concurrently modified by inc_dl_tasks_cs() (under rq->lock) and cpuset_attach() (under cpuset_mutex), leading to data corrupt...

CVE-2026-93149

This Linux kernel vulnerability affects the mac80211_hwsim (hardware-simulated WiFi) driver. In mac80211_hwsim_stop(), a race condition exists between the skb_queue_empty() check and the subsequent skb_dequeue() call. Because TX status handling can remove a pending frame under the queue lock betw...

CVE-2026-93148

CVE-2026-93148 is a Linux kernel vulnerability in the BPF subsystem . The root cause lies in how BTF struct walks relax the struct-size check for accesses through a trailing flexible array. While valid for ordinary BTF type walking, PTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with...

CVE-2026-93147

CVE-2026-93147 affects the Linux kernel on the s390 architecture within the BPF (Berkeley Packet Filter) subsystem. The root cause is that the ly instruction loads the 32-bit value cpu_nr into the 64-bit register BPF_REG_0 without zeroing the upper 32 bits, leaving stale data that can corrupt sub...

CVE-2026-93146

CVE-2026-93146 is a Linux kernel vulnerability in the time/namespace subsystem. The function proc_timens_set_offset() validates the tv_sec field but fails to validate that tv_nsec is within the required range [0, NSEC_PER_SEC-1] before passing it to timespec64_add() , which expects normalized val...

CVE-2026-93145

A vulnerability in the Linux kernel Qualcomm GDSC (Generic Dynamic Switch Controller) clock driver. The function gdsc_unregister() removed the OF provider entry and tore down parent/subdomain wiring but never called pm_genpd_remove() on the individual generic_pm_domain structures registered by gd...

CVE-2026-93143

CVE-2026-93143 affects the Linux kernel's staging: media: ipu7 driver. The vulnerability is a pm_runtime refcount leak in the ipu7_resume() function: when pm_runtime_get_sync() is called and the subsequent runtime PM resume fails, the usage count remains incremented but the error path returns wit...

CVE-2026-93144

CVE-2026-93144 affects the Linux kernel BPF subsystem, specifically the check_ptr_to_btf_access() path. The root cause is that program-type btf_struct_access callbacks can validate writes before the default BTF access path rejects non-read accesses, bypassing the read-only policy enforced for unt...

CVE-2026-93142

CVE-2026-93142 affects the Linux kernel 's RCAR thermal driver (thermal/drivers/rcar). The root cause is an error pointer dereference of priv->zone: the code calls thermal_zone_device_enable() before verifying that thermal_zone_device_register_with_trips() succeeded, so a failed registration l...

CVE-2026-93141

CVE-2026-93141 is a double-free vulnerability in the Linux kernel's Renesas R8A66597 USB gadget driver (r8a66597). When usb_add_gadget_udc() fails during device probe, the ep0_req request structure is freed in the err_add_udc error path and then freed a second time in clean_up2, leading to a doub...

CVE-2026-93140

CVE-2026-93140 affects the Linux kernel's UDF filesystem . When an I/O error occurs while writing the Logical Volume Integrity Descriptor (LVID) buffer, the block layer clears the BH_Uptodate flag, even though the in-memory data remains valid. Subsequent calls to udf_open_lvid() or udf_sync_fs() ...

CVE-2026-93139

CVE-2026-93139 affects the Linux kernel's amdgpu driver , specifically the MES (Micro-Engine Scheduler) component. The root cause is a loop in the hung_queue_db_array that iterated only AMDGPU_MAX_MES_PIPES times, leaving entries uninitialized for multi-XCC GPUs. This results in null pointer dere...

CVE-2026-93138

CVE-2026-93138 is a memory ordering race in the Linux kernel's BPF subsystem, specifically in bpf_get_btf_vmlinux(). The function lazily parses the vmlinux BTF under a mutex but publishes the resulting pointer via a plain store and reads it via a plain lockless load. On weakly-ordered architectur...

CVE-2026-93137

CVE-2026-93137 is a use-after-free in the Linux kernel's BPF subsystem, specifically in bpf_find_vma(). The function reads task->mm and calls mmap_read_trylock(mm) without holding a reference on the mm_struct. When operating on a foreign task , a concurrent exit_mm() can free the mm_struct bet...

CVE-2026-93136

CVE-2026-93136 affects the Linux kernel's MHI (Modem Host Interface) bus endpoint driver (bus: mhi: ep). The vulnerability is a device reference count leak in the error path of MHI device creation. When dev_set_name() or device_add() fails during device creation, the error path incorrectly drops ...

CVE-2026-93134

Linux kernel printk console subsystem is affected by a possible use-after-free in console_flush_one_record(). When emitting a record via legacy printing, a handover to another legacy printing context may release the console SRCU read lock, leaving the @con pointer invalid. The function failed to ...

CVE-2026-93135

CVE-2026-93135 is a vulnerability in the Linux kernel BPF subsystem affecting architectures that implement bpf_jit_inlines_helper_call() (e.g., LoongArch, ARM64, RISC-V ). When the verifier skips rewriting the helper call offset (insn->imm) because it expects the JIT to inline the helper, the ...

CVE-2026-93133

This CVE affects the Linux kernel ACPI RISC-V subsystem, specifically the riscv_acpi_add_prt_dep() function. The root cause is that the acpi_get_handle() call can fail, leaving the link_handle variable uninitialized , which could lead to undefined behavior when the variable is subsequently used. ...

CVE-2026-93132

This vulnerability affects the Linux kernel 's ACPI RISC-V subsystem, specifically the riscv_acpi_add_prt_dep() function. The root cause is that the loop's error conditions are handled by continue statements that skip the entry pointer update to the next entry, resulting in dubious or incorrect p...

CVE-2026-93131

CVE-2026-93131 affects the Linux kernel's platform/x86/dell-privacy driver . The vulnerability is a race condition caused by accessing priv->features_present without holding the list mutex, which allows the priv structure to be freed while still in use (use-after-free). The fix ensures the lis...

CVE-2026-93130

CVE-2026-93130 affects the Linux kernel's dell-wmi-base platform driver (under platform/x86). The root cause is a resource leak : when the module load fails, the SMBIOS request and the privacy driver are not properly cleaned up. The fix ensures proper release of these resources on the failure pat...

CVE-2026-93129

CVE-2026-93129 affects the Linux kernel driver platform/x86: dell-wmi-base . The root cause is an incorrect buffer index used when processing the "ultra performance" key from Dell WMI events. The event data passed to dell_wmi_process_key() is already parsed such that the buffer starts after the t...

CVE-2026-93127

CVE-2026-93127 is a BPF verifier bug in the Linux kernel . When a spilled scalar is reloaded via a sign-extending narrowing load (BPF_MEMSX), the verifier copies the register's scalar id to the destination, but the sign extension then changes the value. If the same stack slot is also reloaded via...

CVE-2026-93128

CVE-2026-93128 affects the platform/x86 lg-laptop driver in the Linux kernel . The event notification callback may access the kbd_backlight LED device even when it was not successfully registered with the LED subsystem, and acpi_remove() unconditionally unregisters LED devices. The fix tracks the...

CVE-2026-93126

CVE-2026-93126 affects the Linux kernel in the remoteproc subsystem, specifically the Qualcomm qcom_q6v5_adsp driver. The root cause is a reference leak : the function adsp_map_carveout calls of_parse_phandle_with_args() , which requires the caller to release the device-node reference via of_node...

CVE-2026-93125

CVE-2026-93125 is a Linux kernel BPF verifier bug in the handling of kfunc arguments named rdonly_buf_size or rdwr_buf_size. The function check_kfunc_args() stores the argument value into a u64 field (meta->r0_size) without bounding it. check_kfunc_call() then copies that value into regs[BPF_R...

CVE-2026-93124

CVE-2026-93124 affects the asus-wireless platform/x86 driver in the Linux kernel . The root cause is that asus_wireless_probe() returns success even when acpi_match_acpi_device() finds no match, storing a NULL companion pointer . When the driver is force-bound to a device without an ACPI companio...

CVE-2026-93123

CVE-2026-93123 affects the qcom GENI serial driver in the Linux kernel. The vulnerability exists in the DMA TX completion path: when uart_flush_buffer() executes after hardware completes a DMA transfer but before the completion interrupt is processed, the stale completion can advance the transmit...

CVE-2026-93121

CVE-2026-93121 affects the Linux kernel in the USB gadget f_fs subsystem. The flaw is in ffs_dmabuf_transfer(): the error paths for endpoint-disabled (ESHUTDOWN ) and request-allocation failure (ENOMEM ) call dma_fence_put() on a fence object that has only been kmalloc'd but not yet initialized w...

CVE-2026-93122

CVE-2026-93122 is an out-of-bounds write in the Linux kernel's USB gadget UAC drivers (f_uac1.c, f_uac2.c). The UAC1/UAC2 configfs rate-list attributes parse a comma-separated sampling-rate list into fixed-size arrays of UAC_MAX_RATES (10) entries without validating the token count, so an 11th en...

CVE-2026-93120

CVE-2026-93120 affects the Linux kernel 's USB gadget configfs subsystem. The function os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN (a byte count of 14) as the input length to utf16s_to_utf8s(), which expects a count of UTF-16 code units. Since the qw_sign[] array holds only 7 code units (...

CVE-2026-93119

CVE-2026-93119 affects the Linux kernel usb: ljca driver. In ljca_enumerate_gpio(), the bank_num field read from the device descriptor is used to loop into the valid_pin[] array, which holds only 2 entries (LJCA_MAX_GPIO_NUM / 32). Existing validation checks (reply-length and pins_per_bank * bank...

CVE-2026-93118

CVE-2026-93118 affects the aspeed_udc USB gadget driver in the Linux kernel . The root cause is an unchecked coherent DMA allocation in ast_udc_probe(); when the allocation fails, ast_udc_init_ep() dereferences the null pointer during probe, leading to a null pointer dereference . The fix adds a ...

CVE-2026-93117

CVE-2026-93117 is a Use-After-Free (UAF) vulnerability in the Linux kernel USB subsystem . Dynamic IDs are only guaranteed to be valid while usb_dynids_lock is held, as remove_id_store can free the underlying node. If usb_probe_interface runs concurrently with a dynamic ID removal, it may access ...

CVE-2026-93115

CVE-2026-93115 affects the Linux kernel 's platform/mellanox: mlxbf-pmc driver. The root cause is a NULL pointer dereference : mlxbf_pmc_probe() passes the result of ACPI_COMPANION() to acpi_device_hid(), which dereferences it. Because any platform driver can be force-bound to a device outside it...

CVE-2026-93116

CVE-2026-93116 affects the asus-wmi platform/x86 driver in the Linux kernel . During driver initialization in asus_wmi_add(), error path labels are misordered relative to the sequential registration of subsystems. When initialization fails partway through (e.g., asus_wmi_custom_fan_curve_init() o...

CVE-2026-93114

CVE-2026-93114 affects the Linux kernel's platform/surface: acpi-notify driver. The root cause is a NULL pointer dereference in san_probe(), which dereferences the result of ACPI_COMPANION() when installing the GSBUS address space handler without verifying its presence. This flaw was introduced w...

CVE-2026-93112

CVE-2026-93112 affects the Linux kernel BPF subsystem. The vulnerability is in bpf_cpumask_populate() , whose destination parameter is typed as struct cpumask * instead of struct bpf_cpumask *. This type mismatch allows the BPF verifier to accept borrowed, read-only cpumask pointers (e.g., from s...

CVE-2026-93113

CVE-2026-93113 affects the Linux kernel clock driver camcc-sc8280xp for the Qualcomm SC8280XP SoC. With the introduction of sync_state support in the clk and pmdomain subsystems, the titan_top_gdsc power domain gets stuck in the 'on' state when unused clocks are shut down, triggering a kernel WAR...

CVE-2026-93111

This vulnerability affects the Linux kernel BPF subsystem, specifically the tracing_multi trampoline mechanism. The root cause is that the tracing_multi link does not set the ftrace_managed flag, which causes the link to fail release when a tracing_multi link is attached followed by an fentry lin...

CVE-2026-93109

CVE-2026-93109 affects the Linux kernel 's RDMA/mlx5_ib module. The root cause is that devx_free_subscription() can remain queued as an RCU callback after the last DevX event file drops its module reference, or after an auxiliary driver detaches its devices. In either case, mlx5_ib can unload bef...

CVE-2026-93110

CVE-2026-93110 affects the Linux kernel 's RDMA/core subsystem, specifically the ib_core module. The vulnerability arises because put_gid_ndev() is queued via call_rcu(), but stopping workqueues during module unload does not drain already-queued RCU callbacks. Since synchronize_rcu() does not wai...

CVE-2026-93108

CVE-2026-93108 affects the Linux kernel 's RDMA/ipoib subsystem. During module teardown, RCU callbacks may still be executing when ib_ipoib is unloaded, because IPoIB reclamation completions can be signaled from inside an RCU callback. Additionally, a client registration failure can remove alread...

CVE-2026-93106

CVE-2026-93106 affects the Linux kernel crash_dump subsystem. The function restore_dm_crypt_keys_to_thread_keyring() passes a keyring reference to add_key_to_keyring() for each saved dm-crypt key, but that function drops the reference on every call . When more than one key is restored, the refere...

CVE-2026-93107

CVE-2026-93107 affects the Linux kernel RDMA/rxe (Soft-RoCE) subsystem. The root cause is a regression from commit 49dc9c1f0c7e, which removed the error-state branch from check_resource() but retained the error-state return in do_complete(). When a QP enters the error state while a packet is bein...

CVE-2026-93105

This Linux kernel vulnerability affects the IPsec ESP subsystem, specifically the esp_ssg_unref() function. The function unconditionally drops page references on skb frag pages after an AEAD transform, but fails to account for managed frags (SKBFL_MANAGED_FRAG_REFS)—pages owned by a zerocopy ubuf...