CVE-2026-93110

CVE-2026-93110 affects the Linux kernel 's RDMA/core subsystem, specifically the ib_core module. The vulnerability arises because put_gid_ndev() is queued via call_rcu(), but stopping workqueues during module unload does not drain already-queued RCU callbacks. Since synchronize_rcu() does not wai...

CVE-2026-93108

CVE-2026-93108 affects the Linux kernel 's RDMA/ipoib subsystem. During module teardown, RCU callbacks may still be executing when ib_ipoib is unloaded, because IPoIB reclamation completions can be signaled from inside an RCU callback. Additionally, a client registration failure can remove alread...

CVE-2026-93107

CVE-2026-93107 affects the Linux kernel RDMA/rxe (Soft-RoCE) subsystem. The root cause is a regression from commit 49dc9c1f0c7e, which removed the error-state branch from check_resource() but retained the error-state return in do_complete(). When a QP enters the error state while a packet is bein...

CVE-2026-93106

CVE-2026-93106 affects the Linux kernel crash_dump subsystem. The function restore_dm_crypt_keys_to_thread_keyring() passes a keyring reference to add_key_to_keyring() for each saved dm-crypt key, but that function drops the reference on every call . When more than one key is restored, the refere...

CVE-2026-93105

This Linux kernel vulnerability affects the IPsec ESP subsystem, specifically the esp_ssg_unref() function. The function unconditionally drops page references on skb frag pages after an AEAD transform, but fails to account for managed frags (SKBFL_MANAGED_FRAG_REFS)—pages owned by a zerocopy ubuf...

CVE-2026-93104

CVE-2026-93104 is a use-after-free in the Linux kernel 's RDMA/rvt subsystem. The function rvt_alloc_device() deallocates the IB device when its port array allocation fails, but then returns the pointer to the already-freed allocation. Callers treat any non-NULL return value as valid and derefere...

CVE-2026-93103

CVE-2026-93103 affects the Linux kernel in the RDMA/hfi1 driver. The root cause is that hfi1_free_devdata() unconditionally erases dd->unit from the unit table, assuming the device was successfully inserted. If xa_alloc_irq() fails, the zero-initialized unit remains at index 0, meaning cleanup...

CVE-2026-93102

CVE-2026-93102 affects the RDMA/hfi1 driver in the Linux kernel. The root cause is a resource leak: hfi1_init_dd() allocates shared AIP/VNIC RX support, but if hfi1_init() or hfi1_register_ib_device() subsequently fails, init_one() tears down device data without calling hfi1_free_rx() , leaking n...

CVE-2026-93101

CVE-2026-93101 affects the Linux kernel's v4l2-async media subsystem . The root cause is that v4l2_async_unregister_subdev() fails to call v4l2_device_unregister_subdev() when a sub-device's asc_list is empty. This occurs in a corner case where the tvp5150 i2c driver (which uses v4l2_async) is pa...

CVE-2026-93100

CVE-2026-93100 is a use-after-free in the Linux kernel's fs/resctrl subsystem. The race occurs between rdtgroup_kn_put() (which decrements waitcount via atomic_dec_and_test() outside rdtgroup_mutex) and bulk teardown paths (free_all_child_rdtgrp() / rmdir_all_sub()) that hold the mutex. A concurr...

CVE-2026-93099

This CVE affects the Linux kernel fs/resctrl subsystem, specifically the Resource Director Technology (RDT) filesystem. The vulnerability is a Use-After-Free (UAF) in worker threads mbm_handle_overflow() and cqm_handle_limbo() . The root cause is that these workers may be blocked waiting for cpus...

CVE-2026-93098

CVE-2026-93098 is a deadlock in the Linux kernel's rpmsg: glink subsystem. During driver detach, the device core holds the device mutex throughout the remove callback chain. When the GLINK endpoint destroy path redundantly unregisters the underlying rpmsg device, it calls device_del() , which att...

CVE-2026-93097

CVE-2026-93097 affects the Linux kernel CXL/mbox subsystem's poison list handling. A CXL device that returns count == 0 with CXL_POISON_FLAG_MORE set on every iteration causes an infinite do/while loop while holding poison.mutex . This hangs the sysfs-triggered poison scan thread and blocks all s...

CVE-2026-93096

CVE-2026-93096 is a concurrency bug in the Linux kernel's CXL (Compute Express Link) features subsystem . When a Get or Set Feature payload exceeds the mailbox payload size, it is split across multiple mailbox commands. The existing mbox_mutex serializes only individual commands and is dropped be...

CVE-2026-93095

CVE-2026-93095 is a Linux kernel out-of-bounds write in the hfsplus filesystem driver. In hfsplus_delete_cat(), when the last open reference to an unlinked HFS+ hardlink backing inode is closed (str == NULL), the function reconstructs the catalog key from thread.nodeName.length read directly from...

CVE-2026-93094

A use-after-free vulnerability in the Linux kernel's ath12k Wi-Fi driver affects the AP vdev creation rollback path. When a step after ath12k_peer_create() fails, the err_peer_del path omits a call to ath12k_dp_link_peer_unassign() before the dp_link_peer is freed by ath12k_dp_link_peer_unmap_eve...

CVE-2026-93093

CVE-2026-93093 affects the Linux kernel's firmware/arm_scmi driver. The root cause is an ordering flaw: transport setup routines (mailbox_chan_setup() and smc_chan_setup()) can enable interrupt delivery or register callbacks before the SCMI channel state (the cinfo pointer and cinfo->handle) i...

CVE-2026-93092

A race condition in the Linux kernel arm_scmi firmware driver could occur during device removal. The requested-devices notifier looks up protocol fwnodes from the active_protocols IDR , and if the notifier was not unregistered before the IDR was released and destroyed, a notifier callback could r...

CVE-2026-93091

CVE-2026-93091 affects the arm_scmi firmware driver in the Linux kernel. During device removal or probe error teardown, scmi_notification_exit() releases the notification instance before the TX/RX transport channels are freed, allowing an RX interrupt to call scmi_notify() and dereference freed m...

CVE-2026-93090

CVE-2026-93090 affects the ARM SCMI (System Control and Management Interface) firmware driver in the Linux kernel . The root cause is a failure-handling defect in scmi_channels_setup(): if this function fails after the common BASE channel or earlier protocol channels have already been registered ...

CVE-2026-93089

In the Linux kernel , the firmware: arm_scmi driver contains a resource-leak vulnerability in its error handling path. When the transport channel setup succeeds but the subsequent IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the tra...

CVE-2026-93086

CVE-2026-93086 affects the Linux kernel's arm_scmi firmware driver. The vulnerability resides in scmi_cleanup_channels(), which iterates over TX/RX channel IDRs using idr_for_each() to free transport resources. The destroy callback incorrectly removed each entry from the IDR being walked, which c...

CVE-2026-93085

CVE-2026-93085 affects the Linux kernel arm_scmi firmware driver . The Device Tree parsing paths accepted SCMI protocol IDs outside the valid range defined by MSG_PROTOCOL_ID_MASK , logging an error but continuing to process the invalid value. A malformed 32-bit DT reg value could reach helpers e...

CVE-2026-93084

CVE-2026-93084 affects the ARM SCMI (System Control and Management Interface) firmware driver in the Linux kernel . The SCMI bus notifier acquires a handle on BUS_NOTIFY_BIND_DRIVER but only releases it on BUS_NOTIFY_UNBOUND_DRIVER . When device_link_add() fails, the handle is retained without a ...

CVE-2026-93083

In the Linux kernel , the firmware: arm_scmi driver's mailbox_chan_setup() function acquires a primary mailbox channel and then requests an additional unidirectional TX receiver channel . If that second request fails, the function returns immediately without releasing the primary channel , leavin...

CVE-2026-93082

CVE-2026-93082 affects the arm_scmi firmware driver in the Linux kernel . The vulnerable function is mailbox_chan_setup() , which acquires a primary P2A mailbox channel and then attempts to request an additional P2A receiver channel. If the secondary request fails, the function returns the error ...

CVE-2026-93081

CVE-2026-93081 affects the Linux kernel 's firmware: arm_scmi driver, specifically the SCMI device destroy path. The root cause is that scmi_child_dev_find() drops the reference returned by device_find_child() before returning the scmi_device pointer, so a concurrent unregister can release the de...

CVE-2026-93080

CVE-2026-93080 affects the arm_scmi firmware driver in the Linux kernel . SCMI transport devices are deliberately excluded from normal bus matching so protocol drivers cannot bind to them, but scmi_device_destroy() reused the same protocol/name lookup to locate devices for channel teardown. The f...

CVE-2026-93079

CVE-2026-93079 is a heap out-of-bounds write in the Linux kernel's CXL subsystem. In cxlctl_get_feature(), the output buffer is sized from the user-supplied fwctl_rpc.out_len, but the device is instructed to write cxl_mbox_get_feat_in.count bytes into that buffer. Because count is a separate user...

CVE-2026-93078

CVE-2026-93078 is a vulnerability in the Linux kernel 's cxl/features subsystem. The function cxlctl_set_feature() sizes its output buffer from the user-supplied fwctl_rpc.out_len without verifying it is large enough to hold the fwctl_rpc_cxl_out header. When out_len is zero, kvzalloc() returns Z...

CVE-2026-93077

CVE-2026-93077 affects the Linux kernel CXL (Compute Express Link) subsystem, specifically the cxl_get_feature() function in the cxl/features code. The function reads a device feature in a loop but passes a fixed output size as the capacity on every iteration. On the last partial iteration, the b...

CVE-2026-93076

CVE-2026-93076 affects the Linux kernel 's DAX (Direct Access) driver subsystem, specifically the fsdev_dax path for static devices. When a static DAX device is rebound from device_dax to fsdev_dax , a stale vmemmap_shift value—set by device_dax based on alignment—persists on the shared pgmap str...

CVE-2026-93074

CVE-2026-93074 affects the Linux kernel 's dax/fsdev subsystem. The root cause is in __fsdev_dax_direct_access(), which computed the kernel virtual address by adding a device-linear byte offset to virt_addr (the direct-map address of ranges[0]). For multi-range devices with physical gaps between ...

CVE-2026-93075

CVE-2026-93075 is a Linux kernel vulnerability in the dax/fsdev subsystem. When fsdev_dax_probe() sets pgmap->ops and pgmap->owner, these fields are never cleared on unbind for static devices . Because the shared pgmap is long-lived (owned by the dax bus), stale fsdev_pagemap_ops persist af...

CVE-2026-93073

This TOCTOU race condition affects the Linux kernel DAX subsystem in the dax_holder_notify_failure() function. The function reads dax_dev->holder_ops twice without READ_ONCE()—once for a NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops ...

CVE-2026-93072

CVE-2026-93072 affects the Linux kernel irqchip/renesas-irqc driver. During probe, the driver allocates generic interrupt chips in the interrupt domain but fails to set the IRQ_DOMAIN_FLAG_DESTROY_GC flag. On driver removal, the generic chips are therefore not freed, causing a resource leak . Bec...

CVE-2026-93071

CVE-2026-93071 is a memory leak in the Linux kernel's bcm2835-unicam media driver. The function v4l2_async_nf_add_fwnode_remote() allocates an async sub-device (asc) object that is only freed when v4l2_async_nf_cleanup() is called, but that cleanup was not invoked in the driver's error and remove...

CVE-2026-93070

CVE-2026-93070 is a double-free vulnerability in the Linux kernel's Intel IPU6 media driver (media: ipu6). After ipu6_bus_initialize_device() stores the isys/psys pdata pointer and initializes the auxiliary device, error-unwinding paths in the callers perform an extra kfree(pdata). Since the auxi...

CVE-2026-93069

CVE-2026-93069 affects the Linux kernel OPP (Operating Performance Points) subsystem . A prior commit (173e02d67494) changed the initialization order so that *opp_table was initialized after *opp, which reversed the order of registered cleanup functions. This can cause a use-after-free in _opp_kr...

CVE-2026-93067

CVE-2026-93067 affects the Linux kernel's tc358767 DRM bridge driver. In tc_aux_read_data(), the byte count reported by the controller via the AUX_BYTES field (which can be up to 255) is used directly to read into a 16-byte stack buffer (auxrdata) and then copied to the caller buffer, without cla...

CVE-2026-93068

CVE-2026-93068 is a teardown ordering race in the Linux kernel's AMD GPU display driver (drm/amd/display). DM I2C adapters can remain visible to userspace while display manager (DM) teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpu_dm_i2c_xfer() after the backin...

CVE-2026-93066

CVE-2026-93066 is a use-after-free in the Linux kernel's x86/mm/pat (page-attribute-table) subsystem. A race between cpa_collapse_large_pages() and __change_page_attr() allows a concurrent walker to write through a stale PTE pointer into a freed page-table page. The race is triggered when concurr...

CVE-2026-93064

This is a Linux kernel vulnerability in the iwlwifi mvm driver (Intel wireless). The root cause is an off-by-one error in iwl_mvm_frob_txf_key_iter(), the TXF key sanitiser. When a full key match is found, the memset start offset uses i - keylen instead of the correct i + 1 - keylen, which zeroes...

CVE-2026-93065

CVE-2026-93065 affects the Linux kernel iwlwifi driver. The vulnerability resides in the iwl_fwrt_dump_error_logs function, where the loop counter variable count was declared as u8 while num_pc is of type u32 . If the firmware advertises more than 255 program counter (PC) entries, the 8-bit count...

CVE-2026-93063

CVE-2026-93063 is a buffer overflow in the Linux kernel's iwlwifi MEI (Manageable Event Interface) driver. The root cause is a missing length validation: the size of a received SAP message was not checked against the local buffer before being read, allowing an oversized message to overflow the bu...

CVE-2026-93062

CVE-2026-93062 affects the Linux kernel in the iwlwifi wireless driver. The vulnerability is a division by zero in the function iwl_dbg_tlv_alloc_fragments, which can occur when num_frags evaluates to zero. The fix introduces a check that the required size is non-zero and adds a guard on num_frag...

CVE-2026-93061

CVE-2026-93061 is a stack over-read in the Linux kernel's host1x GPU driver . The functions host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed to the output callbac...

CVE-2026-93060

This vulnerability affects the Linux kernel DRM MSM Adreno GPU driver, specifically the a6xx_gpu_init() error path. The root cause is a use-after-free : when initialization fails, a6xx_destroy() frees the a6xx_gpu object, leaving adreno_gpu pointing to freed memory. The fix preserves the error co...

CVE-2026-93059

CVE-2026-93059 affects the drm/msm driver in the Linux kernel . The root cause is a missing put_task_struct() call in the else branch of recover_worker, while get_pid_task() had already incremented the task reference count. This results in a task_struct reference leak on every GPU hang recovery ,...

CVE-2026-93058

CVE-2026-93058 affects the Linux kernel's drm/msm driver (Qualcomm Adreno GPU subsystem). The vulnerability exists in msm_ringbuffer_new(): when an allocation or scheduler setup step fails, the error path calls msm_ringbuffer_destroy(), which in turn calls drm_sched_fini() even if drm_sched_init(...