CVE-2026-93801

The Linux kernel contains a vulnerability in the smb/client component where the stack-allocated cifs_open_info_data is not zero-initialized. This allows the structure to contain random data , potentially causing fields to have incorrect values if they are not explicitly set later. No specific exp...

CVE-2026-93800

The Linux kernel contains a use-after-free (or double free) vulnerability in the btrfs filesystem. The issue occurs when btrfs_update_reloc_root() returns an error during the insert_dirty_subvol() function. This causes a root's reloc_root field to remain pointed at a freed reloc root instead of b...

CVE-2026-93799

The Linux kernel contains a vulnerability in the iwlwifi wireless driver. The function BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from a firmware notification and uses it to index the fw_id_to_mac_id[] array without performing bounds checking . This lack of validation can lead to ou...

CVE-2026-93798

The Linux kernel contains a vulnerability in the btrfs filesystem regarding reloc root cleanup within the merge_reloc_roots() function. The issue occurs when a root with zero root references is processed; the system was resetting the ->reloc_root pointer without utilizing necessary memory barr...

CVE-2026-93797

The Linux kernel contains a vulnerability in the wifi: iwlwifi: mvm component caused by an off-by-1 boundary check . The issue occurs because the system fails to verify if the length is sufficient before accessing the 11th byte. A fix has been developed and is documented in the provided kernel st...

CVE-2026-93796

The Linux kernel contains a vulnerability in the iwlwifi driver involving null RX pointers after free . When iwl_pcie_tx_init() fails after the RX initialization, the NIC initialization unwinds via iwl_pcie_rx_free(). However, the freed RX members remained non-NULL on the live transport object, p...

CVE-2026-93795

The Linux kernel contains a vulnerability in blk-cgroup where a failure in radix_tree_insert() during blkg_create() leads to memory leaks and incorrect state handling. Specifically, the blkg->online flag is set to true even on failure, and the error path fails to call percpu_ref_kill() before ...

CVE-2026-93794

The Linux kernel contains a vulnerability in the smb/client component where punching a hole after a large buffered write can result in the range being incorrectly reported as data. This occurs because a dirty folio spanning the punched range can be written back after the punch, refilling the hole...

CVE-2026-93793

The Linux kernel 's iwlwifi driver contains a vulnerability in the TX_CMD parsing logic. The issue arises because frame_count is used to walk status entries and read the trailing SCD SSN , but the minimum-length check does not follow the exact runtime layout calculation before the payload is pars...

CVE-2026-93792

The Linux kernel contains a vulnerability within the wifi: iwlwifi: mvm component. The root cause is a possible underflow occurring because the system fails to properly validate the length of the wowlan packet provided by the firmware. The issue has been addressed in recent kernel commits, which ...

CVE-2026-93790

The Linux kernel contains an out-of-bounds access vulnerability in the wifi: iwlwifi: mvm component. The issue occurs because mvmsta->tid_data is indexed by the TFD loop counter i instead of the actual tid value, resulting in lq_color being written into a random, unrelated tid_data slot during...

CVE-2026-93791

The Linux kernel (specifically the iwlwifi driver's mvm component) is vulnerable to an out-of-bounds access. The issue stems from the ba_notif->tid value, which is provided by the firmware as a u8 type. Because this value was used directly as an array index into tid_data[] without validation, ...

CVE-2026-93789

The Linux kernel contains a vulnerability in the wifi: iwlwifi driver's firmware parser. The issue is caused by a failure to validate the ALIGN(tlv_len, 4) against the remaining parser length before consuming bytes from a firmware image. This oversight can lead to a length underflow when processi...

CVE-2026-93788

The Linux kernel contains a vulnerability in the iwlwifi driver's ACPI handling. The issue stems from a failure to validate the WGDS table revision index bounds before performing a bitwise shift operation. This oversight occurs when firmware reports an invalid revision value, potentially leading ...

CVE-2026-93787

The Linux kernel contains a vulnerability in the SMB1 client where cifs_filldir() fails to verify if the entry name length provided by a server stays within the bounds of the allocated SMB response buffer. A hostile SMB1 server can return an oversized FileNameLength , causing memchr() to perform ...

CVE-2026-93786

The Linux kernel contains a vulnerability in ksmbd where the VFS would incorrectly handle inherited POSIX ACLs. Specifically, the VFS initialized a child's POSIX ACL from the parent's default ACL and the requested creation mode, but it failed to prevent the mutation of the parent ACL or the overw...

CVE-2026-93785

The Linux kernel contains a vulnerability in the cifs module related to idmap key payload length validation. The cifs.idmap key type stores its payload length in key->datalen, which is limited to U16_MAX . If the system accepts a larger key payload, the recorded length is truncated, causing su...

CVE-2026-93784

A vulnerability exists in the Linux kernel 's cfg80211 component. The function cfg80211_wext_siwgenie() fails to validate the IE buffer stored via SIOCSIWGENIE , leading to an out-of-bounds read in skip_ie() and an integer underflow in memcpy during a subsequent SIOCSIWESSID connection attempt. T...

CVE-2026-93783

The Linux kernel contains a vulnerability in the Bluetooth RFCOMM component within the rfcomm_recv_frame() function. The root cause is a missing length validation when casting skb->data to struct rfcomm_hdr. This allows a truncated frame to trigger an out-of-bounds read of uninitialized memory...

CVE-2026-93782

The Linux kernel contains a vulnerability in vhost-scsi where the software translates guest response descriptors into userspace iovecs during command submission. Because Target-core completes these commands asynchronously, a VHOST_SET_MEM_TABLE operation can replace the memory table while an in-f...

CVE-2026-93781

The Linux kernel contains a vulnerability in the scsi_eh_lock_door() function where it may block on tag allocation during the host recovery state (SHOST_RECOVERY ). Specifically, calling scsi_alloc_request() without the BLK_MQ_REQ_NOWAIT flag can cause a circular dependency: the error handler thr...

CVE-2026-93288

The Linux kernel is affected by a vulnerability in the netfilter: nfnetlink_log component. The root cause involves nfnl_log_net_exit() calling nf_log_unset(), which clears the logger pointer without an RCU grace period . Consequently, ops_free_list() may free the per-net state while concurrent pa...

CVE-2026-93287

The Linux kernel contains a vulnerability where SMBus block transfer lengths are not properly validated in the common path, specifically when using native smbus_xfer implementations. This allows user-controlled oversized block lengths to reach tracepoint memcpy calls and driver callbacks unchecke...

CVE-2026-93286

The Linux kernel contains a NULL pointer dereference vulnerability in the Appletalk network stack. The aarp_send_ddp() function calls atalk_find_dev_addr(dev) without verifying if the device has an AppleTalk interface configured (i.e., dev->atalk_ptr is NULL). This leads to a crash when access...

CVE-2026-93285

The Linux kernel addresses a vulnerability in the f2fs file system. The fix involves embedding f2fs_gc_kthread directly into f2fs_sb_info instead of allocating it dynamically. This structural change simplifies lifetime management and is intended to resolve race conditions that occur during teardo...

CVE-2026-93284

A vulnerability exists in the Linux kernel within the drm/pagemap component. The issue stems from drm_pagemap_migrate_unmap_pages() relying on a pages array to identify pages for DMA unmapping; however, drm_pagemap_migration_unlock_put_pages() clears this array during cleanup, potentially leaving...

CVE-2026-79762

The Termix web-based server management platform (versions 1.7.0 to 2.5.1 ) is vulnerable to credential decryption due to hardcoded default keys. In src/backend/utils/user-crypto.ts, the system derives wrapping keys for OIDC and WebAuthn users' Data Encryption Keys (DEKs) from committed default st...

CVE-2026-79766

The web-based server management platform Termix (versions 2.4.1 through 2.5.0) contains an OS command injection vulnerability in its ACME/Let's Encrypt certificate-request handler. An authenticated administrator can supply attacker-controlled domain and email values via PATCH /users/acme-ssl-sett...

CVE-2026-79759

The web-based server management platform Termix (versions 1.7.0 through 2.5.1) is vulnerable to cross-user information disclosure due to a missing ownership check in the POST /credentials/:id/deploy-to-host endpoint. Located in src/backend/database/routes/credentials.ts, the application fails to ...

CVE-2026-93541

The libXi library, in versions prior to 1.8.4 , is vulnerable to an out-of-bounds read within the XQueryDeviceState() function. This flaw could be exploited by an attacker to impact the system's availability. No specific exploitation details or remediation steps are provided in the documents.

CVE-2026-79761

The web-based server management platform Termix (versions 1.7.0 to 2.5.1 ) is vulnerable to command injection within the SSH key deployment flow. The root cause is located in src/backend/database/routes/credential-deploy-routes.ts, where the application derives a grep pattern from a user-controll...

CVE-2026-79758

The Termix web-based server management platform (versions 1.8.0 through 2.5.1 ) contains a vulnerability where authenticated users can access the server-stats API without per-host authorization. Specifically, the src/backend/ssh/server-stats.ts routes allow users to view host online/offline statu...

CVE-2026-75907

The door access control system on Norwegian Cruise Line assets is vulnerable to improper authentication because it grants entry based solely on the static 7-byte UID of an NTAG212 NFC chip . Since the UID is a manufacturer serial number sent in the clear and lacks challenge-response capabilities ...

CVE-2026-93283

The Linux kernel contains a vulnerability in the i3c master driver related to the device_register() error path. When device_register() fails within i3c_master_register_new_i3c_devs(), the subsequent call to put_device() drops the final reference, triggering i3c_device_release() and freeing the i3...

CVE-2026-93282

The Linux kernel 's ksmbd component contains a flaw in how it performs maximum allowed access checks for SMB2. The DACL permission check failed to consider the Authenticated Users ACE (S-1-5-11), leading to incorrect STATUS_ACCESS_DENIED errors for authorized sessions. Additionally, the system in...

CVE-2026-93281

The Linux kernel contains a vulnerability in the rtw89 wifi driver. Specifically, the function rtw89_mac_check_he_obss_narrow_bw_ru_iter() incorrectly validates the length of extended capabilities, allowing a read of byte 10 even when the datalen is less than 11. The issue is resolved by requirin...

CVE-2026-93280

The Linux kernel is vulnerable to an out-of-bounds read within the greybus: audio component. The issue occurs because gb_audio_gb_get_topology() fetches a topology blob based on a size provided by a module, but gbaudio_tplg_parse_data() fails to verify if the module-supplied section sizes (size_d...

CVE-2026-93279

A use-after-free vulnerability exists in the Linux kernel within the staging: octeon driver. The issue occurs because the TX cleanup tasklet, which can be scheduled by the watchdog IRQ handler to execute cvm_oct_tx_do_cleanup, may remain in the queue and execute after cvm_oct_remove() has already...

CVE-2026-93278

The Linux kernel contains a vulnerability in the octeon staging driver. The function cvm_oct_rx_shutdown incorrectly calls free_irq and netif_napi_del without first calling napi_disable. Because free_irq only ensures completion of hard interrupt handlers, the napi poll function may remain active....

CVE-2026-93277

The Linux kernel contains a vulnerability in the RDMA/bnxt_re driver. The issue arises because destroy callbacks currently zero the udata output after tearing down driver resources; however, if userspace access fails, uverbs preserves the uobject , allowing the destroy callback to execute again e...

CVE-2026-93276

A vulnerability exists in the Linux kernel within the phy: renesas: phy-rcar-gen3-usb2 component. The issue stems from incorrect devm action registration for the disabled VBUS regulator. Specifically, devm_regulator_get_exclusive() initializes the regulator with an enable_count of 1, but the syst...

CVE-2026-93275

The Linux kernel contains a vulnerability in the perf/x86/intel/pt component where calls to pt_event_stop() without the PERF_EF_UPDATE flag fail to call perf_aux_output_end(). This causes a subsequent pt_event_start() to call perf_aux_output_begin() again, violating nesting rules and triggering a...

CVE-2026-93274

A null pointer dereference vulnerability exists in the Linux kernel within the pinctrl: bcm2835 component. The issue occurs when the devm_pinctrl_register() function fails; the bcm2835_pinctrl_probe() function incorrectly calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO ...

CVE-2026-93273

The Linux kernel contains a vulnerability in the tps6594 regulator driver within the tps6594_regulator_probe() function. A multi-phase configuration loop fails to release node references (np, intermediate parent, and np_pmic_parent) via of_node_put(), resulting in a reference leak during each ite...

CVE-2026-93272

The Linux kernel contains a vulnerability in the remoteproc: qcom_wcnss component related to how it handles power domain (PD) regulators. Specifically, an incorrect info pointer increment—swapping num_pd_vregs for num_pds—causes the pointer to shift past the end of the array for pronto-v3 platfor...

CVE-2026-93271

The Linux kernel contains a vulnerability in the ath11k driver where it can receive HT/VHT/HE frames with a reported MCS value exceeding the maximum allowed by the mac80211 rate space (e.g., MCS 12 in HE mode). The ath11k_dp_rx_h_rate() function fails to cap these values, leaving invalid metadata...

CVE-2026-93270

The Linux kernel contains a vulnerability where the BPF interpreter fails to handle the BPF_MOV64_PERCPU_REG instruction correctly. Specifically, the interpreter ignores the 'off' offset at its ALU64_MOV_X label, which is necessary for the JIT to emit correct native code for dst_reg = src_reg + ....

CVE-2026-93269

The Linux kernel contains a circular lock dependency vulnerability in the ext4 filesystem within the ext4_ext_migrate function. The issue arises from a deadlock between s_writepages_rwsem and sb_internal (freeze protection) during concurrent EXT4_IOC_MIGRATE operations and orphan cleanup during m...

CVE-2026-93268

The Linux kernel contains a vulnerability in the ext4 filesystem where a circular lock dependency can cause a deadlock during mount operations. Specifically, the ext4_try_to_expand_extra_isize() function is called from __ext4_mark_inode_dirty() while holding an active jbd2 handle . During mount (...

CVE-2026-93267

The Linux kernel contains a potential use-after-free vulnerability in the RDMA/core component, specifically within the uverbs_free_dmah() function. The root cause is that rdma_restrack_del() is invoked too late in the destruction flow, allowing a window where a dmah remains accessible through res...