398469 matches found
CVE-2026-93278 staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
In the Linux kernel, the following vulnerability has been resolved: staging: octeon: add missing napidisable in cvmoctrxshutdown cvmoctrxshutdown calls freeirq and netifnapidel without disabling the napi instance first. As the freeirq only waits for completion of hard interrupt handlers, the napi...
CVE-2026-93277 RDMA/bnxt_re: Validate udata before executing commands
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Validate udata before executing commands The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy...
CVE-2026-93276 phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator
In the Linux kernel, the following vulnerability has been resolved: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator devmregulatorgetexclusive initialises the regulator with enablecount = 1, requiring the consumer to disable it before release. The devm...
CVE-2026-93275 perf/x86/intel/pt: Fix stop/start with no update
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pteventstop is called without PERFEFUPDATE flag, then perfauxoutputend is not called. A subsequent call to pteventstart will call perfauxoutputbegin again which violates the rul...
CVE-2026-93274 pinctrl: bcm2835: Don't remove an unregistered GPIO chip
In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...
CVE-2026-93273 regulator: tps6594: Fix device node reference leaks in multiphase loop
In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594: Fix device node reference leaks in multiphase loop In tps6594regulatorprobe, the multi-phase configuration loop calls offindnodebyname to find buck nodes by name, and ofgetparent twice to navigate to the PMIC...
CVE-2026-93272 remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcomwcnss: Fix handling the lack of PD regulators in v3 The changes introduced to handle single power domain platforms have swapped the info pointer increment from numpdvregs to numpds, which would shift the info...
CVE-2026-93271 wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate ath11k can receive HT/VHT/HE frames whose reported MCS is above the maximum that can be expressed in the corresponding mac80211 rate space e.g. an HE frame...
CVE-2026-93269 ext4: fix circular lock dependency in ext4_ext_migrate
In the Linux kernel, the following vulnerability has been resolved: ext4: fix circular lock dependency in ext4extmigrate Move iputtmpinode after ext4writepagesupwrite to avoid a circular lock dependency between swritepagesrwsem and sbinternal freeze protection. The deadlock scenario: CPU0...
CVE-2026-93270 bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn
In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for BPFADDRPERCPU insn The BPFMOV64PERCPUREG insn requires JIT to emit native code to for 'dstreg = srcreg + '. However, the interpreter ignores the 'off' at its ALU64MOVX label. The 'off'...
CVE-2026-93268 ext4: skip extra isize expansion during mount to prevent deadlock
In the Linux kernel, the following vulnerability has been resolved: ext4: skip extra isize expansion during mount to prevent deadlock ext4trytoexpandextraisize is called from ext4markinodedirty while holding an active jbd2 handle. During mount !SBACTIVE, the expand path may move xattrs to externa...
CVE-2026-93267 RDMA/core: Fix potential use after free in uverbs_free_dmah()
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in uverbsfreedmah When accessing a dmah via the netlink path the only synchronization mechanism for the said dmah is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...
CVE-2026-93266 arm64: RSI: fix field-spanning write warning in attestation token init
In the Linux kernel, the following vulnerability has been resolved: arm64: RSI: fix field-spanning write warning in attestation token init The challenge is passed in registers a1 through a8. However, copying to ®s.a1 makes FORTIFY treat the destination as the single a1 field, resulting in a...
CVE-2026-93265 PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node DSP3 has an integrated Ethernet MAC Endpoint which has its own set of config registers for configuring settings such as ASPM. The Endpoint device has two...
CVE-2026-93264 RDMA/efa: Fix PBL chunk length computation
In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating the PBL, if it's an indirect PBL we create a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size and can hold 510 addresses EFAPTRSPERCHUNK...
CVE-2026-93263 clk: eswin: Zero-initialize stack-allocated clk_init_data
In the Linux kernel, the following vulnerability has been resolved: clk: eswin: Zero-initialize stack-allocated clkinitdata eswinclkregisterpll and eswinregisterclkdiv declare a struct clkinitdata on the stack and only initialize some of its fields parentdata respectively parenthws...
CVE-2026-93262 md/raid5-ppl: fix use-after-free in ppl_do_flush()
In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppldoflush The loop in ppldoflush continues iterating after calling ppliounitfinished, touching io-pendingflushes and leading to a use-after-free. Add a break statement to stop the loop once io...
CVE-2026-93261 locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Fix NULL pointer dereference in locksetclass registerlockclass can return NULL when the lock class pool is exhausted, graphlock fails, or key validation fails. However, locksetclass uses the return value directly...
CVE-2026-93260 powerpc/xive: propagate IPI init errors to prevent use-after-free
In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When xiveinitipis fails e.g. irqdomainallocirqs fails, the error path frees the global xiveipis array. However, xivesmpprobe previously ignored this failure and...
CVE-2026-93259 powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
In the Linux kernel, the following vulnerability has been resolved: powerpc/irq: Fix missing r2 clobber in PCREL inline assembly In CONFIGPPCKERNELPCREL mode, r2 is no longer reserved for the TOC pointer and is available as a caller-saved register 0. Both calldoirq and calldosoftirq use inline...
CVE-2026-93258 ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: do not use makebadinode in ocfs2readinodeblockfull This reverts commit 58b6fcd2ab34 "ocfs2: mark inode bad upon validation failure during read". Since 'makebadinode' resets inode type to SIFREG, doing this for directory...
CVE-2026-93256 arm64: hibernate: mask DAIF before restoring hibernated kernel
In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: mask DAIF before restoring hibernated kernel The arm64 hibernate code manages the exception masking in an unsound way, leading to potential crashes and/or warnings during resume. When a hibernation image is save...
CVE-2026-93257 block: handle nogenerate/noverify properly in fs-integrity
In the Linux kernel, the following vulnerability has been resolved: block: handle nogenerate/noverify properly in fs-integrity Check the BIPCHECK flags before generating or verifying PI information, otherwise this can be incorrectly called for non-PI metadata and cause generation of incorrect...
CVE-2026-93255 btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock
In the Linux kernel, the following vulnerability has been resolved: btrfs: make sure EXTENTBUFFERREADING is cleared under refslock FALSE ALERTS There is a bug report that the warning inside invalidateandcheckbtreefolios got triggered during btrfs/298: BTRFS info device sdd: first mount of...
CVE-2026-93254 arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit
In the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary localirqdisable on kernel exit Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call localirqdisable befo...
CVE-2026-93253 sched/isolation: Defer freeing of cpumask memblock memory to initcall
In the Linux kernel, the following vulnerability has been resolved: sched/isolation: Defer freeing of cpumask memblock memory to initcall When testing a linux-next kernel with commit 59bd1d914bb5 "memblock: warn when freeing reserved memory before memory map is initialized", the following warning...
CVE-2026-93252 ocfs2: fix circular locking dependency in ocfs2_init_acl()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2initacl A lockdep warning indicates a circular locking dependency between &oi-ipxattrsem and &journal-jtransbarrier: WARNING: possible circular locking dependency detected is trying ...
CVE-2026-93251 ACPI: bus: Introduce acpi_bus_get_primary_device()
In the Linux kernel, the following vulnerability has been resolved: ACPI: bus: Introduce acpibusgetprimarydevice The function used for obtaining the first "physical" device for which the given ACPI one is the ACPI companion, acpigetfirstphysicalnode, may return a stale device pointer mostly in...
CVE-2026-96745 PHP object injection via unsuppressible __pclass class inference in command monitoring events
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...
CVE-2026-93250 vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlanmdbflush vxlanmdbflush iterates over the MDB entries using hlistforeachentrysafe, which only tolerates the removal of the current entry. Contrary to the comment above the loop, the removal o...
CVE-2026-96746 Heap buffer overflow via mid-scan command list growth in client topology monitoring
An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the...
CVE-2026-93249 spi: amlogic-spisg: Make sure clk_init_data is fully initialized
In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initializ...
CVE-2026-93248 drm/xe: don't WARN on kernel job timeout when device already wedged
In the Linux kernel, the following vulnerability has been resolved: drm/xe: don't WARN on kernel job timeout when device already wedged igt@xewedged@wedged-at-any-timeout wedges the device in mode 2 UPONANYHANGNORESET and then rebinds the driver. During unbind, a GSC proxy kernel submission can...
CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...
CVE-2026-96744 Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence...
CVE-2026-93247 Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...
CVE-2026-93246 octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks every MSI-X vector and uses strstr to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector...
CVE-2026-93245 apparmor: policy_int make sure list heads are initialized before fail path
In the Linux kernel, the following vulnerability has been resolved: apparmor: policyint make sure list heads are initialized before fail path If profile create fails before policyinit is complete the list heads are not properly initialized causing profilefree sanity checks to trigger the followin...
CVE-2026-79760 Termix: Authenticated blind SSRF through notification channel test endpoints
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests...
CVE-2026-93425 Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...
CVE-2026-97226 DbGate files-style Endpoint files.js fs.readFile path traversal
A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initia...
CVE-2026-76907 LaSuite Doc: Public Documents Enumeration
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated call...
CVE-2026-93244 drm/sysfb: simpledrm: Improve stride validation
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: simpledrm: Improve stride validation Validate the computed stride against the maximum value INTMAX...
CVE-2026-93243 mm/secretmem: properly account locked pages
In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: properly account locked pages secretmem accounts folios by treating memory as if it were mlock'd and thus limited by the RLIMITMEMLOCK limit. However the folios are unevictable and remain so until the inode is...
CVE-2026-93242 scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix response queue over-consumption in qlaconsumeiocb qla24xxprocessresponsequeue advances ringptr past the head IOCB before dispatching, so by the time qlaconsumeiocb runs, ringptr already points at the first...
CVE-2026-93241 memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done
In the Linux kernel, the following vulnerability has been resolved: memcg: bypass the reclaim and oom killer for dying tasks once oomreaper is done At Meta, we are seeing instances where an OOM killed job is stuck in the exit path for several hours. In one particular case, the job was stuck for...
CVE-2026-93240 memcg: make the v1 soft limit knob inert
In the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep...
CVE-2026-93239 arm64: mm: Fix the lockless page-table walk in show_pte()
In the Linux kernel, the following vulnerability has been resolved: arm64: mm: Fix the lockless page-table walk in showpte showpte walks page tables locklessly and can run with interrupts enabled. A concurrent teardown can free a table page while it is being walked. It can also clear a parent ent...
CVE-2026-93238 s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix potential use of uninitialized apmfiltered bitmap The DECLAREBITMAPapmfiltered, APDEVICES macro allocates the bitmap on the stack without zero-initializing it. In vfioapmdevhotplugcfg, the vfioapmdevfiltermatrix...
CVE-2026-93237 LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Add DIRECTMAPPHYSMEMEND definition getfreememregion and mhpgetpluggablerange bound their search to DIRECTMAPPHYSMEMEND. LoongArch does not define it, so the fallback in include/linux/mm.h applies: under...