CVE-2026-93161 crypto: qat - clear AES key schedule from stack

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qatalgxtsreversekey expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary cryptoaesctx with...

CVE-2026-93160 crypto: atmel-ecc - reject hardware ECDH without a public key

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-ecc - reject hardware ECDH without a public key The hardware ECDH path in atmelecdhcomputesharedsecret uses the private key stored in the device. However, the public key is cached only after atmelecdhsetsecret...

CVE-2026-93159 crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a workdata structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng-priv and later...

CVE-2026-93158 crypto: sa2ul - stop probe if context pool creation fails

In the Linux kernel, the following vulnerability has been resolved: crypto: sa2ul - stop probe if context pool creation fails saulprobe calls sainitmem to create the DMA pool used for security context buffers, but ignores its return value. If pool creation fails, probe still continues with DMA...

CVE-2026-93157 hwrng: xilinx-trng - propagate timeout before any data is read

In the Linux kernel, the following vulnerability has been resolved: hwrng: xilinx-trng - propagate timeout before any data is read xtrngreadblock32 polls for 16-byte chunks but returns the number of bytes read even when the first poll times out. Its caller then treats a zero return as a short...

CVE-2026-93156 crypto: rk3288 - fail ahash requests on HASH idle timeout

In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - fail ahash requests on HASH idle timeout rkhashrun waits for RKCRYPTOHASHSTS to become idle after the final DMA transfer, but ignores the poll result. If the hash engine never becomes idle, the driver still reads...

CVE-2026-93155 crypto: keembay - Fix AEAD unregister count in error path

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Fix AEAD unregister count in error path registeraesalgs registers the AEAD algorithms before registering the skcipher algorithms. If skcipher registration fails, the function unwinds the earlier AEAD registratio...

CVE-2026-93154 RDMA/irdma: Add refcounting to user ring MRs

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Add refcounting to user ring MRs Prevent userspace from deregistering the MRs that back QP/CQ/SRQ rings by bumping the MR's refcount upon association...

CVE-2026-93153 RDMA/bng_re: return a timeout when firmware responses stall

In the Linux kernel, the following vulnerability has been resolved: RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and bngrercfwsendmessage already marks the firmware as stalled when the...

CVE-2026-93152 nvme-apple: Use acquire/release for queue enabled state

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Use acquire/release for queue enabled state applenvmeinitqueue initializes queue state and then marks the queue enabled. The interrupt and request paths check enabled before using that queue state. The old wmb after...

CVE-2026-93151 nvmet-rdma: fix response resource leak on queue teardown

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...

CVE-2026-93150 cgroup/cpuset: Make nr_deadline_tasks an atomic_t

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Make nrdeadlinetasks an atomict The nrdeadlinetasks variable in the cpuset structure was introduced by commit 6c24849f5515 "sched/cpuset: Keep track of SCHEDDEADLINE task in cpusets". It is reported by sashiko 1 th...

CVE-2026-93149 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

CVE-2026-93148 bpf: Reject MEM_ALLOC BTF accesses past object bounds

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEMALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTRTOBTFID | MEMALLOC values point...

CVE-2026-93147 s390/bpf: Replace ly instruction with llgf

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-93146 time/namespace: Validate nanosecond field in proc_timens_set_offset()

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93145 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdscunregister gdscunregister removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove on the individual genericpmdomain structures...

CVE-2026-93143 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix pmruntime refcount leak in ipu7resume ipu7resume calls pmruntimegetsync before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without...

CVE-2026-93144 bpf: Reject writes through untrusted BTF pointers

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

CVE-2026-93142 thermal/drivers/rcar: Fix error checking in probe()

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fix error checking in probe This code accidentally calls thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. Move the call until later to avoid an error pointer...

CVE-2026-93140 udf: Mark LVID buffer as uptodate before marking it dirty

In the Linux kernel, the following vulnerability has been resolved: udf: Mark LVID buffer as uptodate before marking it dirty When an I/O error occurs while writing the Logical Volume Integrity Descriptor LVID buffer to the block device, the block layer's completion handler endbufferwritesync...

CVE-2026-93141 usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: r8a66597: avoid double free of ep0req in probe error path If usbaddgadgetudc fails, r8a66597probe jumps to erraddudc and frees ep0req, then falls through to cleanup2 where ep0req is freed again when it is non-NULL...

CVE-2026-93139 drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed b...

CVE-2026-93138 bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpfgetbtfvmlinux bpfgetbtfvmlinux lazily parses the vmlinux BTF under the bpfverifierlock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing...

CVE-2026-93137 bpf: Fix use-after-free on mm_struct in bpf_find_vma()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free on mmstruct in bpffindvma bpffindvma reads task-mm and calls mmapreadtrylockmm without holding a reference on the mm. On a foreign task, a concurrent exitmm can free the mmstruct between the lockless read...

CVE-2026-93136 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation mhiepcreatedevice takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references...

CVE-2026-93134 printk: Fix possible console use-after-free

In the Linux kernel, the following vulnerability has been resolved: printk: Fix possible console use-after-free When emitting a record via legacy printing, it is possible that a handover to another legacy printing context occurs. When a context has performed a handover, the console SRCU read lock...

CVE-2026-93135 bpf: Reject programs with inlined helpers if JIT is not available

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

CVE-2026-93133 ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Check acpigethandle status in riscvacpiaddprtdep In riscvacpiaddprtdep, the acpigethandle call can fail which would leave linkhandle uninitialized. Fix it by checking the acpigethandle return status and skip the ent...

CVE-2026-93132 ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Fix riscvacpiaddprtdep loop handling The loop in riscvacpiaddprtdep includes error conditions that are handled in a dubious - if not outright wrong - way, by continuining the loop which skips and misses the entry...

CVE-2026-93131 platform/x86: dell-privacy: Fix race condition

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-privacy: Fix race condition Accessing priv-featurespresent needs to happen with the list mutex being held, otherwise priv can be freed at any moment...

CVE-2026-93130 platform/x86: dell-wmi-base: Fix resource leak on module load failure

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-base: Fix resource leak on module load failure We need to properly clean up the SMBIOS request and the privacy driver when the module load fails...

CVE-2026-93129 platform/x86: dell-wmi-base: Fix handling of ultra performance key

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-base: Fix handling of ultra performance key The commit message of commit 5fbd827eb9c2 "platform/x86: dell-wmi: Recognise or support new switches" states that the ultra performance key contains additional da...

CVE-2026-93127 bpf: Drop scalar id on sign-extending narrowing stack fills

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

CVE-2026-93128 platform/x86: lg-laptop: Fix LED resource handling

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lg-laptop: Fix LED resource handling The event notification callback might access kbdbacklight even when it was not successfully registered with the LED subsystem. The same happens inside acpiremove, where the LED...

CVE-2026-93126 remoteproc: qcom_q6v5_adsp: Fix reference leak for device node

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcomq6v5adsp: Fix reference leak for device node When calling ofparsephandlewithargs, the caller is responsible to call ofnodeput to release the reference of device node. In adspmapcarveout, it does not release the...

CVE-2026-93125 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwrbufsize kfunc arguments that exceed u32 max checkkfuncargs detects a kfunc argument named rdonlybufsize or rdwrbufsize and stores reg-varoff.value into meta-r0size, a u64, and does not bound it...

CVE-2026-93124 platform/x86: asus-wireless: Fail probe when there is no ACPI match

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver can be forced to match a device that does not match its list of device IDs because of devicematchdriveroverride, so platform drivers that...

CVE-2026-93123 serial: qcom-geni: do not advance stale DMA completions

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: do not advance stale DMA completions The qcom GENI serial DMA TX completion path advances the transmit fifo by the number of bytes recorded in port-txremaining. If uartflushbuffer runs after the hardware has...

CVE-2026-93121 usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix fence cleanup in ffsdmabuftransfer error paths The error paths for endpoint-disabled ESHUTDOWN and request-allocation failure ENOMEM in ffsdmabuftransfer jump to errfenceput which calls dmafenceput on the...

CVE-2026-93122 usb: gadget: uac: validate rate list length before storing

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

CVE-2026-93120 usb: gadget: configfs: fix out-of-bounds read of qw_sign

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

CVE-2026-93118 usb: gadget: aspeed_udc: check endpoint DMA allocation

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: check endpoint DMA allocation astudcprobe allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep derives per-endpoint buffer pointers from udc-ep0buf, so a failed...

CVE-2026-93119 usb: ljca: bound bank_num in ljca_enumerate_gpio()

In the Linux kernel, the following vulnerability has been resolved: usb: ljca: bound banknum in ljcaenumerategpio ljcaenumerategpio reads desc-banknum from the device and loops validpini = getunalignedle32... for i banknum. validpin holds only LJCAMAXGPIONUM / 32 = 2 entries. Two checks run befor...

CVE-2026-93117 usb: fix UAF when probe runs concurrent to dyn ID removal

In the Linux kernel, the following vulnerability has been resolved: usb: fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when usbdynidslock is held, as removeidstore can free the node. Thus, make a copy in usbprobeinterface. Clarify the documentati...

CVE-2026-93115 platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL

In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPICOMPANION against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on...

CVE-2026-93116 platform/x86: asus-wmi: fix resource leaks on probe failure

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: fix resource leaks on probe failure During driver initialization in asuswmiadd, various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration...

CVE-2026-93114 platform/surface: acpi-notify: Check ACPI companion before use

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely...

CVE-2026-93113 clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: camcc-sc8280xp: unregister CAMCCGDSCCLK With the introduction of syncstate support in the clk and pmdomain subsystems, the following warning happens when the unused clocks are shutdown in camcc-sc8280xp: 15.408367...

CVE-2026-93112 bpf: Require a BPF cpumask for bpf_cpumask_populate()

In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpfcpumaskpopulate bpfcpumaskpopulate writes to its destination with bitmapcopy, but the destination is typed as struct cpumask . That allows the verifier to accept borrowed cpumask pointers returne...