CVE-2026-93108 RDMA/ipoib: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93107 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-93106 crash_dump: release keyring reference at the correct time

In the Linux kernel, the following vulnerability has been resolved: crashdump: release keyring reference at the correct time restoredmcryptkeystothreadkeyring gets a reference to the user keyring before restoring the saved dm-crypt keys. The same keyring reference is then passed to addkeytokeyrin...

CVE-2026-93105 esp: do not unref managed frag pages in esp_ssg_unref()

In the Linux kernel, the following vulnerability has been resolved: esp: do not unref managed frag pages in espssgunref espssgunref releases the page references held on the source scatterlist after the AEAD operation completes. It calls skbpageunref on every frag page for an out-of-place transfor...

CVE-2026-93103 RDMA/hfi1: Preserve unit 0 on allocation failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Preserve unit 0 on allocation failure hfi1freedevdata assumes that the device was inserted into the unit table and unconditionally erases dd-unit. If xaallocirq fails, the zero-initialized unit remains zero, so full...

CVE-2026-93104 RDMA/rvt: Return NULL after port allocation failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/rvt: Return NULL after port allocation failure rvtallocdevice deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as val...

CVE-2026-93102 RDMA/hfi1: Free RX data on late probe failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1initdd allocates the shared AIP/VNIC RX support before returning. If hfi1init or hfi1registeribdevice later fails, initone tears down the device data without calling hfi1freerx...

CVE-2026-93100 fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Prevent use-after-free in rdtgroupknput A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that need the structure to remain valid across a sleep while waiting on acquiring rdtgroupmutex take a...

CVE-2026-93101 media: v4l2-async: Unregister sub-device if asc_list is empty

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Unregister sub-device if asclist is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause is that the tvp5150 i2c module uses v4l2async, but the em28xx driver...

CVE-2026-93099 fs/resctrl: Fix UAF from worker threads when domains are removed

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbmhandleoverflow and cqmhandlelimbo workers read event counters and may sleep while doing so. They are scheduled via delayedwork embedded in struct...

CVE-2026-93097 cxl/mbox: Break poison list loop on an empty payload

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

CVE-2026-93098 rpmsg: glink: fix deadlock in endpoint destroy during driver detach

In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that...

CVE-2026-93096 cxl/features: Serialize multi-part Get/Set Feature transfers

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...

CVE-2026-93095 hfsplus: validate thread record before delete key rebuild

In the Linux kernel, the following vulnerability has been resolved: hfsplus: validate thread record before delete key rebuild hfsplusdeletecat is called with str == NULL when the last open reference to an unlinked HFS+ hardlink backing inode is closed. In that case, the function finds the catalog...

CVE-2026-93094 wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dplinkpeer dangling references on AP vdev rollback ath12kmacvdevcreate for an AP vdev creates the bss self-peer via ath12kpeercreate, which finishes by calling ath12kdplinkpeerassign to publish the dplinkpeer in...

CVE-2026-93093 firmware: arm_scmi: Publish channel state before callbacks

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailboxchansetup registers the mailbox client with mboxrequestchannel, and the mailbox controller...

CVE-2026-93092 firmware: arm_scmi: Unregister device notifier before IDR teardown

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unregister device notifier before IDR teardown The requested-devices notifier looks up protocol fwnodes from the activeprotocols IDR. During remove, unregister the notifier before releasing and destroying...

CVE-2026-93091 firmware: arm_scmi: Quiesce notifications before teardown

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Quiesce notifications before teardown scminotificationexit clears and releases the notification instance, but transport callbacks can still deliver incoming notifications until the TX/RX channels are freed...

CVE-2026-93090 firmware: arm_scmi: Clean up channels on setup failure

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

CVE-2026-93086 firmware: arm_scmi: Avoid IDR updates while cleaning channels

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Avoid IDR updates while cleaning channels scmicleanupchannels walks the TX/RX channel IDRs with idrforeach to free transport resources and destroy the dedicated transport devices before calling idrdestroy. The...

CVE-2026-93089 firmware: arm_scmi: Free transport channel on IDR failure

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Free transport channel on IDR failure If transport channel setup succeeds but the following IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the...

CVE-2026-93085 firmware: arm_scmi: Reject out of range DT protocol IDs

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...

CVE-2026-93084 firmware: arm_scmi: Drop handle on protocol bind failures

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Drop handle on protocol bind failures The SCMI bus notifier acquires an SCMI handle when the driver core emits BUSNOTIFYBINDDRIVER, before invoking the protocol driver probe callback. The protocol probe path on...

CVE-2026-93083 firmware: arm_scmi: Unwind TX receiver mailbox setup failure

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unwind TX receiver mailbox setup failure mailboxchansetup can request an additional unidirectional TX receiver channel after successfully acquiring the primary channel. If that second request fails, the functio...

CVE-2026-93082 firmware: arm_scmi: Unwind P2A receiver mailbox setup failure

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unwind P2A receiver mailbox setup failure mailboxchansetup can request an additional P2A receiver channel after successfully acquiring the primary P2A channel. If that later request fails, the function returns...

CVE-2026-93080 firmware: arm_scmi: Fix transport device teardown lookup

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix transport device teardown lookup SCMI transport devices are deliberately excluded from normal SCMI bus matching so protocol drivers cannot bind to the internal transport children. However, scmidevicedestroy...

CVE-2026-93081 firmware: arm_scmi: Fix SCMI device destroy lifetimes

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix SCMI device destroy lifetimes scmichilddevfind drops the reference returned by devicefindchild before returning the scmidevice pointer. A concurrent unregister can then release the device while the destroy...

CVE-2026-93079 cxl/features: Reject Get Feature count larger than the output buffer

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctlgetfeature sizes its output buffer from the user's fwctlrpc.outlen, but the device is told to write cxlmboxgetfeatin.count bytes into rpcout-payload, whic...

CVE-2026-93078 cxl/features: Reject Set Features output buffer smaller than the header

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctlsetfeature sizes its output buffer from the user's fwctlrpc.outlen but never checks it is large enough to hold even the fwctlrpccxlout header. With...

CVE-2026-93077 cxl/features: Clamp Get Feature output size to the remaining buffer

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxlgetfeature reads a feature in a loop but passes a fixed sizeout as the output capacity every iteration. On the last partial iteration the buffer has less room...

CVE-2026-93076 dax/fsdev: clear vmemmap_shift when binding static pgmap

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear vmemmapshift when binding static pgmap Clear pgmap-vmemmapshift for static DAX devices. When rebinding a static device from devicedax which may set vmemmapshift based on alignment to fsdevdax, the stale...

CVE-2026-93075 dax/fsdev: clear pgmap ops and owner on unbind

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear pgmap ops and owner on unbind fsdevdaxprobe sets pgmap-ops = &fsdevpagemapops and pgmap-owner = devdax, but nothing ever clears them. For a dynamic device the pgmap is devm-allocated and freed on unbind, so this ...

CVE-2026-93074 dax/fsdev: use __va(phys) for kaddr in direct_access

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code added a device-linear byte offset to virtaddr which is va of ranges0, b...

CVE-2026-93073 dax: read holder_ops once in dax_holder_notify_failure()

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

CVE-2026-93072 irqchip/renesas-irqc: Fix generic interrupt chip leak on remove

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-irqc: Fix generic interrupt chip leak on remove The driver allocates domain generic chips probe. However, on driver removal, the generic chips are not automatically freed when the interrupt domain is removed becau...

CVE-2026-93071 media: bcm2835-unicam: Fix asc leaked in error/remove path

In the Linux kernel, the following vulnerability has been resolved: media: bcm2835-unicam: Fix asc leaked in error/remove path v4l2asyncnfaddfwnoderemote allocates the asc, which is freed when v4l2asyncnfcleanup is called. Call v4l2asyncnfcleanup properly in the driver paths. Discovered with...

CVE-2026-93070 media: ipu6: Do not free aux device pdata after init

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6businitializedevice stores the isys/psys pdata pointer in struct ipu6busdevice and initializes the auxiliary device. After that point, error unwinding must drop the auxilia...

CVE-2026-93069 OPP: Fix cleanup ordering

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix cleanup ordering Commit 173e02d67494 "OPP: Initialize scope-based pointers inline" added initialization for all pointers. In some cases, the ordering was changed so that opptable was initialized after opp. This also...

CVE-2026-93067 drm/bridge: tc358767: clamp the reported AUX read size to the request

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: clamp the reported AUX read size to the request tcauxtransfer clamps an AUX read to the payload limit: sizet size = mintsizet, DPAUXMAXPAYLOADBYTES - 1, msg-size; After the transfer it replaces size with the...

CVE-2026-93068 drm/amd/display: Fix DM I2C teardown race

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

CVE-2026-93066 x86/mm/pat: Take cpa_lock around large-page collapse

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpalock around large-page collapse Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes:...

CVE-2026-93065 wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix counter type in iwlfwrtdumperrorlogs The loop counter 'count' was declared as u8 while numpc is u32. If firmware advertises more than 255 PC entries the counter wraps back to zero and the loop never terminates...

CVE-2026-93064 wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwlmvmfrobtxfkeyiter tracks the last matched byte position in loop variable 'i'. When a full key match is found match == keylen, 'i' points at the last byte of the matched...

CVE-2026-93063 wifi: iwlwifi: mei: check SAP message length before reading it

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: check SAP message length before reading it Verify the SAP message size is not larger than the local buffer before reading the message to avoid buffer overflow...

CVE-2026-93062 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

CVE-2026-93061 gpu: host1x: Avoid stack over-read in debug output helpers

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-93060 drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix use after free on error path in a6xxgpuinit The a6xxdestroy function frees "a6xxgpu" and so "adrenogpu" points to freed memory. Preserve the error code before freeing the memory to avoid a use after free...

CVE-2026-93059 drm/msm: Fix task_struct reference leak in recover_worker

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix taskstruct reference leak in recoverworker getpidtask increments the task reference count, but the corresponding puttaskstruct was missing in the else branch, leaking a reference on every GPU hang recovery. Patchwork...

CVE-2026-93058 drm/msm: Only fini scheduler after successful init

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Only fini scheduler after successful init msmringbuffernew destroys a partially initialized ring through msmringbufferdestroy when an allocation or scheduler setup step fails. If drmschedinit fails before it finishes...

CVE-2026-93057 scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcdtxeqtr, ufshcdtxeqtr and ufsqcomgetrxfom allocate...