CVE-2026-93079

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctlgetfeature sizes its output buffer from the user's fwctlrpc.outlen, but the device is told to write cxlmboxgetfeatin.count bytes into rpcout-payload, whic...

CVE-2026-93078

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctlsetfeature sizes its output buffer from the user's fwctlrpc.outlen but never checks it is large enough to hold even the fwctlrpccxlout header. With...

CVE-2026-93077

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxlgetfeature reads a feature in a loop but passes a fixed sizeout as the output capacity every iteration. On the last partial iteration the buffer has less room...

CVE-2026-93076

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear vmemmapshift when binding static pgmap Clear pgmap-vmemmapshift for static DAX devices. When rebinding a static device from devicedax which may set vmemmapshift based on alignment to fsdevdax, the stale...

CVE-2026-93074

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code added a device-linear byte offset to virtaddr which is va of ranges0, b...

CVE-2026-93075

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear pgmap ops and owner on unbind fsdevdaxprobe sets pgmap-ops = &fsdevpagemapops and pgmap-owner = devdax, but nothing ever clears them. For a dynamic device the pgmap is devm-allocated and freed on unbind, so this ...

CVE-2026-93073

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

CVE-2026-93072

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-irqc: Fix generic interrupt chip leak on remove The driver allocates domain generic chips probe. However, on driver removal, the generic chips are not automatically freed when the interrupt domain is removed becau...

CVE-2026-93071

In the Linux kernel, the following vulnerability has been resolved: media: bcm2835-unicam: Fix asc leaked in error/remove path v4l2asyncnfaddfwnoderemote allocates the asc, which is freed when v4l2asyncnfcleanup is called. Call v4l2asyncnfcleanup properly in the driver paths. Discovered with...

CVE-2026-93070

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6businitializedevice stores the isys/psys pdata pointer in struct ipu6busdevice and initializes the auxiliary device. After that point, error unwinding must drop the auxilia...

CVE-2026-93069

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix cleanup ordering Commit 173e02d67494 "OPP: Initialize scope-based pointers inline" added initialization for all pointers. In some cases, the ordering was changed so that opptable was initialized after opp. This also...

CVE-2026-93068

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

CVE-2026-93067

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: clamp the reported AUX read size to the request tcauxtransfer clamps an AUX read to the payload limit: sizet size = mintsizet, DPAUXMAXPAYLOADBYTES - 1, msg-size; After the transfer it replaces size with the...

CVE-2026-93066

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpalock around large-page collapse Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes:...

CVE-2026-93065

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix counter type in iwlfwrtdumperrorlogs The loop counter 'count' was declared as u8 while numpc is u32. If firmware advertises more than 255 PC entries the counter wraps back to zero and the loop never terminates...

CVE-2026-93064

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwlmvmfrobtxfkeyiter tracks the last matched byte position in loop variable 'i'. When a full key match is found match == keylen, 'i' points at the last byte of the matched...

CVE-2026-93063

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: check SAP message length before reading it Verify the SAP message size is not larger than the local buffer before reading the message to avoid buffer overflow...

CVE-2026-93062

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

CVE-2026-93061

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-93060

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix use after free on error path in a6xxgpuinit The a6xxdestroy function frees "a6xxgpu" and so "adrenogpu" points to freed memory. Preserve the error code before freeing the memory to avoid a use after free...

CVE-2026-93059

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix taskstruct reference leak in recoverworker getpidtask increments the task reference count, but the corresponding puttaskstruct was missing in the else branch, leaking a reference on every GPU hang recovery. Patchwork...

CVE-2026-93057

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcdtxeqtr, ufshcdtxeqtr and ufsqcomgetrxfom allocate...

CVE-2026-93058

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Only fini scheduler after successful init msmringbuffernew destroys a partially initialized ring through msmringbufferdestroy when an allocation or scheduler setup step fails. If drmschedinit fails before it finishes...

CVE-2026-93056

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

CVE-2026-93055

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

CVE-2026-93054

In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After deviceadd, the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, uioregisterdevice unwinds the device but leaves idev-info...

CVE-2026-93053

In the Linux kernel, the following vulnerability has been resolved: speakup: keyhelp: guard letteroffsets possible out-of-range indexing helpinit builds letteroffsets by using the first byte of each function name as an index via start & 31 - 1. If functionnames are overridden from sysfs root with...

CVE-2026-93052

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...

CVE-2026-93051

In the Linux kernel, the following vulnerability has been resolved: misc: ad525xdpot: use driver core groups for sysfs files addpotprobe creates per-RDAC sysfs files manually and then optionally creates the command sysfs group. This leaves probe responsible for rolling back partial sysfs state an...

CVE-2026-93050

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-93048

In the Linux kernel, the following vulnerability has been resolved: mtd: part: reject MTDPARTOFSRETAIN in mtdaddpartition mtdaddpartition does not reject the special offset value MTDPARTOFSRETAIN -3, which leads to a WARNON in addmtddevice when called through the BLKPG ioctl on NAND devices. The...

CVE-2026-93049

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdswap: Avoid freeing registered blktrans device twice In mtdswapaddmtd, debugfs setup failure after successful blktrans registration can free mbddev twice. addmtdblktransdev initializes the blktrans device reference and...

CVE-2026-93047

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Associate BOs with every job that accesses them A submission can expand into a chain of jobs e.g. bin + render + cache clean. Implicit synchronization in v3dsubmitlockreservations is gated on each job's bo, but the BO li...

CVE-2026-93046

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs was failing when passed UINTMAX, this in turn would lead to an out of bound access in the propert...

CVE-2026-93044

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

CVE-2026-93045

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...

CVE-2026-93043

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for gotox insn The interpreter does not recognize the BPFJMP|BPFJA|BPFX insn, which is used for insnarray map. Thereafter, it would hit the BUGON in bpfprogrun at run time. 2.563726 BPF...

CVE-2026-93041

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dwedmaabortinterrupt drops vc.lock before changing request and status. issuepending can acquire the lock in that small window, observe the old busy state, and skip starting queued...

CVE-2026-93042

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Terminate all descriptors without callbacks The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst: "No callback functions will be called for...

CVE-2026-93040

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

CVE-2026-93038

In the Linux kernel, the following vulnerability has been resolved: iio: dac: ad5686: missing NULL check on match data Verify that chipinfo pointer is not NULL. If a user binds the driver using driveroverride via sysfs with a device name not present in the idtable or ofmatchtable, match data will...

CVE-2026-93039

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: Keep link pointers valid on realloc failure mesoncardreallocatelinks grows the DAI link and private data arrays with two consecutive krealloc calls and updates the owner pointers only after both calls have succeeded....

CVE-2026-93037

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-92525

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92524

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in itsvpeirqdomainalloc When itsirqgicdomainalloc fails, the following itsvpeirqdomainfree fails to invoke itsvepteardown for the corresponding interrupt, which leaks the resource. Invoke...

CVE-2026-92523

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

CVE-2026-92522

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both MADT and MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generi...

CVE-2026-92521

In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driverdata on all paths that free the acpipciroot acpipcirootadd assigns the freshly allocated root to device-driverdata before dmardeviceadd and pciacpiscanroot. Both failure paths reach the end: label where roo...

CVE-2026-92520

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

CVE-2026-92518

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIGCFICLANG is enabled, prog-bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an...