CVE-2026-93254

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary localirqdisable on kernel exit Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call localirqdisable befo...

CVE-2026-93252

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2initacl A lockdep warning indicates a circular locking dependency between &oi-ipxattrsem and &journal-jtransbarrier: WARNING: possible circular locking dependency detected is trying ...

CVE-2026-93253

In the Linux kernel, the following vulnerability has been resolved: sched/isolation: Defer freeing of cpumask memblock memory to initcall When testing a linux-next kernel with commit 59bd1d914bb5 "memblock: warn when freeing reserved memory before memory map is initialized", the following warning...

CVE-2026-93250

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlanmdbflush vxlanmdbflush iterates over the MDB entries using hlistforeachentrysafe, which only tolerates the removal of the current entry. Contrary to the comment above the loop, the removal o...

CVE-2026-93247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

CVE-2026-93245

In the Linux kernel, the following vulnerability has been resolved: apparmor: policyint make sure list heads are initialized before fail path If profile create fails before policyinit is complete the list heads are not properly initialized causing profilefree sanity checks to trigger the followin...

CVE-2026-93248

In the Linux kernel, the following vulnerability has been resolved: drm/xe: don't WARN on kernel job timeout when device already wedged igt@xewedged@wedged-at-any-timeout wedges the device in mode 2 UPONANYHANGNORESET and then rebinds the driver. During unbind, a GSC proxy kernel submission can...

CVE-2026-93246

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks every MSI-X vector and uses strstr to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector...

CVE-2026-93243

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: properly account locked pages secretmem accounts folios by treating memory as if it were mlock'd and thus limited by the RLIMITMEMLOCK limit. However the folios are unevictable and remain so until the inode is...

CVE-2026-93242

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix response queue over-consumption in qlaconsumeiocb qla24xxprocessresponsequeue advances ringptr past the head IOCB before dispatching, so by the time qlaconsumeiocb runs, ringptr already points at the first...

CVE-2026-93244

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: simpledrm: Improve stride validation Validate the computed stride against the maximum value INTMAX...

CVE-2026-93234

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...

CVE-2026-93237

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Add DIRECTMAPPHYSMEMEND definition getfreememregion and mhpgetpluggablerange bound their search to DIRECTMAPPHYSMEMEND. LoongArch does not define it, so the fallback in include/linux/mm.h applies: under...

CVE-2026-93236

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon falls back to V4L2PIXFMTMPEG2. However, if a distro has locally...

CVE-2026-93239

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: Fix the lockless page-table walk in showpte showpte walks page tables locklessly and can run with interrupts enabled. A concurrent teardown can free a table page while it is being walked. It can also clear a parent ent...

CVE-2026-93240

In the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep...

CVE-2026-93241

In the Linux kernel, the following vulnerability has been resolved: memcg: bypass the reclaim and oom killer for dying tasks once oomreaper is done At Meta, we are seeing instances where an OOM killed job is stuck in the exit path for several hours. In one particular case, the job was stuck for...

CVE-2026-93235

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

CVE-2026-93238

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix potential use of uninitialized apmfiltered bitmap The DECLAREBITMAPapmfiltered, APDEVICES macro allocates the bitmap on the stack without zero-initializing it. In vfioapmdevhotplugcfg, the vfioapmdevfiltermatrix...

CVE-2026-93227

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: deferredgrowzone: fix out-of-range firstdeferredpfn With CONFIGDEFERREDSTRUCTPAGEINIT enabled, deferredgrowzone initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, th...

CVE-2026-93228

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...

CVE-2026-93230

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic bootmem HugeTLB pages are currently initialized from hugetlbinit, but pageallocinitlate runs earlier and walks pageblocks to determine zone contiguity...

CVE-2026-93229

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

CVE-2026-93232

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix boot panic with CONFIGDEBUGVM and HVO bootmem pages Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4. This series is split out from the earlier larger series "mm: Generalize HVO for HugeTLB and...

CVE-2026-93231

In the Linux kernel, the following vulnerability has been resolved: lockd: fix swapped arguments in nlmsvcmatchip When releasing locks by server IP address via /proc/fs/nfsd/unlockip, nlmsvcunlockallbyip calls nlmtraversefiles with the server sockaddr as the opaque @data argument:...

CVE-2026-93233

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix callocated underflow on large folio split nouveaudmemfoliofree drops chunk-callocated once per freed folio, while a large compound device-private folio is only counted once when it is allocated. When such a...

CVE-2026-93224

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix unmatched rnunregister on failed accept When svcrdmaaccept takes the errout path before rpcrdmarnregister has succeeded, the existing cleanup block calls rpcrdmarnunregisterdev, &newxprt-scrn unconditionally...

CVE-2026-93219

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sun4i: Advertise a real minimum delta sun4iclkevtnextevent compensates for the timer stop/start synchronization delay by programming evt - TIMERSYNCTICKS into the hardware interval register. The clockeve...

CVE-2026-93220

In the Linux kernel, the following vulnerability has been resolved: schedext: Keep kicksync waiting on the rq's own CPU kicksyncwaitbalcb assumes it runs on the rq's CPU from the schedule tail: the snapshots it compares against live in that CPU's percpu area and the busy-wait runs with the rq loc...

CVE-2026-93221

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

CVE-2026-93225

In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95usbphygettca succeeds, the typec switch leaks because the only cleanup path was in .remove, which never runs on probe failure. Use...

CVE-2026-93226

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6nhdumpexceptions uses hlistforeachentry to iterate over RCU-protected exception lists. The caller holds rcureadlock, but does not hold rt6exceptionlock, so rt6insertexception can...

CVE-2026-93223

In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix ofnodeput on VIP parse errors tegravipchannelofparse initializes np from dev-ofnode without taking a reference, but its error paths drop one through the errnodeput label. This underflows the...

CVE-2026-93222

In the Linux kernel, the following vulnerability has been resolved: signal: avoid shared siginfo namespace rewrites sendsignallocked rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one recipient can affect the next. Copy the siginfo before changing it...

CVE-2026-93212

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...

CVE-2026-93217

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

CVE-2026-93211

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize DRC hash table before registering shrinker shrinkerregister precedes the INITLISTHEAD loop and the drchashsize store. On weakly-ordered architectures arm64, ppc, a shrinker scan can observe drchashsize before the...

CVE-2026-93216

In the Linux kernel, the following vulnerability has been resolved: mm/pageowner: use memcgdata snapshot to avoid TOCTOU in printpageownermemcg printpageownermemcg reads page-memcgdata via READONCE at the start to guard against tail pages and NULL data. However, it later re-reads page-memcgdata...

CVE-2026-93214

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...

CVE-2026-93213

In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property name when the name is empty or all digits. Check the bound first...

CVE-2026-93215

In the Linux kernel, the following vulnerability has been resolved: cdx: Fix double free when sysfs file creation fails In cdxcreateresattr, if sysfscreatebinfile fails, the code frees resattr but doesn't set cdxdev-resattrnum to NULL. This leaves a dangling pointer in the array. Then...

CVE-2026-93218

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2026-93207

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpcgsswirecred at svcauthgssdecodecredbody entry svcauthgssdecodecredbody writes the caller's rpcgsswirecred field by field and assigns gcctx.len only on the success tail. The caller storage is svcdata-clcred, which...

CVE-2026-93210

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

CVE-2026-93208

In the Linux kernel, the following vulnerability has been resolved: kasan: fix cache shrink race with CPU hotplug kasanquarantineremovecache first invokes percpuremovecache on all online CPUs. Each callback moves objects belonging to the cache from cpuquarantine to the CPU's shrinkqlist, where th...

CVE-2026-93209

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: use skbget instead of skbclone for reqskb BT enable fails intermittently with -ETIMEDOUT -110. The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 logged ...

CVE-2026-88371

ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6 function. When processing specially crafted Code 128 input, decodee can return -1 for an invalid edge pattern, and decode6 subsequently left-shifts this negative signed value while constructing the edge...

CVE-2026-93205

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Manage teardown with devm armsmmudeviceremove manually frees the IOPF queue, destroys the vmidmap and disables the device, while the IRQs and queues are devm managed. devm unwinds only after remove returns, so...

CVE-2026-93206

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

CVE-2026-92680

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...