CVE-2026-93244

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: simpledrm: Improve stride validation Validate the computed stride against the maximum value INTMAX...

CVE-2026-93234

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...

CVE-2026-93237

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Add DIRECTMAPPHYSMEMEND definition getfreememregion and mhpgetpluggablerange bound their search to DIRECTMAPPHYSMEMEND. LoongArch does not define it, so the fallback in include/linux/mm.h applies: under...

CVE-2026-93236

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon falls back to V4L2PIXFMTMPEG2. However, if a distro has locally...

CVE-2026-93239

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: Fix the lockless page-table walk in showpte showpte walks page tables locklessly and can run with interrupts enabled. A concurrent teardown can free a table page while it is being walked. It can also clear a parent ent...

CVE-2026-93240

In the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep...

CVE-2026-93241

In the Linux kernel, the following vulnerability has been resolved: memcg: bypass the reclaim and oom killer for dying tasks once oomreaper is done At Meta, we are seeing instances where an OOM killed job is stuck in the exit path for several hours. In one particular case, the job was stuck for...

CVE-2026-93235

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

CVE-2026-93238

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix potential use of uninitialized apmfiltered bitmap The DECLAREBITMAPapmfiltered, APDEVICES macro allocates the bitmap on the stack without zero-initializing it. In vfioapmdevhotplugcfg, the vfioapmdevfiltermatrix...

CVE-2026-93227

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: deferredgrowzone: fix out-of-range firstdeferredpfn With CONFIGDEFERREDSTRUCTPAGEINIT enabled, deferredgrowzone initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, th...

CVE-2026-93230

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic bootmem HugeTLB pages are currently initialized from hugetlbinit, but pageallocinitlate runs earlier and walks pageblocks to determine zone contiguity...

CVE-2026-93228

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...

CVE-2026-93229

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

CVE-2026-93232

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix boot panic with CONFIGDEBUGVM and HVO bootmem pages Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4. This series is split out from the earlier larger series "mm: Generalize HVO for HugeTLB and...

CVE-2026-93231

In the Linux kernel, the following vulnerability has been resolved: lockd: fix swapped arguments in nlmsvcmatchip When releasing locks by server IP address via /proc/fs/nfsd/unlockip, nlmsvcunlockallbyip calls nlmtraversefiles with the server sockaddr as the opaque @data argument:...

CVE-2026-93233

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix callocated underflow on large folio split nouveaudmemfoliofree drops chunk-callocated once per freed folio, while a large compound device-private folio is only counted once when it is allocated. When such a...

CVE-2026-93224

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix unmatched rnunregister on failed accept When svcrdmaaccept takes the errout path before rpcrdmarnregister has succeeded, the existing cleanup block calls rpcrdmarnunregisterdev, &newxprt-scrn unconditionally...

CVE-2026-93219

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sun4i: Advertise a real minimum delta sun4iclkevtnextevent compensates for the timer stop/start synchronization delay by programming evt - TIMERSYNCTICKS into the hardware interval register. The clockeve...

CVE-2026-93220

In the Linux kernel, the following vulnerability has been resolved: schedext: Keep kicksync waiting on the rq's own CPU kicksyncwaitbalcb assumes it runs on the rq's CPU from the schedule tail: the snapshots it compares against live in that CPU's percpu area and the busy-wait runs with the rq loc...

CVE-2026-93221

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

CVE-2026-93226

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6nhdumpexceptions uses hlistforeachentry to iterate over RCU-protected exception lists. The caller holds rcureadlock, but does not hold rt6exceptionlock, so rt6insertexception can...

CVE-2026-93225

In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95usbphygettca succeeds, the typec switch leaks because the only cleanup path was in .remove, which never runs on probe failure. Use...

CVE-2026-93222

In the Linux kernel, the following vulnerability has been resolved: signal: avoid shared siginfo namespace rewrites sendsignallocked rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one recipient can affect the next. Copy the siginfo before changing it...

CVE-2026-93223

In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix ofnodeput on VIP parse errors tegravipchannelofparse initializes np from dev-ofnode without taking a reference, but its error paths drop one through the errnodeput label. This underflows the...

CVE-2026-93212

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...

CVE-2026-93217

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

CVE-2026-93211

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize DRC hash table before registering shrinker shrinkerregister precedes the INITLISTHEAD loop and the drchashsize store. On weakly-ordered architectures arm64, ppc, a shrinker scan can observe drchashsize before the...

CVE-2026-93216

In the Linux kernel, the following vulnerability has been resolved: mm/pageowner: use memcgdata snapshot to avoid TOCTOU in printpageownermemcg printpageownermemcg reads page-memcgdata via READONCE at the start to guard against tail pages and NULL data. However, it later re-reads page-memcgdata...

CVE-2026-93213

In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property name when the name is empty or all digits. Check the bound first...

CVE-2026-93214

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...

CVE-2026-93215

In the Linux kernel, the following vulnerability has been resolved: cdx: Fix double free when sysfs file creation fails In cdxcreateresattr, if sysfscreatebinfile fails, the code frees resattr but doesn't set cdxdev-resattrnum to NULL. This leaves a dangling pointer in the array. Then...

CVE-2026-93218

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2026-93207

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpcgsswirecred at svcauthgssdecodecredbody entry svcauthgssdecodecredbody writes the caller's rpcgsswirecred field by field and assigns gcctx.len only on the success tail. The caller storage is svcdata-clcred, which...

CVE-2026-93210

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

CVE-2026-93209

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: use skbget instead of skbclone for reqskb BT enable fails intermittently with -ETIMEDOUT -110. The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 logged ...

CVE-2026-93208

In the Linux kernel, the following vulnerability has been resolved: kasan: fix cache shrink race with CPU hotplug kasanquarantineremovecache first invokes percpuremovecache on all online CPUs. Each callback moves objects belonging to the cache from cpuquarantine to the CPU's shrinkqlist, where th...

CVE-2026-93205

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Manage teardown with devm armsmmudeviceremove manually frees the IOPF queue, destroys the vmidmap and disables the device, while the IRQs and queues are devm managed. devm unwinds only after remove returns, so...

CVE-2026-88371

ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6 function. When processing specially crafted Code 128 input, decodee can return -1 for an invalid edge pattern, and decode6 subsequently left-shifts this negative signed value while constructing the edge...

CVE-2026-93206

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

CVE-2026-92680

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...

CVE-2026-88362

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsRisindex in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. Th...

CVE-2026-88361

SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec when parsing PDF PageLabels /Nums entries...

CVE-2026-88369

zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump...

CVE-2026-88368

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvgaddActive function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. T...

CVE-2026-88370

libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled loadinibuffer.h utility and stripinicache. The bundled utility allocates exactly inilength bytes, while stripinicache unconditionally writes a NUL terminator at inisourceinilength, requiring an additional writab...

CVE-2026-88366

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvgpathArcTo when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle. The function subsequently...

CVE-2026-88358

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

CVE-2026-88365

minimp3 commit ea99364f contains an integer overflow vulnerability in mp3decskipid3v1 when parsing the APEv2 tag-size field...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88355

An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in newexpr. For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeofteexpr but treats the returned allocation as a complete teexpr...