CVE-2026-93071

In the Linux kernel, the following vulnerability has been resolved: media: bcm2835-unicam: Fix asc leaked in error/remove path v4l2asyncnfaddfwnoderemote allocates the asc, which is freed when v4l2asyncnfcleanup is called. Call v4l2asyncnfcleanup properly in the driver paths. Discovered with...

CVE-2026-93064

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwlmvmfrobtxfkeyiter tracks the last matched byte position in loop variable 'i'. When a full key match is found match == keylen, 'i' points at the last byte of the matched...

CVE-2026-93069

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix cleanup ordering Commit 173e02d67494 "OPP: Initialize scope-based pointers inline" added initialization for all pointers. In some cases, the ordering was changed so that opptable was initialized after opp. This also...

CVE-2026-93067

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: clamp the reported AUX read size to the request tcauxtransfer clamps an AUX read to the payload limit: sizet size = mintsizet, DPAUXMAXPAYLOADBYTES - 1, msg-size; After the transfer it replaces size with the...

CVE-2026-93066

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpalock around large-page collapse Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes:...

CVE-2026-93070

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6businitializedevice stores the isys/psys pdata pointer in struct ipu6busdevice and initializes the auxiliary device. After that point, error unwinding must drop the auxilia...

CVE-2026-93057

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcdtxeqtr, ufshcdtxeqtr and ufsqcomgetrxfom allocate...

CVE-2026-93059

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix taskstruct reference leak in recoverworker getpidtask increments the task reference count, but the corresponding puttaskstruct was missing in the else branch, leaking a reference on every GPU hang recovery. Patchwork...

CVE-2026-93062

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

CVE-2026-93061

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-93055

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

CVE-2026-93056

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

CVE-2026-93058

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Only fini scheduler after successful init msmringbuffernew destroys a partially initialized ring through msmringbufferdestroy when an allocation or scheduler setup step fails. If drmschedinit fails before it finishes...

CVE-2026-93060

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix use after free on error path in a6xxgpuinit The a6xxdestroy function frees "a6xxgpu" and so "adrenogpu" points to freed memory. Preserve the error code before freeing the memory to avoid a use after free...

CVE-2026-93048

In the Linux kernel, the following vulnerability has been resolved: mtd: part: reject MTDPARTOFSRETAIN in mtdaddpartition mtdaddpartition does not reject the special offset value MTDPARTOFSRETAIN -3, which leads to a WARNON in addmtddevice when called through the BLKPG ioctl on NAND devices. The...

CVE-2026-93054

In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After deviceadd, the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, uioregisterdevice unwinds the device but leaves idev-info...

CVE-2026-93049

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdswap: Avoid freeing registered blktrans device twice In mtdswapaddmtd, debugfs setup failure after successful blktrans registration can free mbddev twice. addmtdblktransdev initializes the blktrans device reference and...

CVE-2026-93050

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-93051

In the Linux kernel, the following vulnerability has been resolved: misc: ad525xdpot: use driver core groups for sysfs files addpotprobe creates per-RDAC sysfs files manually and then optionally creates the command sysfs group. This leaves probe responsible for rolling back partial sysfs state an...

CVE-2026-93052

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...

CVE-2026-93053

In the Linux kernel, the following vulnerability has been resolved: speakup: keyhelp: guard letteroffsets possible out-of-range indexing helpinit builds letteroffsets by using the first byte of each function name as an index via start & 31 - 1. If functionnames are overridden from sysfs root with...

CVE-2026-93042

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Terminate all descriptors without callbacks The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst: "No callback functions will be called for...

CVE-2026-93044

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

CVE-2026-93046

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs was failing when passed UINTMAX, this in turn would lead to an out of bound access in the propert...

CVE-2026-93047

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Associate BOs with every job that accesses them A submission can expand into a chain of jobs e.g. bin + render + cache clean. Implicit synchronization in v3dsubmitlockreservations is gated on each job's bo, but the BO li...

CVE-2026-93041

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dwedmaabortinterrupt drops vc.lock before changing request and status. issuepending can acquire the lock in that small window, observe the old busy state, and skip starting queued...

CVE-2026-93043

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for gotox insn The interpreter does not recognize the BPFJMP|BPFJA|BPFX insn, which is used for insnarray map. Thereafter, it would hit the BUGON in bpfprogrun at run time. 2.563726 BPF...

CVE-2026-93045

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...

CVE-2026-93040

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

CVE-2026-92980

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...

CVE-2026-93039

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: Keep link pointers valid on realloc failure mesoncardreallocatelinks grows the DAI link and private data arrays with two consecutive krealloc calls and updates the owner pointers only after both calls have succeeded....

CVE-2026-93038

In the Linux kernel, the following vulnerability has been resolved: iio: dac: ad5686: missing NULL check on match data Verify that chipinfo pointer is not NULL. If a user binds the driver using driveroverride via sysfs with a device name not present in the idtable or ofmatchtable, match data will...

CVE-2026-93037

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-92524

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in itsvpeirqdomainalloc When itsirqgicdomainalloc fails, the following itsvpeirqdomainfree fails to invoke itsvepteardown for the corresponding interrupt, which leaks the resource. Invoke...

CVE-2026-92521

In the Linux kernel, the following vulnerability has been resolved: ACPI: PCI: Clear driverdata on all paths that free the acpipciroot acpipcirootadd assigns the freshly allocated root to device-driverdata before dmardeviceadd and pciacpiscanroot. Both failure paths reach the end: label where roo...

CVE-2026-92522

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both MADT and MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generi...

CVE-2026-92525

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92523

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

CVE-2026-92517

In the Linux kernel, the following vulnerability has been resolved: bpf, riscv: Fix extable handling for arena loadacquire emitatomicldst returns 1 to have buildbody skip the zext after a sub-word loadacquire. The caller does "ret = ret ?: addexceptionhandler...", which skips addexceptionhandler ...

CVE-2026-92515

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested structs btffindstructfield initializes a fresh seen mask for every recursive descent. Unique special fields in different levels of the same aggregate therefore do not see one another...

CVE-2026-92518

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIGCFICLANG is enabled, prog-bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an...

CVE-2026-92514

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Fix CEQ tasklet use-after-free on removal Each CEQ interrupt handler only schedules eqc-tasklet. The tasklet calls erdmaceqcompletionhandler, which reads the DMA-coherent EQ ring through getnextvalideqe and updates...

CVE-2026-92520

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

CVE-2026-92519

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix memory leak in bpfjitfree When bpfintjitcompile is called for subprograms, it returns early during the first pass !prog-isfunc || extrapass is false, keeping ctx-offset alive for the subsequent extra pass. If JIT...

CVE-2026-92516

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpfresspinlock Sashiko pointed out correctly that the case statement for BPFRESSPINLOCK incorrectly checks offset for BPFSPINLOCK. Fix it by checking resspinlockoff instead...

CVE-2026-92513

In the Linux kernel, the following vulnerability has been resolved: RDMA/manaib: drain QP references after partial table insertion manatablestoreudqp publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xainsertirq calls. A concurrent...

CVE-2026-92508

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...

CVE-2026-92509

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counterrelease When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end ...

CVE-2026-92511

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroycquser When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-92512

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ibqueryqp When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdmarestrackget, meanwhile during the QP destroy path rdmarestrackdel is called at the end o...