CVE-2026-93097

A flaw was found in the Linux kernel's CXL mailbox cxl/mbox component. A malicious or malfunctioning device could exploit a vulnerability where an empty payload with a specific flag causes an infinite loop. This issue can lead to a system hang, preventing further poison operations and resulting i...

CVE-2026-93093

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. During the SCMI channel setup, a race condition can occur where callbacks are enabled before the channel state is fully initialized. If a callback fires in this window, it can lead to a null pointer...

CVE-2026-93068

A flaw was found in the Linux kernel's AMD display DM I2C adapter. A race condition exists where the DM I2C adapters remain visible to userspace while the DM teardown is in progress. A local attacker could exploit this by initiating a concurrent i2c-dev transfer, causing a NULL pointer dereferenc...

CVE-2026-93062

A flaw was found in the Linux kernel's iwlwifi driver. This vulnerability is caused by a division-by-zero error within the iwldbgtlvallocfragments function when the number of fragments is zero. This could lead to a system crash, resulting in a Denial of Service DoS...

CVE-2026-93122

A flaw was found in the Linux kernel's USB Audio Class UAC gadget driver. This vulnerability occurs when processing a list of sampling rates, where the driver fails to properly validate the length of the input list. An attacker could provide an overly long list, causing the system to write data...

CVE-2026-93118

A flaw was found in the Linux kernel's USB gadget driver for Aspeed UDC. During the device initialization process, a failure to allocate a Direct Memory Access DMA buffer is not properly handled. This can lead to the driver attempting to use an invalid memory address, potentially causing a system...

CVE-2026-93114

A flaw was found in the Linux kernel. A vulnerability exists in the platform/surface: acpi-notify component where a platform driver can be forced to match a device lacking an ACPI companion object. This can lead to a NULL pointer dereference when the sanprobe function attempts to access a...

CVE-2026-93113

A flaw was found in the Linux kernel, specifically within the camcc-sc8280xp component of its clock clk and power management domain pmdomain subsystems. This issue arises when unused clocks are shut down, leading to a synchronization problem where the titantopgdsc status remains 'on'. This can...

CVE-2026-93110

A flaw was found in the Linux kernel's RDMA core component. A race condition exists where RCU Read-Copy-Update callbacks, specifically putgidndev, can be invoked after the ibcore module has been unloaded. This occurs because stopping workqueues does not drain already queued callbacks, allowing RC...

CVE-2026-93109

A flaw was found in the Linux kernel's RDMA/mlx5 component. A race condition during module teardown can occur when the mlx5ib module unloads before all Read-Copy-Update RCU callbacks, such as devxfreesubscription, have completed. This premature unloading while callbacks are still pending can lead...

CVE-2026-93108

A flaw was found in the Linux kernel's RDMA/ipoib module. A race condition during module teardown allows the ibipoib module to be unloaded while its code is still executing. This can occur when IPoIB reclamation completions are signaled from within an RCU Read-Copy-Update callback, or during clie...

CVE-2026-93107

A flaw was found in the Linux kernel's RDMA/rxe component. When a Queue Pair QP transitions to an error state during packet completion, the system may reprocess an already-completed packet. This can lead to duplicate data being delivered to user applications, causing data stream corruption...

CVE-2026-93106

A flaw was found in the Linux kernel's crashdump functionality, specifically in how it handles dm-crypt keys. When multiple dm-crypt keys are restored, a reference to the user keyring is incorrectly dropped multiple times. This can lead to a reference count underflow or a use-after-free condition...

CVE-2026-93105

A flaw was found in the Linux kernel. Specifically, a component responsible for handling network packet fragments espssgunref incorrectly manages memory page references. This error can cause the system to release a memory page that is still actively in use. Such an issue can lead to memory...

CVE-2026-93100

A flaw was found in the Linux kernel's resctrl filesystem. A race condition exists in the rdtgroupknput function during the handling of rdtgroup structure reference counts. This allows a local attacker to trigger a use-after-free vulnerability, where memory is accessed after it has been...

CVE-2026-93104

A flaw was found in the Linux kernel RDMA/rvt component. The rvtallocdevice function incorrectly returns a pointer to memory that has already been deallocated after a port allocation failure. This allows callers to dereference the freed memory, leading to a use-after-free vulnerability. This issu...

CVE-2026-93099

A flaw was found in the Linux kernel's fs/resctrl component. This use-after-free UAF vulnerability occurs when worker threads attempt to access memory that has already been released during CPU hotplug operations. A local attacker could potentially exploit this flaw to cause a system crash, leadin...

CVE-2026-93098

A flaw was found in the Linux kernel. A deadlock can occur in the rpmsg: glink component during driver detachment. This issue arises when a redundant device unregistration attempts to acquire a mutex that is already held, causing the system to hang indefinitely. This can lead to a Denial of Servi...

CVE-2026-93096

A flaw was found in the Linux kernel's CXL features. A concurrency vulnerability exists where multi-part Get/Set Feature transfers are not properly serialized. This allows two concurrent transfers to the same mailbox to interleave their parts, which can corrupt the device's transfer context. A...

CVE-2026-93095

A flaw was found in the HFS Plus HFS+ filesystem in the Linux kernel. A local attacker could provide a specially crafted, corrupted HFS+ image that, when processed during a delete key rebuild operation, would cause the system to write past an allocated memory buffer. This out-of-bounds write coul...

CVE-2026-93094

A flaw was found in the ath12k Wi-Fi driver of the Linux kernel. This vulnerability occurs during the rollback of an Access Point AP virtual device vdev creation. If a peer creation step fails, the system can improperly free memory while still holding references to it, leading to a use-after-free...

CVE-2026-93091

A flaw was found in the armscmi firmware component of the Linux kernel. A race condition exists during the teardown of notifications or on the probe error path. This can allow an attacker to trigger a use-after-free vulnerability, where the system attempts to access memory that has already been...

CVE-2026-93092

A flaw was found in the armscmi firmware component of the Linux kernel. A race condition can occur during the unregistration of device notifiers and the teardown of the activeprotocols IDR ID allocator. This timing issue could potentially lead to system instability or a denial of service DoS due ...

CVE-2026-93086

A flaw was found in the Linux kernel's armscmi firmware component. During the cleanup of transmit and receive channels, the scmicleanupchannels function performs an unsafe operation by removing entries from a kernel data structure IDR while it is being iterated. This can lead to an invalid iterat...

CVE-2026-93085

A flaw was found in the ARM System Control and Management Interface SCMI firmware within the Linux kernel. This vulnerability occurs because the system fails to properly reject out-of-range Device Tree DT protocol identifiers. A local attacker could exploit this by providing a malformed 32-bit DT...

CVE-2026-93084

A flaw was found in the Linux kernel's armscmi firmware. When the SCMI bus notifier acquires a handle, but the device link cannot be properly established or a protocol driver probe fails, the SCMI instance's reference count may not be correctly released. This can lead to a resource leak...

CVE-2026-93080

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs because the scmidevicedestroy function, responsible for tearing down SCMI transport devices, uses an incorrect lookup mechanism. Malformed firmware with duplicate protocol...

CVE-2026-93081

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs due to improper handling of device reference counts during the device destruction process. A concurrent unregister operation can release a device while its pointer is still ...

CVE-2026-93079

A flaw was found in the Linux kernel's CXL Compute Express Link feature handling. The cxlctlgetfeature function does not properly validate the size of the output buffer against a user-controlled count value. This oversight allows a local attacker to provide a count larger than the allocated buffe...

CVE-2026-93078

A flaw was found in the Linux kernel's CXL Compute Express Link feature handling. The cxlctlsetfeature function, responsible for setting CXL features, does not properly validate the size of the output buffer provided by a user. If a local attacker provides an output buffer of zero length, it can...

CVE-2026-93077

A flaw was found in the Linux kernel's cxl/features component. The cxlgetfeature function, when reading feature data, uses a fixed output buffer size in a loop. This can lead to a buffer overflow if a connected device returns more data than the remaining buffer capacity, potentially allowing for...

CVE-2026-93076

A flaw was found in the Linux kernel's Direct Access DAX subsystem. When a static DAX device is reconfigured, an outdated memory mapping value can persist. This prevents the system from correctly building its virtual memory map, which is essential for proper operation. This issue could lead to...

CVE-2026-93075

A flaw was found in the Linux kernel's dax/fsdev component. When a static device is unbound, the pgmap operations and owner are not properly cleared. This can lead to a use-after-free vulnerability where a subsequent memory failure event might dispatch through a stale or freed handler, potentiall...

CVE-2026-93074

A flaw was found in the Linux kernel's dax/fsdev component. An error in calculating kernel virtual addresses within the fsdevdaxdirectaccess function, specifically for multi-range devices with physical gaps, can lead to incorrect memory addressing. This issue could result in memory corruption,...

CVE-2026-93073

A flaw was found in the Linux kernel's Direct Access DAX subsystem. A race condition in the daxholdernotifyfailure function allows a concurrent operation to clear a critical pointer holderops between two reads. This can lead to a null pointer dereference, potentially enabling a local attacker to...

CVE-2026-93070

A flaw was found in the ipu6 media driver of the Linux kernel. This vulnerability arises from incorrect handling of auxiliary device private data during initialization, leading to a double free condition. A local attacker could potentially exploit this to cause a denial of service or other memory...

CVE-2026-93069

A flaw was found in the Linux kernel's Optimized Power Management OPP subsystem. An incorrect cleanup ordering during the initialization of internal pointers can lead to a use-after-free error. This occurs when the system attempts to release a reference to an already freed memory region. Such an...

CVE-2026-93067

A flaw was found in the Linux kernel's drm/bridge: tc358767 component. An issue in the tcauxtransfer function, specifically within tcauxreaddata, allows a connected DisplayPort DP AUX controller to report a read size larger than requested. This can lead to a buffer overflow when reading data into...

CVE-2026-93066

A flaw was found in the Linux kernel. A race condition in the x86/mm/pat component, specifically between cpacollapselargepages and changepageattr, can lead to a use-after-free vulnerability. A local attacker, by concurrently loading and unloading modules, could exploit this to write into freed...

CVE-2026-93065

A flaw was found in the iwlwifi driver of the Linux kernel. An integer overflow vulnerability exists where a loop counter, declared as an 8-bit unsigned integer, can wrap around if the firmware advertises more than 255 program counter entries. This can lead to an infinite loop, causing a denial o...

CVE-2026-93064

A flaw was found in the iwlwifi driver of the Linux kernel. An off-by-one error in the iwlmvmfrobtxfkeyiter function, responsible for sanitizing transmit TXF keys, incorrectly calculates the memory clear operation's starting point. This error results in one byte before the intended key being...

CVE-2026-93063

A flaw was found in the Linux kernel's iwlwifi component. This vulnerability allows an attacker to cause a buffer overflow by sending a specially crafted Service Advertisement Protocol SAP message that exceeds the allocated buffer size. This could lead to memory corruption, potentially causing th...

CVE-2026-93061

A flaw was found in the Linux kernel's graphics processing unit GPU host1x debug output. This vulnerability, a type of memory corruption, could allow a local attacker with access to debug files to read beyond the allocated memory buffer. This could potentially lead to information disclosure or...

CVE-2026-93060

A flaw was found in the Linux kernel's Adreno GPU driver. This use-after-free vulnerability occurs in the a6xxgpuinit function. Specifically, the a6xxdestroy function frees the a6xxgpu memory, but adrenogpu continues to point to the freed memory. An attacker could potentially exploit this to caus...

CVE-2026-93058

A flaw was found in the Linux kernel's drm/msm component. When the drmschedinit function fails to complete the scheduler initialization, the system attempts to finalize a partially initialized scheduler. This can lead to an unstable state or a denial of service, as the teardown process assumes...

CVE-2026-93057

A flaw was found in the Linux kernel. When the Universal Flash Storage UFS tagset is quiesced during devfreq gear scaling, the Transmit Event Queue Tail Register TX EQTR can attempt memory allocations. If direct memory reclaim is triggered in this state, it can lead to a deadlock because I/O...

CVE-2026-93055

A flaw was found in the Linux kernel. When processing Universal Disk Format UDF symlink data, a specially crafted input could cause an out-of-bounds read. This occurs because the udfsymlinkfiller function may process a partial pathComponent header, leading to the udfpctochar function attempting t...

CVE-2026-93053

A flaw was found in the Linux kernel's speakup component. A local attacker with root privileges could exploit a vulnerability in the keyhelp module by overriding function names in sysfs. This manipulation could cause an out-of-bounds write in the letteroffsets array, potentially leading to system...

CVE-2026-93054

A flaw was found in the Linux kernel. When a User-space I/O UIO device fails to register, a pointer to memory that has already been released can remain active. A local user could exploit a race condition during this process. This could lead to the system attempting to access freed memory,...

CVE-2026-93052

A flaw was found in the Linux kernel's bcm-vk driver. Improper memory ordering during the initialization of message queues can cause other kernel components to read outdated queue information. This occurs when the msgqinited flag is set before the message queue data is fully synchronized, leading...