CVE-2026-92509

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access core component. When a counter is accessed via the netlink path, the rdmarestrackdel function is invoked too late during the counterrelease process. This timing issue can lead to a use-after-free vulnerability, where...

CVE-2026-92508

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access core component. When a Completion Queue CQ is accessed through the netlink path, a timing issue can occur where the CQ's resources are freed before it is properly removed from tracking. This creates a brief period where the...

CVE-2026-92507

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access core component. A synchronization issue in the ibdeallocpduser function, when a Protection Domain PD is accessed via the netlink path, can lead to a use-after-free vulnerability. This could allow a local attacker to potential...

CVE-2026-92506

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. A race condition during device removal can occur when two SCMI drivers concurrently unregister for the same protocol. This can lead to a double-free vulnerability, where memory is freed twice,...

CVE-2026-92503

A flaw was found in ext4, the extended filesystem for the Linux kernel. When concurrent extended attribute xattr workloads are processed, an ABBA deadlock can occur between a running transaction and the eviction thread. This situation causes both tasks to wait indefinitely for each other, leading...

CVE-2026-92502

A flaw was found in the Linux kernel's ext4 filesystem. When the system is configured with data=journal mode, a local attacker could exploit a race condition during system reboot. This issue prevents the proper clearing of internal data flags, which can lead to data loss or corruption during the...

CVE-2026-92501

A flaw was found in the Linux kernel's ext4 filesystem. A race condition exists during direct I/O DIO operations when the system falls back to buffered I/O. This unprotected timing window allows concurrent I/O operations to incorrectly invalidate cached data, leading to input/output I/O errors. A...

CVE-2026-92500

A flaw was found in the Linux kernel's ext4 filesystem. A race condition can occur during data write operations when the system attempts to handle inline data concurrently. This timing issue can lead to a system crash, causing a denial of service, or potentially result in data loss. Mitigation...

CVE-2026-92499

A flaw was found in the Linux kernel's ext4 filesystem. A local attacker with the ability to create or manipulate a corrupted directory can trigger a use-after-free vulnerability. This occurs when the ext4readdir function attempts to read directory entries from an invalid offset, leading to an...

CVE-2026-92497

A flaw was found in the ath12k Wi-Fi driver within the Linux kernel. This vulnerability occurs because the firmware buffer is read without first verifying that it contains enough data to hold a header. An attacker could potentially exploit this to cause a buffer overread, which may lead to...

CVE-2026-92498

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. Insufficient length checks in several Wireless Management Interface WMI event handlers, specifically ath6klwmiscancompleterx, ath6klwmiaddbareqeventrx, and ath6klwmidelbareqeventrx, allow the system to read beyond the allocated buffer...

CVE-2026-92496

A flaw was found in the ath11k Wi-Fi driver in the Linux kernel. This vulnerability allows a buffer overread to occur in the ath11kwmitlvoprx function. The driver reads the firmware buffer without adequately verifying its size, which could lead to reading data beyond the allocated memory. This...

CVE-2026-92495

A flaw was found in the Linux kernel's RDMA/bnxtre component. A read-only memory mapping mmap for DBR/toggle pages can incorrectly retain write permissions VMMAYWRITE. This allows a local attacker to bypass intended security checks and upgrade the mapping to writable using mprotectPROTWRITE...

CVE-2026-92492

A flaw was found in the Linux kernel's cpufreq/amd-pstate component. A local attacker could potentially trigger a NULL pointer dereference by performing a racing CPU hotplug or driver teardown operation. This occurs because certain functions, amdpstatepowersupplynotifier and amdpstateprofileset, ...

CVE-2026-92491

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. During the registration of protocol tables, the scmiprotocoltableregister function may fail to properly unregister previous requests if a subsequent entry fails. This can result in a dangling pointer...

CVE-2026-92490

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware driver. When a driver fails to register, the system may not properly unregister associated protocol devices, leaving behind invalid references. This can lead to the system attempting to access memory...

CVE-2026-92489

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability occurs in the xfrmdevdirectoutput function due to incorrect handling of network packet buffer skb ownership. When netfilter drops a packet, the skb can be freed twice, leading to a double-free condition. This memory...

CVE-2026-92487

A flaw was found in the exfat filesystem within the Linux kernel. A race condition can occur when a shared writable memory mapping has its validsize extended by a buffered write or a page fault. During this process, the kernel zeroes out a page-cache gap, and a concurrent write operation through...

CVE-2026-92485

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. Incorrect handling of trampoline flags during the release of a BPF tracing link can lead to corruption of the trampoline. This corruption prevents the proper restoration of program instructions, which may result in a...

CVE-2026-92484

A flaw was found in the Linux kernel's cxl/region component. This use-after-free vulnerability occurs when an error path releases a reference to a switch decoder prematurely. If this is the last reference, the decoder can be freed before its name is accessed for error logging, potentially leading...

CVE-2026-92483

A flaw was found in the Linux kernel's liveupdate component. When a retrieval attempt for a File List Block FLB fails, the system does not record this failure. Consequently, if a user attempts to retrieve another file associated with the same FLB, the system may retry the failed retrieval. This...

CVE-2026-92482

A flaw was found in the Linux kernel's pinctrl Mediatek driver. This vulnerability occurs because the gpiochip memory is freed prematurely while it is still registered, leading to a use-after-free condition. This can happen when the driver is built as a module and then unloaded. A local attacker...

CVE-2026-92481

A flaw was found in the Linux kernel's pinctrl: mediatek driver. When the driver is unloaded, it fails to properly release External Interrupt EINT resources. This oversight can result in the system attempting to access memory that has already been freed, potentially leading to system instability ...

CVE-2026-92480

A flaw was found in the Linux kernel's SCSI Universal Flash Storage UFS core. This vulnerability arises from improper validation of string descriptors, which can lead to an out-of-bounds read when processing UTF-16 payloads. A local attacker or a malicious UFS device could exploit this to...

CVE-2026-92479

A flaw was found in the Linux kernel's Universal Flash Storage UFS host controller driver. When an invalid completion queue entry CQE tag is reported, the driver attempts to dereference a NULL pointer, which can lead to a system crash. This vulnerability could allow a local attacker to cause a...

CVE-2026-92478

A flaw was found in the Linux kernel. The Universal Flash Storage UFS core component does not properly validate connected lane counts. This could allow a local attacker to provide specially crafted input, leading to out-of-range memory access when processing Universal Flash Storage UFS commands...

CVE-2026-92477

A flaw was found in the Linux kernel, specifically within the scsi: ufs: debugfs component. The ufssavederrwrite function copies user-provided input into a stack buffer without ensuring sufficient space for a string terminator. If the input completely fills the buffer, it overwrites the terminato...

CVE-2026-92476

A flaw was found in the Linux kernel's crypto: keembay driver. This vulnerability occurs because a critical component, irqcompletion, is not fully prepared before the system starts processing interrupts. If an interrupt happens during this brief window, it can attempt to use an uninitialized...

CVE-2026-90435

A flaw was found in the Linux kernel's RDMA/mlx5 component. A local attacker could exploit an integer overflow vulnerability when processing user-supplied buffer size values. This flaw occurs because large user inputs can cause an integer overflow during buffer size calculation, leading to a...

CVE-2026-90433

A flaw was found in the Linux kernel's spi: oc-tiny driver. This vulnerability arises from a timing issue where the system attempts to free memory associated with a Serial Peripheral Interface SPI controller before ensuring that all related interrupt handling has ceased. This can lead to a...

CVE-2026-90432

A flaw was found in the Linux kernel's schedext component, specifically within its hardlockup handler. An unnecessary deferral of abort operations could prevent the system from properly recovering from a CPU hardlockup, where a CPU becomes unresponsive. This could lead to system unresponsiveness ...

CVE-2026-90431

A flaw was found in the Linux kernel's remoteproc component. A race condition exists between the crash handling and removal functions due to a lack of synchronization. This could allow a local attacker to trigger a use-after-free vulnerability. Successful exploitation of this flaw may lead to...

CVE-2026-90429

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv component. A synchronization issue exists between the error Interrupt Service Routine ISR and the Virtual Interrupt Function VINTF de-initialization process. A concurrent error could lead to the ISR attempting to access a VINTF that is...

CVE-2026-90426

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv component. During the teardown process of Virtual Interrupt Functions VINTFs, the error interrupt IRQ is freed after the VINTFs are torn down. This incorrect order can lead to a scenario where an error occurring in this window causes the...

CVE-2026-90425

A flaw was found in the Linux kernel, specifically within the IOMMU Input/Output Memory Management Unit Tegra241 command queue driver. This vulnerability arises from improper handling of virtual Stream IDs vSID when a device has either multiple or no physical Stream IDs. A malicious guest operati...

CVE-2026-90423

A flaw was found in the Linux kernel's RDMA/rxe component. An error in the On-Demand Paging ODP initialization path can lead to a Use-After-Free UAF vulnerability. During error handling, memory is prematurely released, but a pointer to it is not properly cleared. This allows subsequent operations...

CVE-2026-90420

A flaw was found in the nilfs2 component of the Linux kernel. When the nilfs2 filesystem encounters an I/O error and is subsequently remounted as read-only, a cleaner input/output control ioctl operation can enter an infinite loop. This condition causes the affected task to hang indefinitely,...

CVE-2026-90421

A flaw was found in the Linux kernel's Peripheral Component Interconnect PCI subsystem. This Use-After-Free UAF vulnerability arises when a PCI device probe operation occurs concurrently with the removal of a dynamic ID. This timing issue could allow a local attacker to cause a system crash,...

CVE-2026-90418

A flaw was found in nilfs2, a file system in the Linux kernel. This vulnerability occurs when a dirty page unexpectedly loses its dirty status during a copy operation, particularly after the filesystem detects metadata corruption and transitions to read-only mode. An attacker could potentially...

CVE-2026-90419

A flaw was found in the nilfs2 filesystem implementation within the Linux kernel. This vulnerability occurs due to insufficient validation of super-root inode metadata size before parsing. A local attacker could craft a malicious filesystem image that, when processed, causes an out-of-bounds read...

CVE-2026-90416

A flaw was found in the Linux kernel's RDMA/mlx5 component. The getparam function, used for debugging congestion parameters, incorrectly formats a 32-bit unsigned integer as a signed integer. This can lead to a stack out-of-bounds read when a large value is processed, potentially causing unexpect...

CVE-2026-90413

A flaw was found in the Linux kernel's IB/isert component. A remote attacker can exploit this vulnerability by sending a specially crafted login Protocol Data Unit PDU that declares a larger data segment length than the actual data received. This discrepancy causes an out-of-bounds read during...

CVE-2026-90412

A flaw was found in the nvmet component of the Linux kernel. When processing an RMI log page, if memory allocation for the log buffer fails, the system incorrectly reports a successful operation to the host. This can lead to the host believing data was transferred when it was not, potentially...

CVE-2026-90410

A flaw was found in the Linux kernel's Serial Peripheral Interface SPI davinci component. A timing issue exists during the deallocation of the SPI controller, where its memory can be freed before the associated interrupt handler is fully drained. This can lead to a use-after-free vulnerability,...

CVE-2026-90408

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This vulnerability arises from insufficient length enforcement for event structures and unchecked firmware input used as loop bounds. An attacker could potentially exploit this to cause an out-of-bounds read, which may lead to informatio...

CVE-2026-90409

A flaw was found in the Linux kernel's drm/panthor driver. This vulnerability arises from a missing check that allows user-mode virtual memory VM bind mappings to overlap with memory regions reserved for kernel Buffer Objects BOs. A local attacker could exploit this to cause memory corruption,...

CVE-2026-90406

A flaw was found in the Linux kernel's media: qcom: iris driver. This vulnerability occurs when the iriscoredeinit function fails to properly handle a runtime Power Management PM resume failure. An attacker could potentially exploit this by triggering a scenario where the pmruntimeresumeandget...

CVE-2026-90405

A flaw was found in the media: stm32: dcmi component of the Linux kernel. Improper error handling in the probe function can lead to a null pointer dereference. This issue occurs because dmareleasechannel is called before the dcmi-dmachan variable is properly assigned, potentially allowing a local...

CVE-2026-90403

A flaw was found in the Linux kernel's rtlwifi PCI driver. An issue in the rtlpciprobe error handling path causes cleanup functions to be skipped. This prevents proper de-initialization of resources, which could lead to resource exhaustion or system instability, potentially resulting in a Denial ...

CVE-2026-90401

A flaw was found in the Linux kernel's Multiple Device MD RAID personalities, specifically raid1, raid10, and raid456. This vulnerability arises from incomplete support for the REQNOWAIT flag during write operations. When one mirror succeeds and another fails with an -EAGAIN error, the MD driver...