CVE-2026-93194

A flaw was found in the drm/rockchip: dwdp component of the Linux kernel. This vulnerability occurs because core resources, such as the DisplayPort AUX channel, are initialized but never properly released when the dwdpbind function is called. This oversight can lead to memory leaks and a...

CVE-2026-93193

A flaw was found in the Linux kernel's drm/rockchip: analogixdp component. A reference leak occurs in the rockchipdpdrmencoderenable function because ofgetchildbyname does not symmetrically call ofnodeput. This can lead to resource exhaustion, potentially causing a denial of service DoS for the...

CVE-2026-93192

A flaw was found in the Linux kernel's drm/v3d component. When the v3dfencecreate function fails within runjob callbacks, the queue-activejob is not properly cleared. This oversight leaves a dangling pointer, which could lead to memory corruption or a denial of service DoS condition...

CVE-2026-93190

A flaw was found in the crosectypec component of the Linux kernel. The crostypecregisterpartnerpdos function does not properly validate the sourcecapcount and sinkcapcount values received from the Embedded Controller EC. An attacker could potentially provide manipulated count values, leading to a...

CVE-2026-93191

A flaw was found in the Linux kernel's SMACK Simplified Mandatory Access Control Kernel module. The smackmsgqueuemsgrcv function incorrectly checks the permissions of the sending task instead of the receiving task when using a message queue. This allows an unauthorized local user, operating under...

CVE-2026-93189

A flaw was found in the Linux kernel's Human Interface Device HID core. When a driver's probe fails after enabling input delivery, the hidhwstop function may free a hidraw structure while in-flight HID reports are still being processed. This timing issue can lead to a use-after-free vulnerability...

CVE-2026-93188

A flaw was found in the Linux kernel's Roccat Human Interface Device HID driver. A local attacker, by connecting a specially crafted malicious USB device, can send an out-of-range profile index. This can lead to an out-of-bounds read, resulting in the disclosure of sensitive information through t...

CVE-2026-93187

A flaw was found in the Linux kernel's Sound Open Firmware SOF IPC4 topology component. When internal functions sofipc4widgetsetupcompsrc and sofipc4widgetsetupcompasrc are invoked with an invalid number of input or output formats specifically, zero, they incorrectly report a successful operation...

CVE-2026-90349

A flaw was found in the Linux kernel's mt76 wireless driver, specifically within the mt7996tx function. When the mac80211 subsystem leaves the link unspecified, the driver substitutes a primary link ID that is then used without proper bounds checking to access internal arrays. This unchecked acce...

CVE-2026-90348

A flaw was found in the Linux kernel's ath10k snoc wireless driver. When collecting a firmware crash dump on arm64 systems, the ath10kmsadumpmemory function uses memcpy to copy data from a memory region that does not permit unaligned accesses. This unaligned memory access triggers a kernel crash,...

CVE-2026-90347

A flaw was found in the Linux kernel. On ARM64 architectures, a vulnerability in the ptrace system call entry tracing mechanism allows a local attacker to manipulate the first system call argument. This manipulation can occur without being subjected to security checks, such as seccomp or audit...

CVE-2026-90345

A flaw was found in the brcmfmac Wi-Fi driver in the Linux kernel. This vulnerability occurs because certain paths for handling Wi-Fi Peer-to-Peer P2P action frames incorrectly assume that a P2P device virtual interface vif is always present. A local attacker could potentially send specially...

CVE-2026-90344

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A remote attacker, operating a malicious Access Point AP, could exploit this by sending a Channel Switch Announcement CSA to an invalid channel, specifically channel zero. Due to an error in parsing the CSA, the system fails to...

CVE-2026-90343

A flaw was found in the Linux kernel's Wi-Fi Wireless Fidelity subsystem, specifically within the cfg80211 component. When a Wi-Fi Peer-to-Peer P2P device or Neighborhood Area Network NAN interface is stopped while a Passive Measurement Scan Request PMSR is pending, the driver may retain a stale...

CVE-2026-90342

A flaw was found in the Linux kernel. A local user could potentially trigger a deadlock within the kernel's memory management, specifically related to the mmaplock mechanism. This issue arises when the arenavmfault function attempts to retry a memory fault without correctly releasing a previously...

CVE-2026-90341

A flaw was found in the Linux kernel's handling of coreboot firmware tables. A local attacker with control over firmware could provide a malformed coreboot table. This could cause an overflow in size calculations or an advertised extent beyond the allocated resource, leading the kernel to map and...

CVE-2026-90339

A flaw was found in the Linux kernel's powerpc/syscall component. This vulnerability occurs when the systemcallexception function incorrectly handles a sentinel value during syscall processing, particularly when security mechanisms like seccomp or ptrace intercept a syscall. This can lead to an...

CVE-2026-88838

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are...

CVE-2026-88833

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causin...

CVE-2026-93204

A flaw was found in the batman-adv component of the Linux kernel. When a Media Access Control MAC address is updated, the update is not performed atomically. This allows a parallel process to read a partially updated MAC address, which could then be used to poison the Address Resolution Protocol...

CVE-2026-93203

A flaw was found in the B.A.T.M.A.N. Advanced Better Approach To Mobile Ad-hoc Networking module of the Linux kernel. This vulnerability occurs when the system attempts to add new claims and modify existing claim backbones in parallel. Under specific timing conditions, this parallel processing ca...

CVE-2026-93201

A flaw was found in the Linux kernel's dm-pcache component. An attacker with administrative privileges CAPSYSADMIN can supply a specially crafted cache device with an out-of-range segment identifier. This can lead to an out-of-bounds read and write, resulting in memory corruption and potentially...

CVE-2026-95114

A flaw was found in libwebsockets. An out-of-bounds read vulnerability in the Lightweight Embedded JSON Parser LEJP allows a remote attacker to cause a Denial of Service DoS. By submitting specially crafted JSON data, an attacker can trigger an invalid memory read that causes the application to...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-90261

A flaw was found in the btrfs zoned filesystem component of the Linux kernel. During metadata-heavy operations, a specific writeback scenario can prevent the system from properly managing active block groups. This issue can lead to a transaction abortion, forcing the filesystem into a read-only...

CVE-2026-90262

A flaw was found in the Linux kernel's btrfs filesystem. This flaw occurs when the btrfsreadmerkletreepage function encounters a Merkle folio that is not up-to-date. Instead of retrying the read, the system incorrectly treats this as a permanent error, causing transient read failures to become...

CVE-2026-90250

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter cgroup storage mechanism. When replacing an existing BPF program with a new one that uses BPFMAPTYPEPERCPUCGROUPSTORAGE, the system may fail to properly allocate and assign the necessary cgroup storage. This oversight can lead to a...

CVE-2026-90242

A flaw was found in the Linux kernel's iommu/vt-d subsystem. When an IOMMU Input/Output Memory Management Unit domain with an iopfhandler is replaced by another domain at the Requestor ID RID level, a reference count for the old domain is not properly released. This resource leak prevents the...

CVE-2026-90238

A flaw was found in the Linux kernel's AMD ISP4 media driver. During the initialization process, a self-deadlock can occur if the isp4sdpwronandinit function attempts to re-acquire a mutex it already holds. This issue can lead to a system deadlock, resulting in a Denial of Service DoS for the...

CVE-2026-108574

A flaw was found in LiteLLM. A remote attacker can bypass authorization controls by manipulating the session identifier sessionid parameter in the spend tracking interface. This flaw allows an attacker to view spend tracking logs and usage metrics associated with other user sessions without prope...

CVE-2026-90260

A flaw was found in the Linux kernel's Btrfs zoned filesystem. When a freed-but-still-dirty tree block is written out as zeros, the btreecsumonebio function improperly clears the extent buffer's in-memory content. This can lead to corruption of the extent tree, potentially causing system...

CVE-2026-90259

A flaw was found in btrfs qgroup. An incorrect length calculation in the qgroupfreereserveddata function can lead to a much larger length being used than intended. This error in calculation may result in improper data handling, potentially causing system instability or data corruption. Mitigation...

CVE-2026-90258

A flaw was found in the pinctrl: airoha component of the Linux kernel. Without properly handling IRQ Interrupt Request resource helpers, the gpiolib General Purpose Input/Output library fails to set a flag indicating an IRQ pin is in use. This oversight can allow an unprivileged user or another...

CVE-2026-90257

A flaw was found in the kernel's virtiobt component. When processing responses to Zephyr vendor commands, the system fails to properly check the length of the received data. This can lead to an out-of-bounds read, where adjacent memory is accessed beyond the intended buffer. Consequently, sensiti...

CVE-2026-90256

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A use-after-free UAF vulnerability can occur when hciconn::l2capdata is accessed without proper locking during the disconnection indication process. This can lead to a system crash or...

CVE-2026-90251

A flaw was found in the Linux kernel's Bluetooth Microsoft MSFT driver. This vulnerability arises from insufficient validation of the evtprefixlen field against the actual response length during the readsupportedfeatures operation. A malicious Bluetooth controller could exploit this by sending a...

CVE-2026-90249

A flaw was found in the Linux kernel's Industrial I/O IIO core, specifically within the gp2ap002 light sensor driver. A local attacker with appropriate permissions could exploit this by repeatedly writing the same value to the event enable attribute. This can lead to an unbalanced runtime Power...

CVE-2026-90248

A flaw was found in the Linux kernel's network scheduler component net/sched: clsapi. A race condition exists in the tcnewtfilter function during the insertion of a new protocol. If a process loses a race to insert a protocol, its error handling path may incorrectly remove an active network...

CVE-2026-90247

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. This vulnerability allows for a memory map mmap lock to be leaked when handling interrupt work, specifically within the stackmapgetbuildidoffset and bpffindvma functions. This can lead to a situation where two read locks...

CVE-2026-90246

A flaw was found in AppArmor within the Linux kernel. An unprivileged user can exploit an integer overflow vulnerability in the verifytags function by crafting a malicious AppArmor policy. This flaw allows an attacker to trigger an out-of-bounds read during policy loading, which could lead to...

CVE-2026-90245

A flaw was found in the Linux kernel's fbdev kyro driver. This vulnerability arises from the calculation of overlay viewport end coordinates using 32-bit unsigned arithmetic. Large input values can cause these calculations to wrap around, resulting in incorrect coordinates being passed to the...

CVE-2026-90244

A flaw was found in the Linux kernel. Specifically, within the iommu/dma component, a lack of proper locking in the VFIO type1 legacy container could allow concurrent access to the msipagelist. This concurrent access can lead to data corruption of the msipagelist, potentially causing system...

CVE-2026-90243

A flaw was found in the Linux kernel's IOMMU/VT-d subsystem. During the tear-down of copied context entries, the kernel zeroes out parts of an entry before clearing its "Present" bit and invalidating related caches. This timing issue allows hardware to fetch a partially cleared entry that is stil...

CVE-2026-90237

A flaw was found in the Linux kernel's netfilter connection tracking nfct component. This vulnerability arises from the incorrect handling of connection tracking expectations, where early insertion of expectations into the list can lead to stale entries. These stale entries point to incorrect...

CVE-2026-90241

A flaw was found in the Linux kernel's iommu/vt-d subsystem. During the setup of scalable-mode context entries for PCI devices, an error can occur that leaves behind invalid context entries. These entries may point to memory that has already been freed. An attacker could potentially exploit this ...

CVE-2026-90240

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit / VT-d Virtualization Technology for Directed I/O component. When tearing down Direct Memory Access DMA aliases of a device, the system fails to flush the context cache with the correct Source ID SID. This oversight...

CVE-2026-90235

A flaw was found in the xprtsock component of the Linux kernel's sunrpc implementation. This concurrency vulnerability arises from improper synchronization when updating and reading shared socket callback pointers. As a result, a processor might use an outdated reference to a callback function...

CVE-2026-90234

A flaw was found in the Linux kernel's Network File System NFS client. When an NFS server grants a delegation, the client may fail to record it and not send a DELEGRETURN message. This can lead to a situation where the server believes the client still holds the delegation. If the server then...

CVE-2026-90232

A flaw was found in the Linux kernel's Address Mapping Table AMT device handling. When an AMT device is configured across different network namespaces netns, unregistering the underlying network device can lead to a system hang. This occurs because the amtdeviceevent function does not correctly...

CVE-2026-90231

A flaw was found in AppArmor, a Linux kernel security module. This vulnerability allows a local attacker to bypass security confinement. The issue arises from an incorrect application of unprivileged transition restrictions on tasks already confined by a stack, enabling an escape if two transitio...