CVE-2026-93253

In the Linux kernel, the following vulnerability has been resolved: sched/isolation: Defer freeing of cpumask memblock memory to initcall When testing a linux-next kernel with commit 59bd1d914bb5 "memblock: warn when freeing reserved memory before memory map is initialized", the following warning...

CVE-2026-97434

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix handling of NAPI on the remove path All the NAPI instances for a DPSW device are attached to the first switch port's netdevice but shared by all ports. The NAPI instances get disabled only once the last port goe...

CVE-2026-93282

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated sessi...

CVE-2026-93244

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: simpledrm: Improve stride validation Validate the computed stride against the maximum value INTMAX...

CVE-2026-93249

In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initializ...

CVE-2026-97455

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpidsterminatecontrolmethod Fix use-after-free issue in acpidsterminatecontrolmethod by clearing references to method locals and arguments...

CVE-2026-93827

In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtiofssetupvqs allocates fs-vqs and fs-mqmap before calling virtiofindvqs. If virtiofindvqs fails, the error path frees both pointers and returns an error to virtiofsprobe...

CVE-2026-97452

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Prevent adding invalid references Prevent adding references for local, argument, and debug objects in acpiutcopysimpleobject...

CVE-2026-97450

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

CVE-2026-97481

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix possible ISR soft lockup There are rare cases in which the host gets stuck in the ISR because it is flooded with messages during the startup phase. The reason for the soft lockup in the ISR is the missing FIFO...

CVE-2026-97508

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb-rootswitch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tbxdphandlerequest return error to the remote host. However, we need to make sure we keep the uui...

CVE-2026-93213

In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property name when the name is empty or all digits. Check the bound first...

CVE-2026-97456

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix condition check in acpipsparseloop Fix condition check for AMLELSEOP in acpipsparseloop to prevent out-of-bounds access...

CVE-2026-97451

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

CVE-2026-93821

In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead...

CVE-2026-93800

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on reloc root after error in insertdirtysubvol If during relocation we fail in insertdirtysubvol because btrfsupdaterelocroot returned an error, we will leave a root's relocroot field pointing to a reloc...

CVE-2026-97416

In the Linux kernel, the following vulnerability has been resolved: btrfs: balance: fix potential bg lookup failure in btrfsmayallocdatachunk BUG Running btrfs balance can trigger a null-ptr-deref before relocating a data chunk when metadata corruption leaves a chunk in the chunk tree without a...

CVE-2026-97491

In the Linux kernel, the following vulnerability has been resolved: net/rds: Don't sleep inside rdsibconnpathshutdown New rds rdma self tests exposed a hang when tearing down the ib network configs. This is caused by the shutdown worker thread sleeping on the waitevent call, which blocks other wo...

CVE-2026-93252

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2initacl A lockdep warning indicates a circular locking dependency between &oi-ipxattrsem and &journal-jtransbarrier: WARNING: possible circular locking dependency detected is trying ...

CVE-2026-93820

In the Linux kernel, the following vulnerability has been resolved: PCI: rockchip: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may le...

CVE-2026-93822

In the Linux kernel, the following vulnerability has been resolved: PCI: iproc: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead ...

CVE-2026-93222

In the Linux kernel, the following vulnerability has been resolved: signal: avoid shared siginfo namespace rewrites sendsignallocked rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one recipient can affect the next. Copy the siginfo before changing it...

CVE-2026-97415

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate names in ROOTREF and ROOTBACKREF ROOTREF and ROOTBACKREF items contain a struct btrfsrootref followed by the subvolume name. Several readers assume that this layout is already valid and then use the...

CVE-2026-73064

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers...

CVE-2026-93205

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Manage teardown with devm armsmmudeviceremove manually frees the IOPF queue, destroys the vmidmap and disables the device, while the IRQs and queues are devm managed. devm unwinds only after remove returns, so...

CVE-2026-93228

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...

CVE-2026-97501

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction pinctrlgpiodirectioninput / pinctrlgpiodirectionoutput take the pinctrl mutex. This causes a gpiochip operations to need to sleep. Worse yet, the .cansleep...

CVE-2026-93275

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pteventstop is called without PERFEFUPDATE flag, then perfauxoutputend is not called. A subsequent call to pteventstart will call perfauxoutputbegin again which violates the rul...

CVE-2026-97422

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and...

CVE-2026-97515

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 On NPCM845, when a target on the I3C bus gets stuck holding SDA low, the controller reports a false Master Request MR in-band interrupt event. The driver handles...

CVE-2026-93786

In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and...

CVE-2026-93823

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Let driver decide buffer size at AMDKFDIOCGETDMABUFINFO ioctl amdkfd driver needs allocate buffer to return bo metadata to user space. The buffer size is controlled by user currently. It is a potential security issue...

CVE-2026-97511

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds access in monitor In NAN, we don't know on what band the frame will be sent. Therefore we set info-band to NUMNL80211BANDS. However, this leads to out-of-bound access in...

CVE-2026-93828

In the Linux kernel, the following vulnerability has been resolved: exfat: fix handling of damaged volume in exfatcreateupcasetable When the size of the upcase table is set to zero in the dentry for any reasone.g. corrupted media or misbehaving device, an integer overflow causes the module to loo...

CVE-2026-97410

In the Linux kernel, the following vulnerability has been resolved: netconsole: take targetcleanuplistlock in dropnetconsoletarget dropnetconsoletarget unlinks the target while only holding targetlistlock. However, when the underlying interface has been unregistered, netconsolenetdevevent moves t...

CVE-2026-97409

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl-ioerrwork to abort inflight requests. This ends up calling...

CVE-2026-97513

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2mctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of...

CVE-2026-93781

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Do not block on tag allocation in scsiehlockdoor scsiehlockdoor is called from scsirestartoperations while the host is still in the SHOSTRECOVERY state, i.e. before the host is switched back to SHOSTRUNNING and...

CVE-2026-93794

In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h...

CVE-2026-93814

In the Linux kernel, the following vulnerability has been resolved: spi: core: Abort active target transfer on controller suspend When an SPI controller operating in target mode has a transfer in progress at the time of system suspend, the suspend path proceeds without aborting the ongoing...

CVE-2026-93793

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate TXCMD response layout TXCMD parsing uses framecount to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing...

CVE-2026-93791

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: add a check on the tid coming from the firmware banotif-tid is a firmware-controlled u8 that is used directly as an array index into tiddata without any validation. Add a bounds check against IWLMAXTIDCOUNT...

CVE-2026-97479

In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when removing a device while its supplier is unbinding During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 devicelinksnodriver+0xcc/0xfc ... Cal...

CVE-2026-93826

In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidppconnectevent If inputregisterdevice fails, we call inputfreedevice, but keep stale pointer to the old device in hidpp-input, which could potentially lead to UAF. Fix that by resetting it to...

CVE-2026-97426

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error Return the parse error before acquiring PM access...

CVE-2026-93810

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double fput Fix a double fput in error handling in cachefilescreatetmpfile...

CVE-2026-97432

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix P2P-Device binding handling Our binding handling for P2P-Device can run into the following scenario, as observed by our testing: - a station interface is connected on some channel - the P2P-Device does a...

CVE-2026-93790

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix out-of-bounds tiddata access in BA notif mvmsta-tiddata was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lqcolor into a random tiddata slot unrelated to the BA...

CVE-2026-97499

In the Linux kernel, the following vulnerability has been resolved: coresight: perf: Retrieve path and source from event data ETM perf callbacks currently use the per-CPU csdevsrc pointer, which can race with updates during device registration and unregistration. The AUX setup already builds and...

CVE-2026-93799

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate staid in BA window status notif BAWINDOWSTATUSNOTIFICATIONID extracts a 5-bit staid from the firmware notification and uses it to index fwidtomacid without bounds checking. Validate staid before array...