CVE-2026-93096

CVE-2026-93096 is a concurrency bug in the Linux kernel's CXL (Compute Express Link) features subsystem . When a Get or Set Feature payload exceeds the mailbox payload size, it is split across multiple mailbox commands. The existing mbox_mutex serializes only individual commands and is dropped be...

CVE-2026-93094

A use-after-free vulnerability in the Linux kernel's ath12k Wi-Fi driver affects the AP vdev creation rollback path. When a step after ath12k_peer_create() fails, the err_peer_del path omits a call to ath12k_dp_link_peer_unassign() before the dp_link_peer is freed by ath12k_dp_link_peer_unmap_eve...

CVE-2026-93095

CVE-2026-93095 is a Linux kernel out-of-bounds write in the hfsplus filesystem driver. In hfsplus_delete_cat(), when the last open reference to an unlinked HFS+ hardlink backing inode is closed (str == NULL), the function reconstructs the catalog key from thread.nodeName.length read directly from...

CVE-2026-93093

CVE-2026-93093 affects the Linux kernel's firmware/arm_scmi driver. The root cause is an ordering flaw: transport setup routines (mailbox_chan_setup() and smc_chan_setup()) can enable interrupt delivery or register callbacks before the SCMI channel state (the cinfo pointer and cinfo->handle) i...

CVE-2026-93091

CVE-2026-93091 affects the arm_scmi firmware driver in the Linux kernel. During device removal or probe error teardown, scmi_notification_exit() releases the notification instance before the TX/RX transport channels are freed, allowing an RX interrupt to call scmi_notify() and dereference freed m...

CVE-2026-93092

A race condition in the Linux kernel arm_scmi firmware driver could occur during device removal. The requested-devices notifier looks up protocol fwnodes from the active_protocols IDR , and if the notifier was not unregistered before the IDR was released and destroyed, a notifier callback could r...

CVE-2026-93090

CVE-2026-93090 affects the ARM SCMI (System Control and Management Interface) firmware driver in the Linux kernel . The root cause is a failure-handling defect in scmi_channels_setup(): if this function fails after the common BASE channel or earlier protocol channels have already been registered ...

CVE-2026-93086

CVE-2026-93086 affects the Linux kernel's arm_scmi firmware driver. The vulnerability resides in scmi_cleanup_channels(), which iterates over TX/RX channel IDRs using idr_for_each() to free transport resources. The destroy callback incorrectly removed each entry from the IDR being walked, which c...

CVE-2026-93089

In the Linux kernel , the firmware: arm_scmi driver contains a resource-leak vulnerability in its error handling path. When the transport channel setup succeeds but the subsequent IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the tra...

CVE-2026-93085

CVE-2026-93085 affects the Linux kernel arm_scmi firmware driver . The Device Tree parsing paths accepted SCMI protocol IDs outside the valid range defined by MSG_PROTOCOL_ID_MASK , logging an error but continuing to process the invalid value. A malformed 32-bit DT reg value could reach helpers e...

CVE-2026-93084

CVE-2026-93084 affects the ARM SCMI (System Control and Management Interface) firmware driver in the Linux kernel . The SCMI bus notifier acquires a handle on BUS_NOTIFY_BIND_DRIVER but only releases it on BUS_NOTIFY_UNBOUND_DRIVER . When device_link_add() fails, the handle is retained without a ...

CVE-2026-93083

In the Linux kernel , the firmware: arm_scmi driver's mailbox_chan_setup() function acquires a primary mailbox channel and then requests an additional unidirectional TX receiver channel . If that second request fails, the function returns immediately without releasing the primary channel , leavin...

CVE-2026-93082

CVE-2026-93082 affects the arm_scmi firmware driver in the Linux kernel . The vulnerable function is mailbox_chan_setup() , which acquires a primary P2A mailbox channel and then attempts to request an additional P2A receiver channel. If the secondary request fails, the function returns the error ...

CVE-2026-93080

CVE-2026-93080 affects the arm_scmi firmware driver in the Linux kernel . SCMI transport devices are deliberately excluded from normal bus matching so protocol drivers cannot bind to them, but scmi_device_destroy() reused the same protocol/name lookup to locate devices for channel teardown. The f...

CVE-2026-93081

CVE-2026-93081 affects the Linux kernel 's firmware: arm_scmi driver, specifically the SCMI device destroy path. The root cause is that scmi_child_dev_find() drops the reference returned by device_find_child() before returning the scmi_device pointer, so a concurrent unregister can release the de...

CVE-2026-93079

CVE-2026-93079 is a heap out-of-bounds write in the Linux kernel's CXL subsystem. In cxlctl_get_feature(), the output buffer is sized from the user-supplied fwctl_rpc.out_len, but the device is instructed to write cxl_mbox_get_feat_in.count bytes into that buffer. Because count is a separate user...

CVE-2026-93078

CVE-2026-93078 is a vulnerability in the Linux kernel 's cxl/features subsystem. The function cxlctl_set_feature() sizes its output buffer from the user-supplied fwctl_rpc.out_len without verifying it is large enough to hold the fwctl_rpc_cxl_out header. When out_len is zero, kvzalloc() returns Z...

CVE-2026-93077

CVE-2026-93077 affects the Linux kernel CXL (Compute Express Link) subsystem, specifically the cxl_get_feature() function in the cxl/features code. The function reads a device feature in a loop but passes a fixed output size as the capacity on every iteration. On the last partial iteration, the b...

CVE-2026-93076

CVE-2026-93076 affects the Linux kernel 's DAX (Direct Access) driver subsystem, specifically the fsdev_dax path for static devices. When a static DAX device is rebound from device_dax to fsdev_dax , a stale vmemmap_shift value—set by device_dax based on alignment—persists on the shared pgmap str...

CVE-2026-93074

CVE-2026-93074 affects the Linux kernel 's dax/fsdev subsystem. The root cause is in __fsdev_dax_direct_access(), which computed the kernel virtual address by adding a device-linear byte offset to virt_addr (the direct-map address of ranges[0]). For multi-range devices with physical gaps between ...