CVE-2026-93196

A slab-use-after-free vulnerability in the Linux kernel's nvdimm: virtio_pmem subsystem occurs when virtio_pmem_host_ack() wakes a request already freed by the submitter. This happens because the request token remains reachable via the virtqueue after virtio_pmem_flush() returns and frees it. The...

CVE-2026-93197

This Linux kernel vulnerability affects memory cgroup (memcg) LRU size accounting . When a memcg is offlined, lruvec_reparent_lru() and lru_gen_reparent_memcg() copy the per-zone lru_zone_size[] to the parent without clearing the child's copy, leaving phantom counters on the dying cgroup. Because...

CVE-2026-93195

CVE-2026-93195 affects the Linux kernel component drm/bridge: synopsys: dw-dp (Synopsys DesignWare DisplayPort driver). The DisplayPort AUX channel is initialized and registered during dw_dp_bind() but is never unregistered , which may lead to resource leaks and/or use-after-free when the bridge ...

CVE-2026-93193

CVE-2026-93193 affects the Linux kernel drm/rockchip analogix_dp driver. The vulnerability is a device node reference leak in rockchip_dp_drm_encoder_enable(), caused by of_get_child_by_name() not calling of_node_put() in a symmetric manner. The fix introduces __free(device_node) to automatically...

CVE-2026-93194

CVE-2026-93194 affects the drm/rockchip: dw_dp (DesignWare DisplayPort) driver in the Linux kernel . The root cause is that core resources such as the DisplayPort AUX channel are initialized and registered during dw_dp_bind() but are never unregistered, leading to memory leaks and a confirmed sla...

CVE-2026-93192

CVE-2026-93192 is a dangling pointer vulnerability in the Linux kernel's drm/v3d driver (Broadcom VideoCore IV GPU). The run_job() callbacks for the BIN, RENDER, TFU, and CSD queues assign a job to queue->active_job before calling v3d_fence_create(). If that call fails, the callback returns NU...

CVE-2026-93191

CVE-2026-93191 affects the Linux kernel's SMACK (Security Markup and Labeling Kernel) module. The root cause is in smack_msg_queue_msgrcv(), which incorrectly checks the permissions of the current task rather than the target task. When the pipelined_send() optimization in the msgsnd() syscall pat...

CVE-2026-93190

CVE-2026-93190 affects the Linux kernel platform/chrome: cros_ec_typec driver. The function cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into a fixed 7-element stack array without validating that source_cap_count or sink_cap_count (8-bit fields from the...

CVE-2026-93189

CVE-2026-93189 is a use-after-free in the Linux kernel HID core subsystem. When a driver's probe calls hid_device_io_start() and then fails at a later initialization step, the unwind path hid_hw_stop() frees struct hidraw via hidraw_disconnect() while in-flight HID reports on another CPU may stil...

CVE-2026-93188

CVE-2026-93188 affects the Linux kernel's HID roccat driver . The functions kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device claiming the Ro...

CVE-2026-93186

CVE-2026-93186 affects the Linux kernel CXL mailbox (cxl/mbox) subsystem. The CXL_MEM_SEND_COMMAND ioctl bounds the user-supplied in.size to the mailbox payload size but leaves out.size unbounded. The subsequent call to kvzalloc(out.size) in cxl_mbox_cmd_ctor() allows a user-controlled oversized ...

CVE-2026-93187

CVE-2026-93187 affects the Linux kernel in the ASoC SOF ipc4-topology driver. When the number of input or output audio formats is zero, the functions sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() print an error and jump to the cleanup label, but the return variable ret re...

CVE-2026-93185

CVE-2026-93185 affects the Linux kernel ASoC rt700-sdw driver (Realtek RT700 SoundWire audio codec). The root cause is a work-object lifecycle bug : rt700_sdw_remove() only drains jack_detect_work and jack_btn_check_work when hw_init is true, but that flag is cleared when the SoundWire slave tran...

CVE-2026-93183

CVE-2026-93183 affects the Linux kernel 's DRM Lima GPU driver (drivers/gpu/drm). The root cause is an ordering bug: lima_vm_create() is invoked before va_start and va_end are initialized, so both are zero when passed to drm_mm_init() . When DRM_DEBUG_MM is enabled, the DRM_MM_BUG_ON check fires,...

CVE-2026-93184

CVE-2026-93184 affects the Linux kernel ASoC fsl_audmix driver's runtime PM handling during probe. After pm_runtime_enable(), the AUDMIX audio mixer block remains powered off until the first runtime resume. Register writes issued between probe() and that first resume—originating from DAPM or ALSA...

CVE-2026-93182

CVE-2026-93182 is a u32 overflow in the Linux kernel's CFS scheduler (sched/fair), specifically in update_tg_cfs_runnable(). The overflow occurs when se->avg.runnable_avg * divider exceeds the 32-bit range, corrupting the runnable sum and cascading through load-average propagation to produce a...

CVE-2026-93180

CVE-2026-93180 affects the Linux kernel's drm/panthor GPU driver. A NULL pointer dereference occurs when a GPU memory mapping is split during a partial unmap of an evicted Buffer Object (BO) . The root cause is that the logic handling partial unmap of huge pages was not fully skipped for the VMA ...

CVE-2026-93181

CVE-2026-93181 affects the Linux kernel in the perf/x86/intel/uncore subsystem. The root cause is an incorrect call ordering: in the CPU online path, uncore_box_ref() was invoked before uncore_change_context(), so the gate on box->cpu >= 0 always failed and the uncore box was never initiali...

CVE-2026-93179

This vulnerability affects the Linux kernel in the drm/amd/powerplay subsystem. When the VBIOS supplies a malformed VoltageObjectInfo table, voltage objects whose usSize is smaller than the header or would advance the cursor past the table end are not rejected, causing either an infinite loop (ze...

CVE-2026-93178

A missing bounds check in the Linux kernel's drm/amdgpu/pm/powerplay subsystem (SMU7) allows the vddInd and vddcInd fields parsed from VBIOS tables to index into voltage lookup tables without validation, potentially causing out-of-bounds reads with high impact on confidentiality and availability ...