CVE-2026-93072

CVE-2026-93072 affects the Linux kernel irqchip/renesas-irqc driver. During probe, the driver allocates generic interrupt chips in the interrupt domain but fails to set the IRQ_DOMAIN_FLAG_DESTROY_GC flag. On driver removal, the generic chips are therefore not freed, causing a resource leak . Bec...

CVE-2026-93071

CVE-2026-93071 is a memory leak in the Linux kernel's bcm2835-unicam media driver. The function v4l2_async_nf_add_fwnode_remote() allocates an async sub-device (asc) object that is only freed when v4l2_async_nf_cleanup() is called, but that cleanup was not invoked in the driver's error and remove...

CVE-2026-93070

CVE-2026-93070 is a double-free vulnerability in the Linux kernel's Intel IPU6 media driver (media: ipu6). After ipu6_bus_initialize_device() stores the isys/psys pdata pointer and initializes the auxiliary device, error-unwinding paths in the callers perform an extra kfree(pdata). Since the auxi...

CVE-2026-93069

CVE-2026-93069 affects the Linux kernel OPP (Operating Performance Points) subsystem . A prior commit (173e02d67494) changed the initialization order so that *opp_table was initialized after *opp, which reversed the order of registered cleanup functions. This can cause a use-after-free in _opp_kr...

CVE-2026-93067

CVE-2026-93067 affects the Linux kernel's tc358767 DRM bridge driver. In tc_aux_read_data(), the byte count reported by the controller via the AUX_BYTES field (which can be up to 255) is used directly to read into a 16-byte stack buffer (auxrdata) and then copied to the caller buffer, without cla...

CVE-2026-93068

CVE-2026-93068 is a teardown ordering race in the Linux kernel's AMD GPU display driver (drm/amd/display). DM I2C adapters can remain visible to userspace while display manager (DM) teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpu_dm_i2c_xfer() after the backin...

CVE-2026-93066

CVE-2026-93066 is a use-after-free in the Linux kernel's x86/mm/pat (page-attribute-table) subsystem. A race between cpa_collapse_large_pages() and __change_page_attr() allows a concurrent walker to write through a stale PTE pointer into a freed page-table page. The race is triggered when concurr...

CVE-2026-93064

This is a Linux kernel vulnerability in the iwlwifi mvm driver (Intel wireless). The root cause is an off-by-one error in iwl_mvm_frob_txf_key_iter(), the TXF key sanitiser. When a full key match is found, the memset start offset uses i - keylen instead of the correct i + 1 - keylen, which zeroes...

CVE-2026-93065

CVE-2026-93065 affects the Linux kernel iwlwifi driver. The vulnerability resides in the iwl_fwrt_dump_error_logs function, where the loop counter variable count was declared as u8 while num_pc is of type u32 . If the firmware advertises more than 255 program counter (PC) entries, the 8-bit count...

CVE-2026-93063

CVE-2026-93063 is a buffer overflow in the Linux kernel's iwlwifi MEI (Manageable Event Interface) driver. The root cause is a missing length validation: the size of a received SAP message was not checked against the local buffer before being read, allowing an oversized message to overflow the bu...

CVE-2026-93062

CVE-2026-93062 affects the Linux kernel in the iwlwifi wireless driver. The vulnerability is a division by zero in the function iwl_dbg_tlv_alloc_fragments, which can occur when num_frags evaluates to zero. The fix introduces a check that the required size is non-zero and adds a guard on num_frag...

CVE-2026-93061

CVE-2026-93061 is a stack over-read in the Linux kernel's host1x GPU driver . The functions host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed to the output callbac...

CVE-2026-93060

This vulnerability affects the Linux kernel DRM MSM Adreno GPU driver, specifically the a6xx_gpu_init() error path. The root cause is a use-after-free : when initialization fails, a6xx_destroy() frees the a6xx_gpu object, leaving adreno_gpu pointing to freed memory. The fix preserves the error co...

CVE-2026-93059

CVE-2026-93059 affects the drm/msm driver in the Linux kernel . The root cause is a missing put_task_struct() call in the else branch of recover_worker, while get_pid_task() had already incremented the task reference count. This results in a task_struct reference leak on every GPU hang recovery ,...

CVE-2026-93058

CVE-2026-93058 affects the Linux kernel's drm/msm driver (Qualcomm Adreno GPU subsystem). The vulnerability exists in msm_ringbuffer_new(): when an allocation or scheduler setup step fails, the error path calls msm_ringbuffer_destroy(), which in turn calls drm_sched_fini() even if drm_sched_init(...

CVE-2026-93057

This Linux kernel vulnerability affects the SCSI UFS core subsystem. When devfreq gear scaling quiesces the UFS tagset, the TX EQTR functions (ufshcd_tx_eqtr(), __ufshcd_tx_eqtr(), and ufs_qcom_get_rx_fom()) allocate memory with GFP_KERNEL. If direct reclaim is triggered in this context, reclaim/...

CVE-2026-93056

This vulnerability affects the Linux kernel 's USB gadget f_uac1_legacy driver. The UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for the fn_play, fn_cap, and fn_cntl string options, but its store function contains an inverted null check on the kstrndup() return value. As a result...

CVE-2026-93055

CVE-2026-93055 affects the Linux kernel's UDF filesystem implementation. The vulnerability is an out-of-bounds (OOB) read in the handling of UDF symlinks: udf_symlink_filler() can pass a partial pathComponent header to udf_pc_to_char(), which then reads beyond the available input. The fix validat...

CVE-2026-93054

CVE-2026-93054 is a use-after-free vulnerability in the Linux kernel's UIO (Userspace I/O) driver. After device_add(), the UIO device becomes visible to userspace. If a subsequent setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at a caller-owned stru...

CVE-2026-93053

This Linux kernel vulnerability affects the speakup accessibility subsystem. The function help_init() builds a letter_offsets[] array indexed by (start & 31) - 1, where start is the first byte of a function name. When a root user overrides function names via the sysfs path /sys/accessibility/spea...