CVE-2026-93174

CVE-2026-93174 affects the Linux kernel BPF subsystem. In copy_map_value_long(), the function passes map->value_size to bpf_obj_memcpy() instead of the correctly padded round_up(map->value_size, 8). When a per-CPU map contains special fields, bpf_obj_memcpy() copies around those fields with...

CVE-2026-93172

CVE-2026-93172 affects the Linux kernel in the mm/mm_init subsystem. The vulnerability is a missing allocation failure check for pgdat->per_cpu_nodestats in free_area_init_core_hotplug(), which results in a NULL pointer dereference when the code attempts to offset into the per-cpu area. The fi...

CVE-2026-93171

CVE-2026-93171 affects the Linux kernel's lp5860 LED driver . The root cause is a potential double-unlock of a mutex in lp5860_device_init(): when lp5860_init_dt() fails, an already-unlocked mutex is unlocked a second time. The fix reworks how the lock is taken and released to avoid this. The fix...

CVE-2026-93170

CVE-2026-93170 is a race condition in the Linux kernel's dmaengine: xilinx_dma driver, affecting the AXIDMA and MCDMA interrupt handlers. When multiple descriptors are queued, an interrupt after partial completion causes the channel to be incorrectly marked idle and start_transfer() to be called ...

CVE-2026-93169

CVE-2026-93169 is a race condition in the Linux kernel's zynqmp_dma DMA engine driver (Zynq MP platform). In the zynqmp_dma_remove() function, runtime PM was disabled only after checking device state and performing a manual suspend. This ordering could race with runtime PM activity during the mod...

CVE-2026-93168

In the Linux kernel , the Xilinx DMA engine driver (xilinx_dma) can cause a CPU stall lasting several minutes when xilinx_dma_poll_timeout is called with delay_us=0 and the polled condition is never met. The root cause is a severe underestimation of wall-clock time in poll_timeout_us_atomic after...

CVE-2026-93167

CVE-2026-93167 affects the Linux kernel on C-SKY ABIv2 architectures. In the syscall trace path , the code adjusts the stack pointer (sp ) before loading the 5th and 6th syscall arguments (a4/a5) from pt_regs . Because those register-save offsets are relative to the original pt_regs base, reading...

CVE-2026-93166

This Linux kernel vulnerability affects the rtw89 Wi-Fi driver, specifically the debug function rtw89_ppdu_str() . The root cause is an off-by-one error : a > comparison should have been >=, allowing an out-of-bounds memory access when processing PDU strings. The fix is provided in kernel p...

CVE-2026-93165

A memory overread in the Linux kernel's Chrome sensorhub driver (platform/chrome/sensorhub) occurs when a malfunctioning EC firmware causes msg->insize to be clamped in cros_ec_cmd_xfer() because it exceeds max_response. The resulting shorter-than-expected read causes a subsequent memcpy() in ...

CVE-2026-93164

CVE-2026-93164 affects the Linux kernel uprobes/x86 subsystem. The root cause is that optimized uprobes installed on a 5-byte NOP could clobber the x86 redzone area : the call instruction used to jump to the uprobe trampoline stores the return address on the stack, potentially overwriting tempora...

CVE-2026-93163

CVE-2026-93163 is a use-after-free vulnerability in the Linux kernel's hardware random number generator (hwrng) core subsystem. The root cause is in hwrng_register(): after adding a new RNG to the global rng_list, if the subsequent attempt to set it as current_rng fails, the function returns an e...

CVE-2026-93162

CVE-2026-93162 affects the Linux kernel crypto: qat subsystem. The root cause is a use-after-free condition: the QAT reset worker queues an SR-IOV re-enable operation using a work_struct and completion embedded in an on-stack adf_sriov_dev_data structure. If the completion wait times out, the res...

CVE-2026-93161

CVE-2026-93161 affects the Linux kernel 's crypto: qat subsystem (Intel Quick Assist Technology crypto driver). The function qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack; the resulting key schedule contains sensitive key material that can remain in the stack frame after ...

CVE-2026-93160

CVE-2026-93160 affects the atmel-ecc crypto driver in the Linux kernel . The hardware ECDH path in atmel_ecdh_compute_shared_secret() could use a private key stored in the device that was not generated for the current tfm , because the function lacked the public-key-cache check already present in...

CVE-2026-93158

In the Linux kernel crypto subsystem, the sa2ul driver contains a flaw where sa_ul_probe() ignores the return value of sa_init_mem() , which creates the DMA pool used for security context buffers. If pool creation fails, the probe continues with DMA setup, algorithm registration, and child popula...

CVE-2026-93159

CVE-2026-93159 affects the atmel-sha204a hardware RNG driver in the Linux kernel . In the nonblocking RNG path, a work_data structure is allocated to track in-flight asynchronous I2C requests and stored in rng->priv. If the I2C transfer fails, the previous code only logged a warning but left t...

CVE-2026-93157

CVE-2026-93157 affects the xilinx-trng hardware random number generator driver in the Linux kernel . The root cause is in xtrng_readblock32(), which polls for 16-byte chunks but returns the byte count even when the first poll times out. The caller then treats a zero return as a short successful r...

CVE-2026-93156

This Linux kernel vulnerability affects the rk3288 crypto hash driver. In rk_hash_run(), the driver waits for the RK_CRYPTO_HASH_STS status to become idle after the final DMA transfer but ignores the poll result . If the hash engine never becomes idle, the driver proceeds to read the digest regis...

CVE-2026-93154

CVE-2026-93154 is a use-after-free vulnerability in the Linux kernel's RDMA/irdma subsystem. The root cause is the absence of refcounting on user-space ring Memory Regions (MRs) : userspace could deregister the MRs backing QP, CQ, or SRQ rings while they were still in use. The fix bumps the MR's ...

CVE-2026-93155

In the Linux kernel , the Keembay crypto driver contains a bug in the register_aes_algs() function's error handling path. When skcipher algorithm registration fails, the function unwinds the earlier AEAD registration by calling crypto_engine_unregister_aeads() but incorrectly passes ARRAY_SIZE(al...