CVE-2026-93198

CVE-2026-93198 affects the Linux kernel component dm-pcache (device-mapper persistent cache). The writeback worker follows the persisted dirty_tail chain, which is decoded from the cache device independently of the key_tail chain that cache_replay() validates. Because on-media fields are authenti...

CVE-2026-93197

This Linux kernel vulnerability affects memory cgroup (memcg) LRU size accounting . When a memcg is offlined, lruvec_reparent_lru() and lru_gen_reparent_memcg() copy the per-zone lru_zone_size[] to the parent without clearing the child's copy, leaving phantom counters on the dying cgroup. Because...

CVE-2026-93196

A slab-use-after-free vulnerability in the Linux kernel's nvdimm: virtio_pmem subsystem occurs when virtio_pmem_host_ack() wakes a request already freed by the submitter. This happens because the request token remains reachable via the virtqueue after virtio_pmem_flush() returns and frees it. The...

CVE-2026-93195

CVE-2026-93195 affects the Linux kernel component drm/bridge: synopsys: dw-dp (Synopsys DesignWare DisplayPort driver). The DisplayPort AUX channel is initialized and registered during dw_dp_bind() but is never unregistered , which may lead to resource leaks and/or use-after-free when the bridge ...

CVE-2026-93193

CVE-2026-93193 affects the Linux kernel drm/rockchip analogix_dp driver. The vulnerability is a device node reference leak in rockchip_dp_drm_encoder_enable(), caused by of_get_child_by_name() not calling of_node_put() in a symmetric manner. The fix introduces __free(device_node) to automatically...

CVE-2026-93194

CVE-2026-93194 affects the drm/rockchip: dw_dp (DesignWare DisplayPort) driver in the Linux kernel . The root cause is that core resources such as the DisplayPort AUX channel are initialized and registered during dw_dp_bind() but are never unregistered, leading to memory leaks and a confirmed sla...

CVE-2026-93192

CVE-2026-93192 is a dangling pointer vulnerability in the Linux kernel's drm/v3d driver (Broadcom VideoCore IV GPU). The run_job() callbacks for the BIN, RENDER, TFU, and CSD queues assign a job to queue->active_job before calling v3d_fence_create(). If that call fails, the callback returns NU...

CVE-2026-93191

CVE-2026-93191 affects the Linux kernel's SMACK (Security Markup and Labeling Kernel) module. The root cause is in smack_msg_queue_msgrcv(), which incorrectly checks the permissions of the current task rather than the target task. When the pipelined_send() optimization in the msgsnd() syscall pat...

CVE-2026-93190

CVE-2026-93190 affects the Linux kernel platform/chrome: cros_ec_typec driver. The function cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into a fixed 7-element stack array without validating that source_cap_count or sink_cap_count (8-bit fields from the...

CVE-2026-93189

CVE-2026-93189 is a use-after-free in the Linux kernel HID core subsystem. When a driver's probe calls hid_device_io_start() and then fails at a later initialization step, the unwind path hid_hw_stop() frees struct hidraw via hidraw_disconnect() while in-flight HID reports on another CPU may stil...

CVE-2026-93188

CVE-2026-93188 affects the Linux kernel's HID roccat driver . The functions kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device claiming the Ro...

CVE-2026-93186

CVE-2026-93186 affects the Linux kernel CXL mailbox (cxl/mbox) subsystem. The CXL_MEM_SEND_COMMAND ioctl bounds the user-supplied in.size to the mailbox payload size but leaves out.size unbounded. The subsequent call to kvzalloc(out.size) in cxl_mbox_cmd_ctor() allows a user-controlled oversized ...

CVE-2026-93187

CVE-2026-93187 affects the Linux kernel in the ASoC SOF ipc4-topology driver. When the number of input or output audio formats is zero, the functions sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() print an error and jump to the cleanup label, but the return variable ret re...

CVE-2026-93185

CVE-2026-93185 affects the Linux kernel ASoC rt700-sdw driver (Realtek RT700 SoundWire audio codec). The root cause is a work-object lifecycle bug : rt700_sdw_remove() only drains jack_detect_work and jack_btn_check_work when hw_init is true, but that flag is cleared when the SoundWire slave tran...

CVE-2026-93183

CVE-2026-93183 affects the Linux kernel 's DRM Lima GPU driver (drivers/gpu/drm). The root cause is an ordering bug: lima_vm_create() is invoked before va_start and va_end are initialized, so both are zero when passed to drm_mm_init() . When DRM_DEBUG_MM is enabled, the DRM_MM_BUG_ON check fires,...

CVE-2026-93184

CVE-2026-93184 affects the Linux kernel ASoC fsl_audmix driver's runtime PM handling during probe. After pm_runtime_enable(), the AUDMIX audio mixer block remains powered off until the first runtime resume. Register writes issued between probe() and that first resume—originating from DAPM or ALSA...

CVE-2026-93182

CVE-2026-93182 is a u32 overflow in the Linux kernel's CFS scheduler (sched/fair), specifically in update_tg_cfs_runnable(). The overflow occurs when se->avg.runnable_avg * divider exceeds the 32-bit range, corrupting the runnable sum and cascading through load-average propagation to produce a...

CVE-2026-93180

CVE-2026-93180 affects the Linux kernel's drm/panthor GPU driver. A NULL pointer dereference occurs when a GPU memory mapping is split during a partial unmap of an evicted Buffer Object (BO) . The root cause is that the logic handling partial unmap of huge pages was not fully skipped for the VMA ...

CVE-2026-93181

CVE-2026-93181 affects the Linux kernel in the perf/x86/intel/uncore subsystem. The root cause is an incorrect call ordering: in the CPU online path, uncore_box_ref() was invoked before uncore_change_context(), so the gate on box->cpu >= 0 always failed and the uncore box was never initiali...

CVE-2026-93179

This vulnerability affects the Linux kernel in the drm/amd/powerplay subsystem. When the VBIOS supplies a malformed VoltageObjectInfo table, voltage objects whose usSize is smaller than the header or would advance the cursor past the table end are not rejected, causing either an infinite loop (ze...