CVE-2026-93178

A missing bounds check in the Linux kernel's drm/amdgpu/pm/powerplay subsystem (SMU7) allows the vddInd and vddcInd fields parsed from VBIOS tables to index into voltage lookup tables without validation, potentially causing out-of-bounds reads with high impact on confidentiality and availability ...

CVE-2026-93177

CVE-2026-93177 affects the Linux kernel 's drm/amdgpu/pm/powerplay driver for Vega10 GPUs. The vddInd, vddciInd, and mvddInd indices parsed from VBIOS tables are used to access vddc, vddci, and vddmem lookup tables without bounds checks across nine code sites, allowing an out-of-range index to re...

CVE-2026-93176

CVE-2026-93176 is a dangling pointer vulnerability in the Linux kernel's DRM/AMD display driver, specifically in amdgpu_dm_plane_drm_plane_reset(). The function frees the old plane state before allocating a replacement; if the subsequent kzalloc() call fails, the state pointer is left pointing to...

CVE-2026-93175

CVE-2026-93175 is a dangling pointer (use-after-free) in the Linux kernel's DRM/AMD display driver. The function amdgpu_dm_crtc_reset_state() freed the old CRTC state before allocating a replacement; if kzalloc() failed, the function returned early, leaving a pointer to already-freed memory. The ...

CVE-2026-93173

CVE-2026-93173 affects the Linux kernel BPF LSM subsystem. When a non-sleepable BPF program is freed via __bpf_prog_put_rcu() (a call_rcu() callback), it invokes security_bpf_prog_free(), which in turn calls bpf_prog_free in softirq context. If a sleepable LSM program is attached to the sleepable...

CVE-2026-93174

CVE-2026-93174 affects the Linux kernel BPF subsystem. In copy_map_value_long(), the function passes map->value_size to bpf_obj_memcpy() instead of the correctly padded round_up(map->value_size, 8). When a per-CPU map contains special fields, bpf_obj_memcpy() copies around those fields with...

CVE-2026-93172

CVE-2026-93172 affects the Linux kernel in the mm/mm_init subsystem. The vulnerability is a missing allocation failure check for pgdat->per_cpu_nodestats in free_area_init_core_hotplug(), which results in a NULL pointer dereference when the code attempts to offset into the per-cpu area. The fi...

CVE-2026-93171

CVE-2026-93171 affects the Linux kernel's lp5860 LED driver . The root cause is a potential double-unlock of a mutex in lp5860_device_init(): when lp5860_init_dt() fails, an already-unlocked mutex is unlocked a second time. The fix reworks how the lock is taken and released to avoid this. The fix...

CVE-2026-93170

CVE-2026-93170 is a race condition in the Linux kernel's dmaengine: xilinx_dma driver, affecting the AXIDMA and MCDMA interrupt handlers. When multiple descriptors are queued, an interrupt after partial completion causes the channel to be incorrectly marked idle and start_transfer() to be called ...

CVE-2026-93169

CVE-2026-93169 is a race condition in the Linux kernel's zynqmp_dma DMA engine driver (Zynq MP platform). In the zynqmp_dma_remove() function, runtime PM was disabled only after checking device state and performing a manual suspend. This ordering could race with runtime PM activity during the mod...

CVE-2026-93168

In the Linux kernel , the Xilinx DMA engine driver (xilinx_dma) can cause a CPU stall lasting several minutes when xilinx_dma_poll_timeout is called with delay_us=0 and the polled condition is never met. The root cause is a severe underestimation of wall-clock time in poll_timeout_us_atomic after...

CVE-2026-93167

CVE-2026-93167 affects the Linux kernel on C-SKY ABIv2 architectures. In the syscall trace path , the code adjusts the stack pointer (sp ) before loading the 5th and 6th syscall arguments (a4/a5) from pt_regs . Because those register-save offsets are relative to the original pt_regs base, reading...

CVE-2026-93166

This Linux kernel vulnerability affects the rtw89 Wi-Fi driver, specifically the debug function rtw89_ppdu_str() . The root cause is an off-by-one error : a > comparison should have been >=, allowing an out-of-bounds memory access when processing PDU strings. The fix is provided in kernel p...

CVE-2026-93165

A memory overread in the Linux kernel's Chrome sensorhub driver (platform/chrome/sensorhub) occurs when a malfunctioning EC firmware causes msg->insize to be clamped in cros_ec_cmd_xfer() because it exceeds max_response. The resulting shorter-than-expected read causes a subsequent memcpy() in ...

CVE-2026-93164

CVE-2026-93164 affects the Linux kernel uprobes/x86 subsystem. The root cause is that optimized uprobes installed on a 5-byte NOP could clobber the x86 redzone area : the call instruction used to jump to the uprobe trampoline stores the return address on the stack, potentially overwriting tempora...

CVE-2026-93163

CVE-2026-93163 is a use-after-free vulnerability in the Linux kernel's hardware random number generator (hwrng) core subsystem. The root cause is in hwrng_register(): after adding a new RNG to the global rng_list, if the subsequent attempt to set it as current_rng fails, the function returns an e...

CVE-2026-93162

CVE-2026-93162 affects the Linux kernel crypto: qat subsystem. The root cause is a use-after-free condition: the QAT reset worker queues an SR-IOV re-enable operation using a work_struct and completion embedded in an on-stack adf_sriov_dev_data structure. If the completion wait times out, the res...

CVE-2026-93161

CVE-2026-93161 affects the Linux kernel 's crypto: qat subsystem (Intel Quick Assist Technology crypto driver). The function qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack; the resulting key schedule contains sensitive key material that can remain in the stack frame after ...

CVE-2026-93160

CVE-2026-93160 affects the atmel-ecc crypto driver in the Linux kernel . The hardware ECDH path in atmel_ecdh_compute_shared_secret() could use a private key stored in the device that was not generated for the current tfm , because the function lacked the public-key-cache check already present in...

CVE-2026-93158

In the Linux kernel crypto subsystem, the sa2ul driver contains a flaw where sa_ul_probe() ignores the return value of sa_init_mem() , which creates the DMA pool used for security context buffers. If pool creation fails, the probe continues with DMA setup, algorithm registration, and child popula...