CVE-2026-93202

CVE-2026-93202 is a deadlock vulnerability in the Linux kernel i3c master driver. The function i3c_master_register_new_i3c_devs() calls device_register() while holding i3c_bus_normaluse_lock() (a read-side rwsem). The resulting device probe callback may invoke I3C helpers that re-acquire the same...

CVE-2026-93203

CVE-2026-93203 is a race condition in the Linux kernel's batman-adv mesh networking module, specifically in the Bridge Loop Avoidance (BLA) subsystem. The function batadv_bla_add_claim() can corrupt the CRC16 of backbone gateway entries when a new claim and a backbone ownership change execute in ...

CVE-2026-93201

CVE-2026-93201 affects the Linux kernel dm-pcache (persistent cache) subsystem. The functions cache_pos_decode(), cache_key_decode(), and the last-kset branches of cache_replay(), the writeback worker, and the GC worker index cache->segments[] using a segment ID read from on-disk metadata with...

CVE-2026-93200

CVE-2026-93200 affects the Linux kernel's i3c (Improved Inter-chip) master controller driver. The root cause is a use-after-free of the master->this pointer: it is freed in i3c_master_detach_free_devs() before the master device itself is released, yet sysfs attribute callbacks still dereferenc...

CVE-2026-93199

Linux kernel i3c master driver contains a logic flaw in the function i3c_master_search_i3c_dev_duplicate(). The function searches the I3C bus for another device sharing the same PID as a reference device, but can incorrectly match master->this—the I3C controller itself. Since the controller is...

CVE-2026-93198

CVE-2026-93198 affects the Linux kernel component dm-pcache (device-mapper persistent cache). The writeback worker follows the persisted dirty_tail chain, which is decoded from the cache device independently of the key_tail chain that cache_replay() validates. Because on-media fields are authenti...

CVE-2026-93196

A slab-use-after-free vulnerability in the Linux kernel's nvdimm: virtio_pmem subsystem occurs when virtio_pmem_host_ack() wakes a request already freed by the submitter. This happens because the request token remains reachable via the virtqueue after virtio_pmem_flush() returns and frees it. The...

CVE-2026-93197

This Linux kernel vulnerability affects memory cgroup (memcg) LRU size accounting . When a memcg is offlined, lruvec_reparent_lru() and lru_gen_reparent_memcg() copy the per-zone lru_zone_size[] to the parent without clearing the child's copy, leaving phantom counters on the dying cgroup. Because...

CVE-2026-93195

CVE-2026-93195 affects the Linux kernel component drm/bridge: synopsys: dw-dp (Synopsys DesignWare DisplayPort driver). The DisplayPort AUX channel is initialized and registered during dw_dp_bind() but is never unregistered , which may lead to resource leaks and/or use-after-free when the bridge ...

CVE-2026-93193

CVE-2026-93193 affects the Linux kernel drm/rockchip analogix_dp driver. The vulnerability is a device node reference leak in rockchip_dp_drm_encoder_enable(), caused by of_get_child_by_name() not calling of_node_put() in a symmetric manner. The fix introduces __free(device_node) to automatically...

CVE-2026-93194

CVE-2026-93194 affects the drm/rockchip: dw_dp (DesignWare DisplayPort) driver in the Linux kernel . The root cause is that core resources such as the DisplayPort AUX channel are initialized and registered during dw_dp_bind() but are never unregistered, leading to memory leaks and a confirmed sla...

CVE-2026-93192

CVE-2026-93192 is a dangling pointer vulnerability in the Linux kernel's drm/v3d driver (Broadcom VideoCore IV GPU). The run_job() callbacks for the BIN, RENDER, TFU, and CSD queues assign a job to queue->active_job before calling v3d_fence_create(). If that call fails, the callback returns NU...

CVE-2026-93191

CVE-2026-93191 affects the Linux kernel's SMACK (Security Markup and Labeling Kernel) module. The root cause is in smack_msg_queue_msgrcv(), which incorrectly checks the permissions of the current task rather than the target task. When the pipelined_send() optimization in the msgsnd() syscall pat...

CVE-2026-93190

CVE-2026-93190 affects the Linux kernel platform/chrome: cros_ec_typec driver. The function cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into a fixed 7-element stack array without validating that source_cap_count or sink_cap_count (8-bit fields from the...

CVE-2026-93189

CVE-2026-93189 is a use-after-free in the Linux kernel HID core subsystem. When a driver's probe calls hid_device_io_start() and then fails at a later initialization step, the unwind path hid_hw_stop() frees struct hidraw via hidraw_disconnect() while in-flight HID reports on another CPU may stil...

CVE-2026-93188

CVE-2026-93188 affects the Linux kernel's HID roccat driver . The functions kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device claiming the Ro...

CVE-2026-93186

CVE-2026-93186 affects the Linux kernel CXL mailbox (cxl/mbox) subsystem. The CXL_MEM_SEND_COMMAND ioctl bounds the user-supplied in.size to the mailbox payload size but leaves out.size unbounded. The subsequent call to kvzalloc(out.size) in cxl_mbox_cmd_ctor() allows a user-controlled oversized ...

CVE-2026-93187

CVE-2026-93187 affects the Linux kernel in the ASoC SOF ipc4-topology driver. When the number of input or output audio formats is zero, the functions sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() print an error and jump to the cleanup label, but the return variable ret re...

CVE-2026-93185

CVE-2026-93185 affects the Linux kernel ASoC rt700-sdw driver (Realtek RT700 SoundWire audio codec). The root cause is a work-object lifecycle bug : rt700_sdw_remove() only drains jack_detect_work and jack_btn_check_work when hw_init is true, but that flag is cleared when the SoundWire slave tran...

CVE-2026-93183

CVE-2026-93183 affects the Linux kernel 's DRM Lima GPU driver (drivers/gpu/drm). The root cause is an ordering bug: lima_vm_create() is invoked before va_start and va_end are initialized, so both are zero when passed to drm_mm_init() . When DRM_DEBUG_MM is enabled, the DRM_MM_BUG_ON check fires,...