CVE-2026-93790

The Linux kernel contains an out-of-bounds access vulnerability in the wifi: iwlwifi: mvm component. The issue occurs because mvmsta->tid_data is indexed by the TFD loop counter i instead of the actual tid value, resulting in lq_color being written into a random, unrelated tid_data slot during...

CVE-2026-93791

The Linux kernel (specifically the iwlwifi driver's mvm component) is vulnerable to an out-of-bounds access. The issue stems from the ba_notif->tid value, which is provided by the firmware as a u8 type. Because this value was used directly as an array index into tid_data[] without validation, ...

CVE-2026-93789

The Linux kernel contains a vulnerability in the wifi: iwlwifi driver's firmware parser. The issue is caused by a failure to validate the ALIGN(tlv_len, 4) against the remaining parser length before consuming bytes from a firmware image. This oversight can lead to a length underflow when processi...

CVE-2026-93788

The Linux kernel contains a vulnerability in the iwlwifi driver's ACPI handling. The issue stems from a failure to validate the WGDS table revision index bounds before performing a bitwise shift operation. This oversight occurs when firmware reports an invalid revision value, potentially leading ...

CVE-2026-93787

The Linux kernel contains a vulnerability in the SMB1 client where cifs_filldir() fails to verify if the entry name length provided by a server stays within the bounds of the allocated SMB response buffer. A hostile SMB1 server can return an oversized FileNameLength , causing memchr() to perform ...

CVE-2026-93786

The Linux kernel contains a vulnerability in ksmbd where the VFS would incorrectly handle inherited POSIX ACLs. Specifically, the VFS initialized a child's POSIX ACL from the parent's default ACL and the requested creation mode, but it failed to prevent the mutation of the parent ACL or the overw...

CVE-2026-93785

The Linux kernel contains a vulnerability in the cifs module related to idmap key payload length validation. The cifs.idmap key type stores its payload length in key->datalen, which is limited to U16_MAX . If the system accepts a larger key payload, the recorded length is truncated, causing su...

CVE-2026-93784

A vulnerability exists in the Linux kernel 's cfg80211 component. The function cfg80211_wext_siwgenie() fails to validate the IE buffer stored via SIOCSIWGENIE , leading to an out-of-bounds read in skip_ie() and an integer underflow in memcpy during a subsequent SIOCSIWESSID connection attempt. T...

CVE-2026-93783

The Linux kernel contains a vulnerability in the Bluetooth RFCOMM component within the rfcomm_recv_frame() function. The root cause is a missing length validation when casting skb->data to struct rfcomm_hdr. This allows a truncated frame to trigger an out-of-bounds read of uninitialized memory...

CVE-2026-93782

The Linux kernel contains a vulnerability in vhost-scsi where the software translates guest response descriptors into userspace iovecs during command submission. Because Target-core completes these commands asynchronously, a VHOST_SET_MEM_TABLE operation can replace the memory table while an in-f...

CVE-2026-93781

The Linux kernel contains a vulnerability in the scsi_eh_lock_door() function where it may block on tag allocation during the host recovery state (SHOST_RECOVERY ). Specifically, calling scsi_alloc_request() without the BLK_MQ_REQ_NOWAIT flag can cause a circular dependency: the error handler thr...

CVE-2026-93288

The Linux kernel is affected by a vulnerability in the netfilter: nfnetlink_log component. The root cause involves nfnl_log_net_exit() calling nf_log_unset(), which clears the logger pointer without an RCU grace period . Consequently, ops_free_list() may free the per-net state while concurrent pa...

CVE-2026-93287

The Linux kernel contains a vulnerability where SMBus block transfer lengths are not properly validated in the common path, specifically when using native smbus_xfer implementations. This allows user-controlled oversized block lengths to reach tracepoint memcpy calls and driver callbacks unchecke...

CVE-2026-93286

The Linux kernel contains a NULL pointer dereference vulnerability in the Appletalk network stack. The aarp_send_ddp() function calls atalk_find_dev_addr(dev) without verifying if the device has an AppleTalk interface configured (i.e., dev->atalk_ptr is NULL). This leads to a crash when access...

CVE-2026-93285

The Linux kernel addresses a vulnerability in the f2fs file system. The fix involves embedding f2fs_gc_kthread directly into f2fs_sb_info instead of allocating it dynamically. This structural change simplifies lifetime management and is intended to resolve race conditions that occur during teardo...

CVE-2026-93284

A vulnerability exists in the Linux kernel within the drm/pagemap component. The issue stems from drm_pagemap_migrate_unmap_pages() relying on a pages array to identify pages for DMA unmapping; however, drm_pagemap_migration_unlock_put_pages() clears this array during cleanup, potentially leaving...

CVE-2026-79762

The Termix web-based server management platform (versions 1.7.0 to 2.5.1 ) is vulnerable to credential decryption due to hardcoded default keys. In src/backend/utils/user-crypto.ts, the system derives wrapping keys for OIDC and WebAuthn users' Data Encryption Keys (DEKs) from committed default st...

CVE-2026-79766

The web-based server management platform Termix (versions 2.4.1 through 2.5.0) contains an OS command injection vulnerability in its ACME/Let's Encrypt certificate-request handler. An authenticated administrator can supply attacker-controlled domain and email values via PATCH /users/acme-ssl-sett...

CVE-2026-79759

The web-based server management platform Termix (versions 1.7.0 through 2.5.1) is vulnerable to cross-user information disclosure due to a missing ownership check in the POST /credentials/:id/deploy-to-host endpoint. Located in src/backend/database/routes/credentials.ts, the application fails to ...

CVE-2026-93541

The libXi library, in versions prior to 1.8.4 , is vulnerable to an out-of-bounds read within the XQueryDeviceState() function. This flaw could be exploited by an attacker to impact the system's availability. No specific exploitation details or remediation steps are provided in the documents.