CVE-2026-93813

The Linux kernel contains a vulnerability in the btrfs file system where a crafted image with a corrupted INODE_REF item can trigger an out-of-boundary access. This occurs because the namelen can exceed the BTRFS_NAME_LEN limit of 255, while the allocated memory for @name remains only 255 bytes. ...

CVE-2026-93812

The Linux kernel 's ksmbd component contains a memory leak vulnerability in the ksmbd_vfs_set_sd_xattr function. The root cause is that ndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc(), but the buffer is not freed if any subsequent ndr_write_*() call returns an error during encoding. The...

CVE-2026-79764

The web-based server management platform Termix versions 2.5.0 through 2.5.1 is vulnerable to an authenticated Server-Side Request Forgery (SSRF) . The /homepage/proxy endpoint accepts a user-provided URL and passes it to http.get or https.get without a destination allowlist. Specifically, the sr...

CVE-2026-93811

The Linux kernel 's ksmbd component contains a memory leak and improper error handling. Specifically, when ndr_decode_v4_ntacl() fails, the acl.sd_buf buffer was leaked because the code skipped the necessary kfree() call. Additionally, the system failed to handle invalid sd_size values correctly,...

CVE-2026-93810

The Linux kernel contains a vulnerability within the cachefiles component. The root cause is a double fput() call occurring during error handling in the cachefiles_create_tmpfile() function. This issue has been resolved in the kernel source. No specific exploit details or in-the-wild exploitation...

CVE-2026-93809

The Linux kernel 's drm/amdgpu component is affected by a vulnerability where the module failed to properly handle RCU callbacks during a module unload. This issue caused the system to attempt to execute late callbacks in freed memory, leading to a page fault and a potential kernel crash. The fix...

CVE-2026-93808

The Linux kernel contains a vulnerability in the ALSA: usb-audio: caiaq driver. The function usb_ep1_command_reply_dispatch() fails to verify if the urb->actual_length is sufficient before reading command-specific fixed items from the URB buffer at offsets such as buf[1] , buf[2] , or buf + 3 ...

CVE-2026-93807

The Linux kernel contains a vulnerability in the wifi: rsi component where the rsi_hal_load_key() function performs unconditional copies of tx_mic_key and rx_mic_key from specific offsets within the key data. Because these offsets are part of the 32-byte TKIP key layout, using shorter keys for ot...

CVE-2026-93806

The Linux kernel contains a vulnerability in the cfg80211 wifi component. The cfg80211_rx_assoc_resp() function incorrectly initializes the status and response-IE fields of cfg80211_connect_resp_params from a management frame before verifying that the frame is long enough to accommodate those off...

CVE-2026-93805

The Linux kernel contains a vulnerability in the cfg80211 component where cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() fail to properly validate the lengths of MLME callback frames before accessing their contents. Specifically, the functions only verify that frames are at least 2 bytes lon...

CVE-2026-93804

The Linux kernel contains a vulnerability in the wifi: mac80211 component related to IBSS (Independent Basic Service Set) disconnection. A cross-CPU race condition exists in ieee80211_ibss_disconnect() because the carrier is turned off and the driver is notified to leave before all in-flight tran...

CVE-2026-93803

The Linux kernel contains a vulnerability in the libipw component where libipw_rx() fails to perform adequate bound checks when extracting the WEP key index . The function reads skb->data[hdrlen + 3], but the existing guard only ensures skb->len >= hdrlen + 3, which does not guarantee th...

CVE-2026-93802

The Linux kernel is affected by a vulnerability in the wifi: rsi component. The rsi_prepare_beacon() function fails to validate the beacon length before copying the mac80211 beacon frame into a management skb. This can lead to a buffer copy issue because the usable tailroom of the skb may be smal...

CVE-2026-93801

The Linux kernel contains a vulnerability in the smb/client component where the stack-allocated cifs_open_info_data is not zero-initialized. This allows the structure to contain random data , potentially causing fields to have incorrect values if they are not explicitly set later. No specific exp...

CVE-2026-93800

The Linux kernel contains a use-after-free (or double free) vulnerability in the btrfs filesystem. The issue occurs when btrfs_update_reloc_root() returns an error during the insert_dirty_subvol() function. This causes a root's reloc_root field to remain pointed at a freed reloc root instead of b...

CVE-2026-93799

The Linux kernel contains a vulnerability in the iwlwifi wireless driver. The function BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from a firmware notification and uses it to index the fw_id_to_mac_id[] array without performing bounds checking . This lack of validation can lead to ou...

CVE-2026-93798

The Linux kernel contains a vulnerability in the btrfs filesystem regarding reloc root cleanup within the merge_reloc_roots() function. The issue occurs when a root with zero root references is processed; the system was resetting the ->reloc_root pointer without utilizing necessary memory barr...

CVE-2026-93797

The Linux kernel contains a vulnerability in the wifi: iwlwifi: mvm component caused by an off-by-1 boundary check . The issue occurs because the system fails to verify if the length is sufficient before accessing the 11th byte. A fix has been developed and is documented in the provided kernel st...

CVE-2026-93796

The Linux kernel contains a vulnerability in the iwlwifi driver involving null RX pointers after free . When iwl_pcie_tx_init() fails after the RX initialization, the NIC initialization unwinds via iwl_pcie_rx_free(). However, the freed RX members remained non-NULL on the live transport object, p...

CVE-2026-93795

The Linux kernel contains a vulnerability in blk-cgroup where a failure in radix_tree_insert() during blkg_create() leads to memory leaks and incorrect state handling. Specifically, the blkg->online flag is set to true even on failure, and the error path fails to call percpu_ref_kill() before ...