CVE-2026-97510

The Linux kernel contains a vulnerability in the thunderbolt subsystem within the __tb_xdomain_response() function. If tb_cfg_request() fails to set up a request—for instance, due to a shut-down control channel—it returns an error without invoking the callback, leading to a memory leak . The issu...

CVE-2026-97509

A vulnerability in the Linux kernel 's thunderbolt component was addressed to ensure the XDomain reference is maintained throughout the lifetime of a service. The root cause involved a scenario where the service ID was released in tb_service_release(), while the associated ID array was still owne...

CVE-2026-97508

The Linux kernel contains a vulnerability related to the thunderbolt subsystem. The issue arises because tb->root_switch is not properly set to NULL when a domain is stopped. Fixing this ensures that tb_xdp_handle_request() correctly returns an error to the remote host while maintaining the uu...

CVE-2026-97507

The Linux kernel contains a vulnerability in the dm1105 media driver. Specifically, the function dm1105_hw_init() fails to check the return value of dm1105_dma_map(), which handles DMA memory allocation. If dma_alloc_coherent() fails, the driver continues to use a NULL pointer for DMA transfers, ...

CVE-2026-97506

The Linux kernel contains a vulnerability in the crypto: ixp4xx component where a null-pointer dereference can occur during buffer chain construction. Specifically, if dma_pool_alloc() fails within the chainup_buffers() function, the code incorrectly sets the buffer pointer to NULL and subsequent...

CVE-2026-97505

A vulnerability in the Linux kernel was identified within the PCI/sysfs interface. The __resource_resize_store() function allowed unprivileged users to modify a BAR's size by writing to the resourceN_resize sysfs attribute, as the system previously relied solely on file access checks rather than ...

CVE-2026-97504

The Linux kernel contains a vulnerability in the lenovo_se10_wdt watchdog driver. The issue involves a use-after-free risk and a potential resource leak where the se10_pdev pointer was not properly handled. To address this, the driver was updated to set se10_pdev to null to prevent use-after-free...

CVE-2026-97503

The Linux kernel contains a vulnerability where the /proc/irq// directory names are built using a char name[10] buffer with sprintf(name, "%u", irq). Because sparse-IRQ configurations allow interrupt numbers in the ten-digit range, these numbers require 11 bytes including the trailing NUL, leadin...

CVE-2026-97502

The Linux kernel contains a vulnerability in the mmc_davinci_irq() function within the davinci host controller driver. The root cause is a NULL pointer dereference occurring when host->data is NULL, but specific status bits (such as TOUTRD , CRCWR , or CRCRD ) are set in qstatus. Specifically,...

CVE-2026-97501

The Linux kernel contains a vulnerability in the Mediatek pinctrl driver where pinctrl_gpio_direction_input() and pinctrl_gpio_direction_output() functions take a pinctrl mutex . This causes gpiochip operations to need to sleep, but because the .can_sleep field is not set, the shared GPIO proxy i...

CVE-2026-97500

The Linux kernel contains a vulnerability in the rtw89 wifi driver. The phy component fails to validate the length of the PHY status IE reported by hardware before parsing, which could allow the parser to access out of range memory. The issue has been resolved in the kernel via commits providing ...

CVE-2026-97499

The Linux kernel contains a vulnerability in the coresight: perf component. The issue arises because ETM perf callbacks currently use the per-CPU csdev_src pointer , which is susceptible to a race condition during device registration and unregistration. To resolve this, the fix utilizes the path ...

CVE-2026-97498

The Linux kernel contains a vulnerability in the drm/amdgpu/userq component where mqd and fw objects (queue core objects) were not properly pinned to avoid eviction. If these buffers were evicted while the hardware continued to use the invalid addresses, it resulted in page faults and system hang...

CVE-2026-97497

The Linux kernel contains a vulnerability within the drm/amdkfd component. The allocate_sdma_queue function failed to perform bounds-checking on the restore_sdma_id option, which is used by CRIU . This oversight allowed for the specification of an sdma queue id exceeding the maximum number of que...

CVE-2026-97496

The Linux kernel contains an out-of-bounds (OOB) memory exposure vulnerability in the drm/amdkfd component within the get_wave_state() function for v9. The root cause is that the function trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read from the MQD, which are fully attacker...

CVE-2026-97495

The Linux kernel contains a vulnerability in the drm/amdkfd component where the allocated_doorbell option, used by CRIU to set a specific doorbell id, lacks proper bounds checking. The issue is addressed by confirming that the value is less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS . While the root ...

CVE-2026-97494

The Linux kernel contains a vulnerability in the drm/amdgpu driver related to the psp_copy_fw function. The issue stems from a lack of validation when handling PSP fw_pri_buf copies, where the function previously failed to properly check for errors during drm_dev_enter or validate image sizes. To...

CVE-2026-97493

The Linux kernel contains a vulnerability in the drm/amdgpu driver where the bound GPIO I2C table entry count is sourced from the VBIOS . This can lead to a buffer overrun of adev->i2c_bus[] if the table is undersized or the count is excessively large due to corrupt size fields. The fix involv...

CVE-2026-97492

A vulnerability exists in the Linux kernel 's mac80211 component where calling ieee80211_handle_reconfig_failure during a failed NAN reconfiguration causes all interfaces to be marked as not in the driver. This leads to dangling pointers to objects like stations and links (specifically noted for ...

CVE-2026-97491

The Linux kernel contains a vulnerability in the net/rds component where the rds_ib_conn_path_shutdown function improperly sleeps. Specifically, a shutdown worker thread uses a wait_event call that blocks other work items in the queue, leading to a system hang during the teardown of IB network co...