CVE-2026-93816

The Linux kernel contains a vulnerability in the f2fs filesystem where the conversion path fails to validate inline dentry name lengths before copying them out of the inline dentry area. Due to a lack of bounds checking against available filename slots, a corrupted image can cause the system to r...

CVE-2026-93815

A vulnerability exists in the Linux kernel involving the au1000 driver. The au1000_close() function incorrectly calls free_irq() while holding the aup->lock spinlock. Because free_irq() can sleep while acquiring the desc->request_mutex , this violates kernel locking rules and triggers a Loc...

CVE-2026-93814

The Linux kernel contains a vulnerability in the spi: core component where an SPI controller operating in target mode fails to abort an ongoing transfer during system suspend. This oversight can leave hardware in an inconsistent state , potentially leading to system hangs or failures to resume cl...

CVE-2026-93813

The Linux kernel contains a vulnerability in the btrfs file system where a crafted image with a corrupted INODE_REF item can trigger an out-of-boundary access. This occurs because the namelen can exceed the BTRFS_NAME_LEN limit of 255, while the allocated memory for @name remains only 255 bytes. ...

CVE-2026-93812

The Linux kernel 's ksmbd component contains a memory leak vulnerability in the ksmbd_vfs_set_sd_xattr function. The root cause is that ndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc(), but the buffer is not freed if any subsequent ndr_write_*() call returns an error during encoding. The...

CVE-2026-79764

The web-based server management platform Termix versions 2.5.0 through 2.5.1 is vulnerable to an authenticated Server-Side Request Forgery (SSRF) . The /homepage/proxy endpoint accepts a user-provided URL and passes it to http.get or https.get without a destination allowlist. Specifically, the sr...

CVE-2026-93811

The Linux kernel 's ksmbd component contains a memory leak and improper error handling. Specifically, when ndr_decode_v4_ntacl() fails, the acl.sd_buf buffer was leaked because the code skipped the necessary kfree() call. Additionally, the system failed to handle invalid sd_size values correctly,...

CVE-2026-93810

The Linux kernel contains a vulnerability within the cachefiles component. The root cause is a double fput() call occurring during error handling in the cachefiles_create_tmpfile() function. This issue has been resolved in the kernel source. No specific exploit details or in-the-wild exploitation...

CVE-2026-93809

The Linux kernel 's drm/amdgpu component is affected by a vulnerability where the module failed to properly handle RCU callbacks during a module unload. This issue caused the system to attempt to execute late callbacks in freed memory, leading to a page fault and a potential kernel crash. The fix...

CVE-2026-93808

The Linux kernel contains a vulnerability in the ALSA: usb-audio: caiaq driver. The function usb_ep1_command_reply_dispatch() fails to verify if the urb->actual_length is sufficient before reading command-specific fixed items from the URB buffer at offsets such as buf[1] , buf[2] , or buf + 3 ...

CVE-2026-93807

The Linux kernel contains a vulnerability in the wifi: rsi component where the rsi_hal_load_key() function performs unconditional copies of tx_mic_key and rx_mic_key from specific offsets within the key data. Because these offsets are part of the 32-byte TKIP key layout, using shorter keys for ot...

CVE-2026-93806

The Linux kernel contains a vulnerability in the cfg80211 wifi component. The cfg80211_rx_assoc_resp() function incorrectly initializes the status and response-IE fields of cfg80211_connect_resp_params from a management frame before verifying that the frame is long enough to accommodate those off...

CVE-2026-93805

The Linux kernel contains a vulnerability in the cfg80211 component where cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() fail to properly validate the lengths of MLME callback frames before accessing their contents. Specifically, the functions only verify that frames are at least 2 bytes lon...

CVE-2026-93804

The Linux kernel contains a vulnerability in the wifi: mac80211 component related to IBSS (Independent Basic Service Set) disconnection. A cross-CPU race condition exists in ieee80211_ibss_disconnect() because the carrier is turned off and the driver is notified to leave before all in-flight tran...

CVE-2026-93803

The Linux kernel contains a vulnerability in the libipw component where libipw_rx() fails to perform adequate bound checks when extracting the WEP key index . The function reads skb->data[hdrlen + 3], but the existing guard only ensures skb->len >= hdrlen + 3, which does not guarantee th...

CVE-2026-93802

The Linux kernel is affected by a vulnerability in the wifi: rsi component. The rsi_prepare_beacon() function fails to validate the beacon length before copying the mac80211 beacon frame into a management skb. This can lead to a buffer copy issue because the usable tailroom of the skb may be smal...

CVE-2026-93801

The Linux kernel contains a vulnerability in the smb/client component where the stack-allocated cifs_open_info_data is not zero-initialized. This allows the structure to contain random data , potentially causing fields to have incorrect values if they are not explicitly set later. No specific exp...

CVE-2026-93800

The Linux kernel contains a use-after-free (or double free) vulnerability in the btrfs filesystem. The issue occurs when btrfs_update_reloc_root() returns an error during the insert_dirty_subvol() function. This causes a root's reloc_root field to remain pointed at a freed reloc root instead of b...

CVE-2026-93799

The Linux kernel contains a vulnerability in the iwlwifi wireless driver. The function BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from a firmware notification and uses it to index the fw_id_to_mac_id[] array without performing bounds checking . This lack of validation can lead to ou...

CVE-2026-93798

The Linux kernel contains a vulnerability in the btrfs filesystem regarding reloc root cleanup within the merge_reloc_roots() function. The issue occurs when a root with zero root references is processed; the system was resetting the ->reloc_root pointer without utilizing necessary memory barr...