CVE-2026-93820

The Linux kernel is vulnerable to a race condition in the rockchip PCI driver. The root bus removal process fails to hold the pci_rescan_remove_lock while stopping and removing the bus, which can cause conflicts with concurrent rescan or hotplug operations triggered via sysfs . These races may re...

CVE-2026-93819

The Linux kernel contains a vulnerability in the mediatek PCI driver where the pci_rescan_remove_lock is not held while stopping and removing a root bus . This lack of synchronization can lead to races with concurrent rescan or hotplug operations triggered via sysfs , potentially resulting in use...

CVE-2026-93817

The Linux kernel contains a vulnerability within the perf subsystem related to the addr_filter_ranges lifetime. The root cause is that event::addr_filter_ranges is used under RCU but was not being RCU freed correctly. This issue has been resolved in the kernel. No specific exploitation details or...

CVE-2026-93818

The Linux kernel contains a vulnerability in the PCI subsystem where a race condition can occur during the stopping and removal of a root bus. The issue is caused by failing to hold the pci_rescan_remove_lock during these operations, which may lead to use-after-free issues or system crashes when ...

CVE-2026-93816

The Linux kernel contains a vulnerability in the f2fs filesystem where the conversion path fails to validate inline dentry name lengths before copying them out of the inline dentry area. Due to a lack of bounds checking against available filename slots, a corrupted image can cause the system to r...

CVE-2026-93815

A vulnerability exists in the Linux kernel involving the au1000 driver. The au1000_close() function incorrectly calls free_irq() while holding the aup->lock spinlock. Because free_irq() can sleep while acquiring the desc->request_mutex , this violates kernel locking rules and triggers a Loc...

CVE-2026-93814

The Linux kernel contains a vulnerability in the spi: core component where an SPI controller operating in target mode fails to abort an ongoing transfer during system suspend. This oversight can leave hardware in an inconsistent state , potentially leading to system hangs or failures to resume cl...

CVE-2026-93813

The Linux kernel contains a vulnerability in the btrfs file system where a crafted image with a corrupted INODE_REF item can trigger an out-of-boundary access. This occurs because the namelen can exceed the BTRFS_NAME_LEN limit of 255, while the allocated memory for @name remains only 255 bytes. ...

CVE-2026-93812

The Linux kernel 's ksmbd component contains a memory leak vulnerability in the ksmbd_vfs_set_sd_xattr function. The root cause is that ndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc(), but the buffer is not freed if any subsequent ndr_write_*() call returns an error during encoding. The...

CVE-2026-79764

The web-based server management platform Termix versions 2.5.0 through 2.5.1 is vulnerable to an authenticated Server-Side Request Forgery (SSRF) . The /homepage/proxy endpoint accepts a user-provided URL and passes it to http.get or https.get without a destination allowlist. Specifically, the sr...

CVE-2026-93811

The Linux kernel 's ksmbd component contains a memory leak and improper error handling. Specifically, when ndr_decode_v4_ntacl() fails, the acl.sd_buf buffer was leaked because the code skipped the necessary kfree() call. Additionally, the system failed to handle invalid sd_size values correctly,...

CVE-2026-93810

The Linux kernel contains a vulnerability within the cachefiles component. The root cause is a double fput() call occurring during error handling in the cachefiles_create_tmpfile() function. This issue has been resolved in the kernel source. No specific exploit details or in-the-wild exploitation...

CVE-2026-93809

The Linux kernel 's drm/amdgpu component is affected by a vulnerability where the module failed to properly handle RCU callbacks during a module unload. This issue caused the system to attempt to execute late callbacks in freed memory, leading to a page fault and a potential kernel crash. The fix...

CVE-2026-93808

The Linux kernel contains a vulnerability in the ALSA: usb-audio: caiaq driver. The function usb_ep1_command_reply_dispatch() fails to verify if the urb->actual_length is sufficient before reading command-specific fixed items from the URB buffer at offsets such as buf[1] , buf[2] , or buf + 3 ...

CVE-2026-93807

The Linux kernel contains a vulnerability in the wifi: rsi component where the rsi_hal_load_key() function performs unconditional copies of tx_mic_key and rx_mic_key from specific offsets within the key data. Because these offsets are part of the 32-byte TKIP key layout, using shorter keys for ot...

CVE-2026-93806

The Linux kernel contains a vulnerability in the cfg80211 wifi component. The cfg80211_rx_assoc_resp() function incorrectly initializes the status and response-IE fields of cfg80211_connect_resp_params from a management frame before verifying that the frame is long enough to accommodate those off...

CVE-2026-93805

The Linux kernel contains a vulnerability in the cfg80211 component where cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() fail to properly validate the lengths of MLME callback frames before accessing their contents. Specifically, the functions only verify that frames are at least 2 bytes lon...

CVE-2026-93804

The Linux kernel contains a vulnerability in the wifi: mac80211 component related to IBSS (Independent Basic Service Set) disconnection. A cross-CPU race condition exists in ieee80211_ibss_disconnect() because the carrier is turned off and the driver is notified to leave before all in-flight tran...

CVE-2026-93803

The Linux kernel contains a vulnerability in the libipw component where libipw_rx() fails to perform adequate bound checks when extracting the WEP key index . The function reads skb->data[hdrlen + 3], but the existing guard only ensures skb->len >= hdrlen + 3, which does not guarantee th...

CVE-2026-93802

The Linux kernel is affected by a vulnerability in the wifi: rsi component. The rsi_prepare_beacon() function fails to validate the beacon length before copying the mac80211 beacon frame into a management skb. This can lead to a buffer copy issue because the usable tailroom of the skb may be smal...