CVE-2026-97929

The Linux kernel contains a vulnerability in the ALSA: usbusx2y driver within the i_usx2y_in04_int() function. The driver fails to validate urb->actual_length , allowing a malfunctioning device to trigger a short transfer. This causes the handler to process uninitialized heap data from the kma...

CVE-2026-97928

The Linux kernel contains a vulnerability in the drm/amdgpu driver where the amdgpu_ttm_map_buffer() function incorrectly forces a VMID 0 flush when performing a clear-on-release on VRAM . Because VRAM is accessed via a direct memory controller (MC) address without a programmed GART window , this...

CVE-2026-97927

The Linux kernel contains a vulnerability in the ufs filesystem where ufs_fill_super() installs the root dentry before successfully loading cylinder group structures for writable mounts. If ufs_read_cylinder_structures() fails, the error path frees the in-core superblock information and sets sb-&...

CVE-2026-97926

The Linux kernel contains a vulnerability in the ufs filesystem where ufs_read_cylinder() copies cylinder group index and rotor positions from on-disk groups into cache without validation. A crafted image can set these values to trigger out-of-bounds access during allocation or free operations. S...

CVE-2026-97925

A race condition exists in the Linux kernel during the replacement of a broadcast device . The issue occurs because tick_install_broadcast_device() is not serialized against concurrent tick broadcast operations. Specifically, a race between __tick_broadcast_oneshot_control() and tick_install_broa...

CVE-2026-97923

The Linux kernel contains a memory leak vulnerability within the tracing subsystem. Specifically, the create_var_ref() function allocates a VAR_REF hist_field and calls init_var_ref() to populate it. If init_var_ref() fails, the allocated field is leaked because it is not added to the trigger's v...

CVE-2026-97924

The Linux kernel contains a vulnerability in the tracing/user_events component. The destroy_user_event() function incorrectly destroys an event's fields before attempting to remove the trace event call. If the removal fails (e.g., returning -EBUSY because the event is still enabled), the event re...

CVE-2026-97922

The Linux kernel contains a memory leak vulnerability in the tracing subsystem. Specifically, using the same variable three or more times in a single hist trigger causes the variable reference and its associated strings to leak when the trigger is removed. The root cause is that while repeated re...

CVE-2026-97921

The Linux kernel contains a memory leak in the tracing subsystem. When creating a histogram trigger with a value or variable carrying an invalid modifier, the kernel identifies the error but fails to free the allocated field because it is skipped during the store operation. This results in unrefe...

CVE-2026-97920

The Linux kernel contains a vulnerability where the print_entries() function incorrectly handles memory allocation failures. When a histogram stats allocation fails, the variable n_entries is overwritten with -ENOMEM. Because tracing_map_destroy_sort_entries() treats this value as an unsigned int...

CVE-2026-97919

A slab-use-after-free vulnerability exists in the Linux kernel tracing subsystem. The issue occurs in event_hist_trigger_named_init() because the function publishes a trigger to the global named_triggers list before ensuring the subsequent initialization (event_hist_trigger_init()) succeeds. If a...

CVE-2026-97918

A slab-use-after-free vulnerability exists in the Linux kernel tracing subsystem. The issue occurs because a trigger registered during a failed hist_trigger_enable() operation remains on the global named_triggers list but is not on the file->triggers list. This causes hist_unregister_trigger()...

CVE-2026-97917

The Linux kernel contains a vulnerability in the accel/ivpu component. The issue stems from a lack of range validation in the ivpu_to_cpu_addr function. To resolve this, a size parameter was added to ensure that the entire range from vpu_addr to vpu_addr + size remains within the buffer object (B...

CVE-2026-97916

The Linux kernel contains a vulnerability in the accel/ivpu driver related to how firmware log buffer metadata is handled. The tracing log headers are stored in DMA-shared Buffer Objects (BOs) , which the NPU firmware can modify. While fw_log_from_bo() validates the header_size and size fields, f...

CVE-2026-97915

The Linux kernel contains a vulnerability in the accel/ivpu component where the name field in struct vpu_tracing_buffer_header is populated by the NPU firmware. Because the host side does not enforce NUL-termination on this fixed-size array, using an unbounded string conversion can lead to an out...

CVE-2026-97914

In the Linux kernel , a vulnerability was identified in the ethosu accelerator component within the ethosu_job_open() function. The issue occurred because a WARN_ON() macro returned a 0 or 1 instead of the original negative error code (errno), potentially leading to incorrect error reporting to u...

CVE-2026-97913

The Linux kernel contains a vulnerability in the accel: ethosu component. The issue arises because the QSIZE register setting might not guarantee a hardware interrupt to prevent a timeout during an out-of-bounds access of the command stream. To resolve this, the system now ensures that the comman...

CVE-2026-97912

The Linux kernel contains a vulnerability in the ethosu accelerator driver where an SRAM mapping failure does not correctly reset the SRAM size to zero. Because the error return is not checked (as SRAM is not a hard requirement), the probe succeeds while leaving a non-zero size. This allows jobs ...

CVE-2026-97910

The Linux kernel contains a vulnerability in the ASoC: sprd driver where sprd_platform_compr_open() allocates fixed-size buffers (32K IRAM and 2M DDR) that are not properly validated against user-controlled inputs. Specifically, sprd_platform_compr_copy() derives copy lengths from runtime->fra...

CVE-2026-97911

The Linux kernel contains a vulnerability in the accel: ethosu driver where userspace can set a job's SRAM size to 0 while maintaining SRAM accesses in the command stream. Because the region base register is skipped when the size is 0, the system may use a stale base address from a previous job. ...