CVE-2026-97917

The Linux kernel contains a vulnerability in the accel/ivpu component. The issue stems from a lack of range validation in the ivpu_to_cpu_addr function. To resolve this, a size parameter was added to ensure that the entire range from vpu_addr to vpu_addr + size remains within the buffer object (B...

CVE-2026-97916

The Linux kernel contains a vulnerability in the accel/ivpu driver related to how firmware log buffer metadata is handled. The tracing log headers are stored in DMA-shared Buffer Objects (BOs) , which the NPU firmware can modify. While fw_log_from_bo() validates the header_size and size fields, f...

CVE-2026-97915

The Linux kernel contains a vulnerability in the accel/ivpu component where the name field in struct vpu_tracing_buffer_header is populated by the NPU firmware. Because the host side does not enforce NUL-termination on this fixed-size array, using an unbounded string conversion can lead to an out...

CVE-2026-97914

In the Linux kernel , a vulnerability was identified in the ethosu accelerator component within the ethosu_job_open() function. The issue occurred because a WARN_ON() macro returned a 0 or 1 instead of the original negative error code (errno), potentially leading to incorrect error reporting to u...

CVE-2026-97913

The Linux kernel contains a vulnerability in the accel: ethosu component. The issue arises because the QSIZE register setting might not guarantee a hardware interrupt to prevent a timeout during an out-of-bounds access of the command stream. To resolve this, the system now ensures that the comman...

CVE-2026-97912

The Linux kernel contains a vulnerability in the ethosu accelerator driver where an SRAM mapping failure does not correctly reset the SRAM size to zero. Because the error return is not checked (as SRAM is not a hard requirement), the probe succeeds while leaving a non-zero size. This allows jobs ...

CVE-2026-97910

The Linux kernel contains a vulnerability in the ASoC: sprd driver where sprd_platform_compr_open() allocates fixed-size buffers (32K IRAM and 2M DDR) that are not properly validated against user-controlled inputs. Specifically, sprd_platform_compr_copy() derives copy lengths from runtime->fra...

CVE-2026-97911

The Linux kernel contains a vulnerability in the accel: ethosu driver where userspace can set a job's SRAM size to 0 while maintaining SRAM accesses in the command stream. Because the region base register is skipped when the size is 0, the system may use a stale base address from a previous job. ...

CVE-2026-97909

The Linux kernel contains a vulnerability in the ASoC (Android Simple Open Source Audio Configuration) component where the uni_reader_init() function registers a shared IRQ before initializing the reader->irq_lock. This race condition allows a pending interrupt to invoke the handler while the ...

CVE-2026-97908

The Linux kernel contains a vulnerability in the btqcomsmd Bluetooth driver where RPMsg endpoints are destroyed after the hci_dev is freed. Because receive callbacks dereference btq->hdev without taking a reference, a window exists where WCNSS data delivery can cause the callback to run with a...

CVE-2026-97907

The Linux kernel contains a vulnerability in the Bluetooth btrtl component within the rtlbt_parse_firmware_v2() function. When the key_id from the chip is zero, the function is intended to ignore security headers; however, it incorrectly breaks from a switch statement, causing it to leak an unini...

CVE-2026-97906

The Linux kernel is affected by an integer overflow vulnerability within the get_boot_config_from_initrd() function. A crafted initrd with an excessively large bootconfig size (e.g., 0xFFFFFFFF) causes pointer arithmetic to wrap around, specifically when calculating data = ((void *)hdr) - size. T...

CVE-2026-97905

The Linux kernel contains a vulnerability in the cpufreq component where policy->cpus is allocated without being zero-initialized when CONFIG_CPUMASK_OFFSTACK=y is enabled. Because alloc_cpumask_var() does not guarantee zeroing, the bitmap may contain garbage data from the slab allocator. This...

CVE-2026-97904

The Linux kernel contains a vulnerability where cpufreq_policy_alloc() initializes the policy->rwsem semaphore after kobject_init_and_add() has already created the policy sysfs directory and its default attributes. This timing issue allows a sysfs access to reach a policy callback before the s...

CVE-2026-97903

The Linux kernel is vulnerable to a slab-use-after-free issue due to an incorrect assumption in the release_task function. Specifically, the system failed to hold a proper reference to thread_pid across proc_flush_pid(). If another task uses the exiting task's PID as a process group or session ID...

CVE-2026-97902

The Linux kernel contains a vulnerability where thaw_super_locked() incorrectly returns -EINVAL when a nested thaw succeeds but other holders remain. This misinforms callers, specifically breaking bdev-initiated freezing . When a filesystem is frozen via FIFREEZE and nested via bdev_freeze(), the...

CVE-2026-97901

The Linux kernel contains a vulnerability in the generic netlink controller where the policy dump keeps pointers to a target family's operation and policy tables in its callback state. Because Netlink only pins the module owning the dump callback (the controller's owner) rather than the target fa...

CVE-2026-97900

The Linux kernel contains a vulnerability in the drm/drm_exec component where drm_exec_prepare_array() fails to call drm_exec_lock_contended() when num_objects is zero. This oversight breaks the locking invariant required by drm_exec_lock_obj() . Specifically, drivers that chain multiple calls, s...

CVE-2026-97899

The Linux kernel contains a memory leak vulnerability within the drm/i915 driver, specifically inside the query_perf_config_list() function. The root cause occurs when krealloc() fails, as the original oa_config_ids are not freed before returning, leading to a memory leak. The issue has been reso...

CVE-2026-97620

The Linux kernel contains a vulnerability in the drm/xe driver where the emit_render_cache_flush() function failed to request a flush of the LSC untyped L1 dataport cache . While HDC Pipeline Flush was historically expected to handle this, newer platforms like MTL and BMG no longer maintain this ...