CVE-2026-93081

CVE-2026-93081 affects the Linux kernel 's firmware: arm_scmi driver, specifically the SCMI device destroy path. The root cause is that scmi_child_dev_find() drops the reference returned by device_find_child() before returning the scmi_device pointer, so a concurrent unregister can release the de...

CVE-2026-93079

CVE-2026-93079 is a heap out-of-bounds write in the Linux kernel's CXL subsystem. In cxlctl_get_feature(), the output buffer is sized from the user-supplied fwctl_rpc.out_len, but the device is instructed to write cxl_mbox_get_feat_in.count bytes into that buffer. Because count is a separate user...

CVE-2026-93078

CVE-2026-93078 is a vulnerability in the Linux kernel 's cxl/features subsystem. The function cxlctl_set_feature() sizes its output buffer from the user-supplied fwctl_rpc.out_len without verifying it is large enough to hold the fwctl_rpc_cxl_out header. When out_len is zero, kvzalloc() returns Z...

CVE-2026-93077

CVE-2026-93077 affects the Linux kernel CXL (Compute Express Link) subsystem, specifically the cxl_get_feature() function in the cxl/features code. The function reads a device feature in a loop but passes a fixed output size as the capacity on every iteration. On the last partial iteration, the b...

CVE-2026-93076

CVE-2026-93076 affects the Linux kernel 's DAX (Direct Access) driver subsystem, specifically the fsdev_dax path for static devices. When a static DAX device is rebound from device_dax to fsdev_dax , a stale vmemmap_shift value—set by device_dax based on alignment—persists on the shared pgmap str...

CVE-2026-93074

CVE-2026-93074 affects the Linux kernel 's dax/fsdev subsystem. The root cause is in __fsdev_dax_direct_access(), which computed the kernel virtual address by adding a device-linear byte offset to virt_addr (the direct-map address of ranges[0]). For multi-range devices with physical gaps between ...

CVE-2026-93075

CVE-2026-93075 is a Linux kernel vulnerability in the dax/fsdev subsystem. When fsdev_dax_probe() sets pgmap->ops and pgmap->owner, these fields are never cleared on unbind for static devices . Because the shared pgmap is long-lived (owned by the dax bus), stale fsdev_pagemap_ops persist af...

CVE-2026-93073

This TOCTOU race condition affects the Linux kernel DAX subsystem in the dax_holder_notify_failure() function. The function reads dax_dev->holder_ops twice without READ_ONCE()—once for a NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops ...

CVE-2026-93071

CVE-2026-93071 is a memory leak in the Linux kernel's bcm2835-unicam media driver. The function v4l2_async_nf_add_fwnode_remote() allocates an async sub-device (asc) object that is only freed when v4l2_async_nf_cleanup() is called, but that cleanup was not invoked in the driver's error and remove...

CVE-2026-93072

CVE-2026-93072 affects the Linux kernel irqchip/renesas-irqc driver. During probe, the driver allocates generic interrupt chips in the interrupt domain but fails to set the IRQ_DOMAIN_FLAG_DESTROY_GC flag. On driver removal, the generic chips are therefore not freed, causing a resource leak . Bec...

CVE-2026-93070

CVE-2026-93070 is a double-free vulnerability in the Linux kernel's Intel IPU6 media driver (media: ipu6). After ipu6_bus_initialize_device() stores the isys/psys pdata pointer and initializes the auxiliary device, error-unwinding paths in the callers perform an extra kfree(pdata). Since the auxi...

CVE-2026-93069

CVE-2026-93069 affects the Linux kernel OPP (Operating Performance Points) subsystem . A prior commit (173e02d67494) changed the initialization order so that *opp_table was initialized after *opp, which reversed the order of registered cleanup functions. This can cause a use-after-free in _opp_kr...

CVE-2026-93067

CVE-2026-93067 affects the Linux kernel's tc358767 DRM bridge driver. In tc_aux_read_data(), the byte count reported by the controller via the AUX_BYTES field (which can be up to 255) is used directly to read into a 16-byte stack buffer (auxrdata) and then copied to the caller buffer, without cla...

CVE-2026-93068

CVE-2026-93068 is a teardown ordering race in the Linux kernel's AMD GPU display driver (drm/amd/display). DM I2C adapters can remain visible to userspace while display manager (DM) teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpu_dm_i2c_xfer() after the backin...

CVE-2026-93066

CVE-2026-93066 is a use-after-free in the Linux kernel's x86/mm/pat (page-attribute-table) subsystem. A race between cpa_collapse_large_pages() and __change_page_attr() allows a concurrent walker to write through a stale PTE pointer into a freed page-table page. The race is triggered when concurr...

CVE-2026-93064

This is a Linux kernel vulnerability in the iwlwifi mvm driver (Intel wireless). The root cause is an off-by-one error in iwl_mvm_frob_txf_key_iter(), the TXF key sanitiser. When a full key match is found, the memset start offset uses i - keylen instead of the correct i + 1 - keylen, which zeroes...

CVE-2026-93065

CVE-2026-93065 affects the Linux kernel iwlwifi driver. The vulnerability resides in the iwl_fwrt_dump_error_logs function, where the loop counter variable count was declared as u8 while num_pc is of type u32 . If the firmware advertises more than 255 program counter (PC) entries, the 8-bit count...

CVE-2026-93063

CVE-2026-93063 is a buffer overflow in the Linux kernel's iwlwifi MEI (Manageable Event Interface) driver. The root cause is a missing length validation: the size of a received SAP message was not checked against the local buffer before being read, allowing an oversized message to overflow the bu...

CVE-2026-93062

CVE-2026-93062 affects the Linux kernel in the iwlwifi wireless driver. The vulnerability is a division by zero in the function iwl_dbg_tlv_alloc_fragments, which can occur when num_frags evaluates to zero. The fix introduces a check that the required size is non-zero and adds a guard on num_frag...

CVE-2026-93061

CVE-2026-93061 is a stack over-read in the Linux kernel's host1x GPU driver . The functions host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed to the output callbac...