CVE-2026-92490

CVE-2026-92490 affects the Linux kernel firmware/arm_scmi driver. The root cause is a use-after-free condition: scmi_driver_register() requests protocol devices before registering the driver. If driver_register() subsequently fails, those requests remain in the global IDR and retain pointers to t...

CVE-2026-92489

CVE-2026-92489 is a skb double-free vulnerability in the Linux kernel's xfrm subsystem. In xfrm_dev_direct_output(), when local_out() returns a value other than 1 (indicating the socket buffer was consumed or its ownership transferred, e.g., when netfilter drops the packet), the function still fr...

CVE-2026-92487

CVE-2026-92487 is a race condition in the Linux kernel's exfat filesystem . When a shared writable mapping has its valid_size extended (via a buffered write or page fault), exfat zeroes the page-cache gap below the new valid_size. A concurrent store through the mapping can race with this zeroing ...

CVE-2026-92488

CVE-2026-92488 is a resource-leak vulnerability in the Linux kernel's RDMA/erdma subsystem. The destructor functions erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() returned early when erdma_post_cmd_wait() failed, leaking queue buffers, MTTs, doorbells, and hardw...

CVE-2026-92486

CVE-2026-92486 affects the Linux kernel BPF subsystem. The root cause is a kCFI (kernel Control Flow Integrity) mismatch : BPF subprograms use the bpf_callback_t ABI, but the task work mechanism invokes the callback through a three-argument function pointer, causing a CFI violation. The fix store...

CVE-2026-92484

CVE-2026-92484 is a use-after-free vulnerability in the Linux kernel 's cxl/region subsystem, specifically in the find_pos_and_ways() error path. The bug occurs because the error handling code releases its reference to a switch decoder before logging an error message that includes the decoder's n...

CVE-2026-92485

CVE-2026-92485 affects the Linux kernel BPF subsystem . The root cause is a trampoline corruption in the BPF verifier: the flag assignment tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX used direct assignment (=) instead of bitwise-OR (|=), so loading a second fexit program targeting the same tail-call...

CVE-2026-92483

CVE-2026-92483 affects the Linux kernel liveupdate (LUO) subsystem. When a FLB (File Loading Block) retrieve() call fails, the error status was not recorded. If the user subsequently requested retrieval of another file registered with the same FLB, LUO would invoke the FLB's retrieve() callback a...

CVE-2026-92482

CVE-2026-92482 affects the MediaTek pinctrl driver in the Linux kernel. The use-after-free occurs because the gpio_chip is allocated with device-managed memory (devm) but registered using the non-managed gpiochip_add_data(). While harmless for built-in drivers, once the driver is built as a modul...

CVE-2026-92481

CVE-2026-92481 affects the Linux kernel MediaTek pinctrl driver (EINT subsystem). The function mtk_eint_do_init() creates an IRQ domain , populates it with a mapping for every EINT line, and installs a chained handler on the parent interrupt, but none of these resources are ever released. While h...

CVE-2026-92480

CVE-2026-92480 affects the Linux kernel in the scsi ufs core subsystem. Two related out-of-bounds read issues exist in string descriptor handling: first, utf16s_to_utf8s() expects a count of UTF-16 code units but receives a byte count, which can cause it to read beyond the descriptor buffer; seco...

CVE-2026-92479

CVE-2026-92479 affects the Linux kernel's UFS (Universal Flash Storage) SCSI driver . In the single-doorbell completion path , the function ufshcd_compl_one_cqe() can be invoked with a NULL CQE (Command Queue Entry). When no command is associated with the completion tag, the error-reporting warni...

CVE-2026-92478

CVE-2026-92478 affects the Linux kernel in the SCSI UFS (Universal Flash Storage) core driver. The root cause is that the connected lane count is used by TX equalization code to index arrays sized by UFS_MAX_LANES . Without validation, a zero or out-of-range RX or TX lane count could be propagate...

CVE-2026-92477

CVE-2026-92477 affects the Linux kernel in the UFS debugfs driver. The function ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). If a write fills the entire buffer, it overwrites the only NUL terminator , potentially causing an out-of-boun...

CVE-2026-92476

A vulnerability in the Linux kernel's keembay crypto (OCS AES) driver occurs because kmb_ocs_aes_probe() requests the device IRQ before initializing irq_completion. Once the handler is registered it can fire immediately, and ocs_aes_irq_handler() unconditionally calls complete() on the uninitiali...

CVE-2026-90435

CVE-2026-90435 is an integer overflow vulnerability in the Linux kernel's RDMA/mlx5 subsystem. The function set_user_buf_size() left-shifts user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers ; a sufficiently large rq.wqe_cnt triggers signed integer overflow (undefined behavior), ...

CVE-2026-90434

CVE-2026-90434 affects the Linux kernel's isofs module , specifically the zisofs (compressed ISO 9660) code path. The bug resides in zisofs_fill_pages() , which reads the compressed block pointer table. While error paths and the loop correctly release buffer_head references, the success path leav...

CVE-2026-90433

CVE-2026-90433 affects the Linux kernel's spi: oc-tiny driver . A use-after-free vulnerability exists due to a mismatch in allocation management: the controller is allocated with the non-managed spi_alloc_host() while the interrupt is registered with devm_request_irq(). During device removal, the...

CVE-2026-90432

CVE-2026-90432 affects the Linux kernel 's sched_ext (scheduler extension) subsystem. The vulnerability is in the hardlockup handler (scx_hardlockup()), which deferred the abort to an irq_work—originally needed because exit claiming required scx_sched_lock and couldn't run from NMI. Now that clai...

CVE-2026-90431

CVE-2026-90431 is a use-after-free vulnerability in the Linux kernel remoteproc subsystem. The root cause is a race condition between rproc_crash_handler_work() and rproc_del(): a driver can be removed while crash-handler work is scheduled or executing, with no synchronization between the two cod...