CVE-2026-92501

CVE-2026-92501 is a race condition in the Linux kernel's ext4 filesystem, affecting the direct I/O (DIO) to buffered write fallback path in ext4_dio_write_iter(). On no-extent inodes (e.g., ext3), DIO writes to holes cause a fallback to buffered I/O. An unprotected window exists between ext4_buff...

CVE-2026-92499

CVE-2026-92499 affects the Linux kernel ext4 filesystem. A corrupted directory entry with an invalid rec_len field can cause ext4_readdir() to resume from an invalid offset, resulting in an out-of-bounds read that KASAN reports as a use-after-free in __ext4_check_dir_entry(). The rescan path only...

CVE-2026-92498

This vulnerability affects the Linux kernel 's ath6kl (Atheros 6K) wireless driver. Three WMI event handlers—ath6kl_wmi_scan_complete_rx() , ath6kl_wmi_addba_req_event_rx() , and ath6kl_wmi_delba_req_event_rx() —read from the event buffer without first verifying that the message is large enough t...

CVE-2026-92497

CVE-2026-92497 affects the Linux kernel 's ath12k Wi-Fi driver. In the function ath12k_wmi_op_rx(), the firmware buffer is read without first verifying that it contains enough data to hold a wmi_cmd_hdr header, which can result in a buffer overread . The fix adds a check to confirm the buffer hol...

CVE-2026-92496

CVE-2026-92496 affects the ath11k WiFi driver in the Linux kernel . In ath11k_wmi_tlv_op_rx(), the firmware buffer is read without first verifying that it contains enough data to hold a wmi_cmd_hdr , which can result in a buffer overread . The fix adds an upfront length check before dereferencing...

CVE-2026-92495

CVE-2026-92495 affects the Linux kernel RDMA/bnxt_re driver . The function bnxt_re_mmap() rejects VM_WRITE for DBR_PAGE and TOGGLE_PAGE mappings, but a read-only mapping can still retain VM_MAYWRITE, allowing it to later be upgraded via mprotect(PROT_WRITE). This bypasses the write-permission che...

CVE-2026-92494

CVE-2026-92494 affects the Linux kernel ext4 filesystem in the function ext4_init_orphan_info() . The root cause is an off-by-one error in the out_free cleanup path: when orphan block magic or checksum validation fails after a successful ext4_bread() call, the loop starts releasing buffers from i...

CVE-2026-92493

In the Linux kernel , the amd_pstate_ut module (part of the cpufreq subsystem) causes a kernel NULL pointer dereference when loaded via modprobe on a non-AMD platform (e.g., Intel Xeon). The crash occurs at amd_pstate_ut_check_perf+0x141/0x280 due to a dereference of a NULL pointer at address 0x0...

CVE-2026-92492

CVE-2026-92492 affects the cpufreq/amd-pstate driver in the Linux kernel. The root cause is a missing NULL pointer check in two dynamic EPP callback paths: amd_pstate_power_supply_notifier() and amd_pstate_profile_set(). When cpufreq_cpu_get() returns NULL (e.g., due to a CPU going offline or a p...

CVE-2026-92491

CVE-2026-92491 affects the arm_scmi firmware driver in the Linux kernel. The root cause is that scmi_protocol_table_register() can leave earlier protocol requests registered when a later entry in the same ID table fails. Since each request retains a pointer to the driver's ID table, a failed modu...

CVE-2026-92490

CVE-2026-92490 affects the Linux kernel firmware/arm_scmi driver. The root cause is a use-after-free condition: scmi_driver_register() requests protocol devices before registering the driver. If driver_register() subsequently fails, those requests remain in the global IDR and retain pointers to t...

CVE-2026-92489

CVE-2026-92489 is a skb double-free vulnerability in the Linux kernel's xfrm subsystem. In xfrm_dev_direct_output(), when local_out() returns a value other than 1 (indicating the socket buffer was consumed or its ownership transferred, e.g., when netfilter drops the packet), the function still fr...

CVE-2026-92487

CVE-2026-92487 is a race condition in the Linux kernel's exfat filesystem . When a shared writable mapping has its valid_size extended (via a buffered write or page fault), exfat zeroes the page-cache gap below the new valid_size. A concurrent store through the mapping can race with this zeroing ...

CVE-2026-92488

CVE-2026-92488 is a resource-leak vulnerability in the Linux kernel's RDMA/erdma subsystem. The destructor functions erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() returned early when erdma_post_cmd_wait() failed, leaking queue buffers, MTTs, doorbells, and hardw...

CVE-2026-92486

CVE-2026-92486 affects the Linux kernel BPF subsystem. The root cause is a kCFI (kernel Control Flow Integrity) mismatch : BPF subprograms use the bpf_callback_t ABI, but the task work mechanism invokes the callback through a three-argument function pointer, causing a CFI violation. The fix store...

CVE-2026-92485

CVE-2026-92485 affects the Linux kernel BPF subsystem . The root cause is a trampoline corruption in the BPF verifier: the flag assignment tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX used direct assignment (=) instead of bitwise-OR (|=), so loading a second fexit program targeting the same tail-call...

CVE-2026-92484

CVE-2026-92484 is a use-after-free vulnerability in the Linux kernel 's cxl/region subsystem, specifically in the find_pos_and_ways() error path. The bug occurs because the error handling code releases its reference to a switch decoder before logging an error message that includes the decoder's n...

CVE-2026-92483

CVE-2026-92483 affects the Linux kernel liveupdate (LUO) subsystem. When a FLB (File Loading Block) retrieve() call fails, the error status was not recorded. If the user subsequently requested retrieval of another file registered with the same FLB, LUO would invoke the FLB's retrieve() callback a...

CVE-2026-92482

CVE-2026-92482 affects the MediaTek pinctrl driver in the Linux kernel. The use-after-free occurs because the gpio_chip is allocated with device-managed memory (devm) but registered using the non-managed gpiochip_add_data(). While harmless for built-in drivers, once the driver is built as a modul...

CVE-2026-92481

CVE-2026-92481 affects the Linux kernel MediaTek pinctrl driver (EINT subsystem). The function mtk_eint_do_init() creates an IRQ domain , populates it with a mapping for every EINT line, and installs a chained handler on the parent interrupt, but none of these resources are ever released. While h...