CVE-2026-93137

CVE-2026-93137 is a use-after-free in the Linux kernel's BPF subsystem, specifically in bpf_find_vma(). The function reads task->mm and calls mmap_read_trylock(mm) without holding a reference on the mm_struct. When operating on a foreign task , a concurrent exit_mm() can free the mm_struct bet...

CVE-2026-93136

CVE-2026-93136 affects the Linux kernel's MHI (Modem Host Interface) bus endpoint driver (bus: mhi: ep). The vulnerability is a device reference count leak in the error path of MHI device creation. When dev_set_name() or device_add() fails during device creation, the error path incorrectly drops ...

CVE-2026-93134

Linux kernel printk console subsystem is affected by a possible use-after-free in console_flush_one_record(). When emitting a record via legacy printing, a handover to another legacy printing context may release the console SRCU read lock, leaving the @con pointer invalid. The function failed to ...

CVE-2026-93135

CVE-2026-93135 is a vulnerability in the Linux kernel BPF subsystem affecting architectures that implement bpf_jit_inlines_helper_call() (e.g., LoongArch, ARM64, RISC-V ). When the verifier skips rewriting the helper call offset (insn->imm) because it expects the JIT to inline the helper, the ...

CVE-2026-93133

This CVE affects the Linux kernel ACPI RISC-V subsystem, specifically the riscv_acpi_add_prt_dep() function. The root cause is that the acpi_get_handle() call can fail, leaving the link_handle variable uninitialized , which could lead to undefined behavior when the variable is subsequently used. ...

CVE-2026-93131

CVE-2026-93131 affects the Linux kernel's platform/x86/dell-privacy driver . The vulnerability is a race condition caused by accessing priv->features_present without holding the list mutex, which allows the priv structure to be freed while still in use (use-after-free). The fix ensures the lis...

CVE-2026-93132

This vulnerability affects the Linux kernel 's ACPI RISC-V subsystem, specifically the riscv_acpi_add_prt_dep() function. The root cause is that the loop's error conditions are handled by continue statements that skip the entry pointer update to the next entry, resulting in dubious or incorrect p...

CVE-2026-93130

CVE-2026-93130 affects the Linux kernel's dell-wmi-base platform driver (under platform/x86). The root cause is a resource leak : when the module load fails, the SMBIOS request and the privacy driver are not properly cleaned up. The fix ensures proper release of these resources on the failure pat...

CVE-2026-93129

CVE-2026-93129 affects the Linux kernel driver platform/x86: dell-wmi-base . The root cause is an incorrect buffer index used when processing the "ultra performance" key from Dell WMI events. The event data passed to dell_wmi_process_key() is already parsed such that the buffer starts after the t...

CVE-2026-93128

CVE-2026-93128 affects the platform/x86 lg-laptop driver in the Linux kernel . The event notification callback may access the kbd_backlight LED device even when it was not successfully registered with the LED subsystem, and acpi_remove() unconditionally unregisters LED devices. The fix tracks the...

CVE-2026-93127

CVE-2026-93127 is a BPF verifier bug in the Linux kernel . When a spilled scalar is reloaded via a sign-extending narrowing load (BPF_MEMSX), the verifier copies the register's scalar id to the destination, but the sign extension then changes the value. If the same stack slot is also reloaded via...

CVE-2026-93126

CVE-2026-93126 affects the Linux kernel in the remoteproc subsystem, specifically the Qualcomm qcom_q6v5_adsp driver. The root cause is a reference leak : the function adsp_map_carveout calls of_parse_phandle_with_args() , which requires the caller to release the device-node reference via of_node...

CVE-2026-93125

CVE-2026-93125 is a Linux kernel BPF verifier bug in the handling of kfunc arguments named rdonly_buf_size or rdwr_buf_size. The function check_kfunc_args() stores the argument value into a u64 field (meta->r0_size) without bounding it. check_kfunc_call() then copies that value into regs[BPF_R...

CVE-2026-93124

CVE-2026-93124 affects the asus-wireless platform/x86 driver in the Linux kernel . The root cause is that asus_wireless_probe() returns success even when acpi_match_acpi_device() finds no match, storing a NULL companion pointer . When the driver is force-bound to a device without an ACPI companio...

CVE-2026-93123

CVE-2026-93123 affects the qcom GENI serial driver in the Linux kernel. The vulnerability exists in the DMA TX completion path: when uart_flush_buffer() executes after hardware completes a DMA transfer but before the completion interrupt is processed, the stale completion can advance the transmit...

CVE-2026-93121

CVE-2026-93121 affects the Linux kernel in the USB gadget f_fs subsystem. The flaw is in ffs_dmabuf_transfer(): the error paths for endpoint-disabled (ESHUTDOWN ) and request-allocation failure (ENOMEM ) call dma_fence_put() on a fence object that has only been kmalloc'd but not yet initialized w...

CVE-2026-93122

CVE-2026-93122 is an out-of-bounds write in the Linux kernel's USB gadget UAC drivers (f_uac1.c, f_uac2.c). The UAC1/UAC2 configfs rate-list attributes parse a comma-separated sampling-rate list into fixed-size arrays of UAC_MAX_RATES (10) entries without validating the token count, so an 11th en...

CVE-2026-93120

CVE-2026-93120 affects the Linux kernel 's USB gadget configfs subsystem. The function os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN (a byte count of 14) as the input length to utf16s_to_utf8s(), which expects a count of UTF-16 code units. Since the qw_sign[] array holds only 7 code units (...

CVE-2026-93118

CVE-2026-93118 affects the aspeed_udc USB gadget driver in the Linux kernel . The root cause is an unchecked coherent DMA allocation in ast_udc_probe(); when the allocation fails, ast_udc_init_ep() dereferences the null pointer during probe, leading to a null pointer dereference . The fix adds a ...

CVE-2026-93119

CVE-2026-93119 affects the Linux kernel usb: ljca driver. In ljca_enumerate_gpio(), the bank_num field read from the device descriptor is used to loop into the valid_pin[] array, which holds only 2 entries (LJCA_MAX_GPIO_NUM / 32). Existing validation checks (reply-length and pins_per_bank * bank...