CVE-2026-93046

CVE-2026-93046 affects the Linux kernel software node subsystem. The bounds check in software_node_get_reference_args() failed when the index was UINT_MAX (i.e., −1 cast to unsigned), causing an out-of-bounds access in the property array. The fix corrects the bound check to cover the UINT_MAX cas...

CVE-2026-93044

CVE-2026-93044 affects the Linux kernel BPF subsystem. The BPF interpreter does not support arena-related instructions (ST/LDX/STX). When a BPF program using an arena map falls back to the interpreter (via core.c::__bpf_prog_select_runtime()), execution hits a BUG_ON() at kernel/bpf/core.c:2349, ...

CVE-2026-93045

CVE-2026-93045 affects the Linux kernel BPF arena subsystem. The vulnerability resides in bpf_arena_free_pages() , which accepts scalar arena addresses and masks them to the low 32 bits before reconstructing a full user address. When the scalar value is below the low 32 bits of the arena base, th...

CVE-2026-93043

CVE-2026-93043 affects the Linux kernel BPF subsystem . The BPF interpreter does not recognize the BPF_JMP|BPF_JA|BPF_X instruction (gotox), which is used when an insn_array map is referenced by a BPF program. At runtime, this causes a BUG_ON() crash in ___bpf_prog_run() (kernel/bpf/core.c:2349),...

CVE-2026-93041

CVE-2026-93041 is a race condition in the Linux kernel's dw-edma (DesignWare eDMA) DMA engine driver. The function dw_edma_abort_interrupt() drops vc.lock before updating the request and status fields. In that window, issue_pending() can acquire the lock, observe the stale busy state, and skip st...

CVE-2026-93042

CVE-2026-93042 affects the Linux kernel dw-edma DMA engine driver. When a deferred STOP reaches the interrupt handler, the driver calls vchan_cookie_complete(), which schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued—contrary to the DMA Engine ...

CVE-2026-93040

CVE-2026-93040 is a race condition in the Linux kernel's dw-edma DMA engine driver. The pause() and resume() functions read and update channel state without holding vc.lock , while interrupt handlers update the same state under that lock. This allows a scenario where pause() observes the channel ...

CVE-2026-93039

CVE-2026-93039 affects the Linux kernel 's ASoC meson audio driver. In meson_card_reallocate_links(), two consecutive krealloc() calls grow the DAI link and private data arrays, but owner pointers are only updated after both succeed. If the first krealloc() moves the block and the second fails, c...

CVE-2026-93038

This Linux kernel vulnerability affects the iio: dac: ad5686 driver. The root cause is a missing NULL check on the chip_info pointer (match data). When a user binds the driver using driver_override via sysfs with a device name not present in the id_table or of_match_table, the match data resolves...

CVE-2026-93037

CVE-2026-93037 affects the Linux kernel in the RDMA/hfi1 driver. The function set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg(). When that call fails, it returns before initializing tx->txreq, yet the error is discarded and the caller continues processing the request as thou...

CVE-2026-92524

CVE-2026-92524 affects the Linux kernel GIC-v3-ITS irqchip driver. The root cause is a resource leak in its_vpe_irq_domain_alloc(): when its_irq_gic_domain_alloc() fails, the subsequent its_vpe_irq_domain_free() does not invoke its_vep_teardown() for the corresponding interrupt, leaving the resou...

CVE-2026-92525

CVE-2026-92525 is a vulnerability in the Linux kernel RDMA/rxe subsystem. For user-space queue pairs, rxe_post_send() takes the is_user branch and schedules send_task without validating the WQE . When rxe_requester() later calls copy_data(), it indexes wqe->dma.sge[cur_sge] using attacker-cont...

CVE-2026-92523

CVE-2026-92523 affects the Linux kernel in the RDMA/nldev subsystem. The vulnerability is an input validation flaw: RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested Netlink attribute whose children are read directly via nla_get_u32() . The top-level policy validates only the container, not the fixed s...

CVE-2026-92522

CVE-2026-92522 is a Linux kernel vulnerability in the ACPI processor module's IOAPIC hotplug lookup. The root cause is insufficient bounds validation when parsing MADT and _MAT records: the MADT walk advanced the cursor using a subtable's declared length after only locating a generic header, and ...

CVE-2026-92521

CVE-2026-92521 affects the Linux kernel ACPI PCI subsystem. In acpi_pci_root_add(), the freshly allocated root is assigned to device->driver_data before dmar_device_add() and pci_acpi_scan_root(). When dmar_device_add() fails during a hot-add, the root is freed via kfree() but driver_data is l...

CVE-2026-92520

CVE-2026-92520 affects the Linux kernel 's BPF subsystem, specifically the queue and stack pop/peek helpers . The verifier expects these helpers to initialize their output buffer, and the empty-map error path does clear it. However, a failed lock acquisition returns -EBUSY without writing the buf...

CVE-2026-92518

CVE-2026-92518 affects the Linux kernel on RISC-V when CONFIG_CFI_CLANG is enabled. The root cause is in the BPF tailcall implementation: prog->bpf_func already skips the kcfi instruction during setup, but including it again in the tailcall jump offset causes the jump to skip an extra 4 bytes,...

CVE-2026-92519

CVE-2026-92519 is a memory leak in the Linux kernel affecting the RISC-V BPF JIT subsystem. When BPF JIT compilation fails for a later subprogram, the kernel calls bpf_jit_free() to clean up an earlier subprogram, but the function fails to free jit_data->ctx.offset , leaking the JIT context of...

CVE-2026-92517

CVE-2026-92517 affects the Linux kernel on RISC-V , specifically in the BPF arena load_acquire path. The root cause is in emit_atomic_ld_st(), which returns a non-zero value (1) to signal that build_body() should skip a zero-extension step. Because the caller uses ret = ret ?: add_exception_handl...

CVE-2026-92516

CVE-2026-92516 affects the Linux kernel's BPF subsystem . The bug is in the verifier's offset warning check: the case statement for BPF_RES_SPIN_LOCK incorrectly referenced the offset for BPF_SPIN_LOCK instead of res_spin_lock_off . The fix corrects this by checking the proper offset variable. Th...