A vulnerability in the Linux kernel's iommu/tegra241-cmdqv driver could cause the error interrupt service routine (ISR) to run before the probe function properly initializes required data structures. This occurs because the error IRQ is requested before the vintfs array is allocated and zeroed. As a result, a latched error interrupt firing early can cause the ISR to access uninitialized memory, potentially leading to undefined behavior. The issue is resolved by requesting the IRQ only after the vintfs array is safely allocated and initialized.
A vulnerability in the Linux kernel's iommu/vt-d subsystem was resolved, involving improper teardown of scalable-mode context entries on probe failure. The issue occurs when the probe function fails partway through processing DMA aliases, leaving some context entries still present and pointing to freed PASID table memory. This can lead to the IOMMU walking invalid memory references. The fix ensures proper teardown of context entries before freeing the PASID table on probe failure.
A vulnerability in the Linux kernel's thermal driver for Intel int3400 devices was resolved. The issue involved improper cleanup of ODVP (On-Demand Voltage and Power) sysfs files on probe failures, which could leave residual files and storage allocated. This occurred because cleanup was only triggered on certain failure paths, missing others such as failures in thermal_tripless_zone_device_register(). The fix moves ODVP cleanup to a common unwind path to ensure all failures release ODVP state and clears cached pointers to prevent partial setup issues.
CVE-2026-93189 is a use-after-free vulnerability in the Linux kernel's HID core subsystem. It occurs when a driver's probe enables input delivery via hid_device_io_start() but fails later and unwinds using hid_hw_stop(), which frees resources while input reports may still be processed on another CPU. This can lead to dereferencing freed memory. The issue affects multiple drivers that call hid_device_io_start() without a matching hid_device_io_stop() before hid_hw_stop(). The Linux kernel has been updated to centralize the quiesce logic in hid_hw_stop() to prevent this misuse.
A vulnerability in the Linux kernel's crypto subsystem (sa2ul) was fixed by stopping the probe process if the creation of the context pool fails. Previously, the probe continued despite failure to create the DMA pool for security context buffers, potentially leading to improper initialization and cleanup.
A vulnerability in the Linux kernel's thermal driver for Renesas R-Car (thermal/drivers/rcar) was fixed by correcting error checking in the probe() function. The issue involved calling thermal_zone_device_enable() before verifying the success of thermal_zone_device_register_with_trips(), which could lead to an error pointer dereference. The fix moves the call to thermal_zone_device_enable() until after the error check, improving cleanup and error handling.
A double free vulnerability was identified and resolved in the Linux kernel's usb gadget driver for the r8a66597 device. The issue occurs in the probe error path when usb_add_gadget_udc() fails, causing the ep0_req resource to be freed twice. This flaw was found through static analysis and code review and has been fixed by removing the redundant free operation.
CVE-2026-93124 is a vulnerability in the Linux kernel's asus-wireless platform driver where the probe function incorrectly succeeds when there is no ACPI device match. This leads to an input device being registered without a notify handler, causing it to never report events. Additionally, if the driver is force-bound to a device lacking an ACPI companion, it stores a NULL pointer that later causes a NULL pointer dereference during unbind.
A vulnerability in the Linux kernel's usb gadget driver for aspeed_udc was fixed by adding checks for endpoint DMA buffer allocation failures. The issue involved dereferencing a failed DMA buffer allocation during device probe, which could lead to unsafe operations during initialization failure cleanup.
CVE-2026-93116 is a high-severity vulnerability in the Linux kernel's asus-wmi driver affecting version 5.17. The flaw involves resource leaks during driver initialization due to misordered error handling paths, which skip cleanup of previously allocated resources when certain initialization steps fail. This can lead to resource exhaustion or instability. The issue has been fixed by reordering error path labels to ensure proper cleanup. No known exploits are reported in the wild.
A vulnerability in the Linux kernel's RDMA hfi1 driver causes a resource leak when device initialization fails late in the probe process. Specifically, RX data allocated during initialization is not freed if certain later initialization steps fail, leading to memory leaks.
CVE-2026-93091 is a use-after-free vulnerability in the Linux kernel's arm_scmi firmware component. It occurs because notification instances can be dereferenced after they have been freed during device removal or probe error paths. The flaw arises from improper ordering in teardown and late initialization work handling, leading to potential memory corruption.
A vulnerability in the Linux kernel's irqchip/renesas-irqc driver causes a resource leak and potential use-after-free leading to kernel crashes. The issue arises because generic interrupt chips allocated during probe are not freed on driver removal due to missing domain flags. This flaw has been fixed by setting IRQ_DOMAIN_FLAG_DESTROY_GC to enable automatic cleanup when the interrupt domain is removed.
A vulnerability in the Linux kernel's ad525x_dpot driver was addressed by changing how sysfs files are managed. Previously, the probe function manually created sysfs files and was responsible for rolling back partial sysfs state, while the remove function had to match every file created. The fix moves device attributes into driver core dev_groups and uses an is_visible() callback to expose only supported attributes, ensuring sysfs files are created only after a successful probe and removed before freeing driver data.
A use-after-free (UAF) vulnerability in the Linux kernel's PCI subsystem was fixed. The flaw occurred when a probe operation ran concurrently with dynamic ID removal, potentially leading to invalid memory access. The fix involves copying dynamic IDs during device matching to prevent use of freed memory and clarifying the validity scope of the ID parameter during probing.
A NULL pointer dereference vulnerability was identified and fixed in the Qualcomm SCM firmware component of the Linux kernel. The flaw occurs because the __scm pointer can be dereferenced before it is properly published during the probe phase, leading to potential kernel crashes. The fix involves restructuring the IRQ handler and probe logic to avoid accessing __scm prematurely by passing the scm context explicitly and using device driver data storage.
A race condition vulnerability in the Linux kernel's octeontx2-vf driver related to workqueue and netdev operations during probe and remove has been fixed. The issue involved improper initialization and cleanup order of the VF workqueue and network device, which could lead to queuing work on a NULL workqueue.
A vulnerability in the Linux kernel's iio pressure sensor driver for dps310 causes a NULL pointer dereference during ACPI probe when the device is enumerated via its ACPI HID. This occurs because the ACPI-derived client name does not match the driver's i2c_device_id table, leading to a kernel crash during probe. The issue is fixed by setting the device name directly and removing the faulty device-id lookup.