A vulnerability in the Linux kernel's USB gadget driver for Aspeed UDC was resolved. The issue involved unchecked DMA buffer allocation failures during device probe, leading to dereferencing of null pointers and unsafe gadget unregistration. The fix adds proper allocation checks and a local cleanup helper to safely unwind resources on probe failure. This vulnerability affects specific Linux kernel versions used in various Ubuntu releases.
A vulnerability in the Linux kernel's asus-wireless platform driver allows the probe function to succeed even when there is no matching ACPI device companion. This leads to a NULL pointer dereference during driver unbinding, potentially causing a kernel crash. The issue arises because the driver does not properly verify the presence of an ACPI companion before proceeding with initialization.
A double free vulnerability was identified and resolved in the Linux kernel's usb gadget driver for the r8a66597 device. The issue occurs in the probe error path where the ep0_req request is freed twice if usb_add_gadget_udc() fails, potentially leading to memory corruption. The fix removes the redundant free to ensure ep0_req is released exactly once.
A vulnerability in the Linux kernel's thermal driver for rcar was fixed by correcting error checking in the probe() function. The issue involved calling thermal_zone_device_enable() before confirming that thermal_zone_device_register_with_trips() succeeded, which could lead to an error pointer dereference. The fix moves the call to thermal_zone_device_enable() until after the error check to prevent this. The cleanup process was also simplified to avoid redundant unregister calls.
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() gdsc_unregister() removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pm_genpd_remove() on the individual generic_pm_domain structures registered by gdsc_init(): void gdsc_unregister(struct gdsc_desc *desc) { struct device *dev = desc->dev; size_t num = desc->num; gdsc_pm_subdomain_remove(desc, num); of_genpd_del_provider(dev->of_node); } That leaves dangling entries on the global gpd_list. After a provider unbind/rebind cycle (deferred-probe replay during early boot, real module unload of a clk driver that owns GDSCs, or an OF-overlay tear- down) the next gdsc_init() will end up trying to re-register a name that is still in the list and pm_genpd_init() returns -EEXIST. While we are here, flip the order so the consumer-facing OF provider entry is the first thing removed -- otherwise a fresh of_genpd_get_from_provider() call racing with the teardown could attach to a domain that is mid-removal. Iterate the scs[] array and pm_genpd_remove() each registered domain after the subdomain links are torn down. The regulators stay devm- managed (devm_regulator_get_optional() in gdsc_register()), so the release happens automatically when the underlying device is unbound; just the genpd accounting needs to be undone explicitly.
In the Linux kernel, the following vulnerability has been resolved: crypto: sa2ul - stop probe if context pool creation fails sa_ul_probe() calls sa_init_mem() to create the DMA pool used for security context buffers, but ignores its return value. If pool creation fails, probe still continues with DMA setup, algorithm registration and child population even though later request setup depends on that pool. Stop probing when sa_init_mem() fails, and route that failure to the PM cleanup path without attempting to destroy an uncreated DMA pool.
A vulnerability in the Linux kernel's I3C master driver causes recursive locking during device registration, which can lead to a deadlock. The issue arises because device registration triggers probe callbacks that attempt to reacquire a read lock already held, which is unsupported by the kernel's read-write semaphore implementation. This has been fixed by separating device creation from registration and adjusting locking mechanisms to prevent recursive lock acquisition.
A use-after-free vulnerability in the Linux kernel's HID subsystem was identified and resolved. The issue occurs when a driver's probe enables input delivery with hid_device_io_start(), then fails later and calls hid_hw_stop() to unwind. This sequence can free the hidraw structure while HID reports are still being processed on another CPU, leading to use-after-free. The flaw affects several drivers that call hid_device_io_start() without a matching hid_device_io_stop() before hid_hw_stop(). A fix centralizes the stopping of input delivery inside hid_hw_stop() to prevent this misuse. The vulnerability has a CVSS score of 8.8, indicating high severity, and affects specific Linux kernel versions listed. No known exploits are reported in the wild.
CVE-2026-92504 is a high severity vulnerability in the Linux kernel's thermal driver for Intel int3400. It involves improper cleanup of ODVP (On-Die Voltage Parameters) sysfs files when probe failures occur during device initialization. This can leave residual ODVP files and storage allocated, potentially leading to resource leaks or inconsistent system state. The issue is addressed by moving the ODVP cleanup to a common unwind path to ensure proper release of resources on all failure paths.
A use-after-free vulnerability exists in the Linux kernel's HID subsystem due to improper synchronization during failed device probe cleanup. Specifically, report callbacks may run concurrently with probe failure cleanup, potentially accessing freed memory. This issue has been resolved by synchronizing input and waiting for ongoing report callbacks to complete before releasing resources.
CVE-2026-90241 is a high-severity vulnerability in the Linux kernel's iommu/vt-d subsystem. It involves improper teardown of scalable-mode context entries on probe failure, which can cause the IOMMU to reference freed memory. This flaw affects specific Linux kernel versions and has been resolved by ensuring proper context teardown before freeing the PASID table.
A resource leak vulnerability in the Linux kernel ALSA ice1712 driver was fixed. The snd_ice1712_probe() function failed to release the ALSA card resource on probe errors, causing a card leak. The fix involves using snd_devm_card_new() with scope-based cleanup and clearing the card pointer after successful registration to prevent leaks.
A vulnerability in the Linux kernel's nvme-pci driver causes a memory leak of DMA descriptor pools on probe failure. The issue arises because descriptor DMA pools allocated per NUMA node are not released properly if the probe fails after the admin tag set allocation. This flaw has been resolved by ensuring descriptor pools are released in the error path without causing double-free errors during normal teardown.
A vulnerability in the Linux kernel's cpufreq driver for the imx6q platform causes an out-of-bounds write when the driver is probed more than once. This occurs because the imx6_soc_volt array is allocated fresh on each probe but filled using a static counter that is not reset, leading to writes beyond the allocated memory. This flaw has been fixed by changing the static storage to local storage to prevent indexing errors.
Multiple issues were identified and resolved in the hid-asus driver within the Linux kernel, including unchecked size in asus_raw_event(), unclean teardown on probe failure, possible use-after-free, inefficient workqueue usage, sleeping calls in atomic context, and incorrect packet sizes sent to the keyboard controller. The fix involved refactoring workqueues, improving initialization sequences, and adding size checks.
A vulnerability in the Linux kernel's mt7915 wifi driver causes a resource leak when IRQ setup fails during device initialization. Specifically, the hif2 reference is not properly released if pci_alloc_irq_vectors() or devm_request_irq() fails, leading to a memory/resource leak. This issue has been resolved by explicitly dropping the hif2 reference on those failure paths.
A vulnerability in the Linux kernel's mt76 wifi driver (mt7996) could cause the CPU to hang during device probe due to an unbounded TLV walk. This occurs when a firmware response contains a zero-length TLV, potentially causing an infinite loop. Additionally, a 32-bit payload was read without proper bounds checking. The issue has been resolved by adding checks to reject short fields and stop on TLVs with invalid lengths.
A NULL pointer dereference vulnerability in the Linux kernel's Qualcomm firmware SCM driver was fixed. The issue occurs because the IRQ handler and certain probe paths can dereference the __scm pointer before it is properly published, leading to potential kernel crashes. The fix involves changing the IRQ handler and related functions to avoid accessing __scm prematurely and ensuring proper initialization order during probe.
A vulnerability in the Linux kernel's media subsystem for stm32 dcmi was fixed by correcting error handling bugs in the probe() function. The issues involved improper cleanup on error paths, memory leaks due to checking uninitialized pointers, and a NULL pointer dereference caused by releasing a DMA channel before it was assigned. These bugs could lead to instability or crashes in affected kernel versions.
A use-after-free (UAF) vulnerability in the Linux kernel's PCI subsystem was resolved. The issue occurred when a probe ran concurrently with dynamic ID removal, potentially leading to invalid memory access. The fix involves copying dynamic IDs during device matching to prevent use of freed memory and clarifying the validity scope of the ID parameter during probing.