CVE-2026-98759 usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework cd321xupdatework passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartn...

CVE-2026-98759

The Linux kernel contains a vulnerability in the usb: typec: tipd component where cd321x_update_work() fails to fully initialize a stack-allocated typec_partner_desc before passing it to typec_register_partner(). This oversight allows garbage function pointers to be stored in the attach and deatt...

EUVD-2026-103843

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

CVE-2026-98758 usb: typec: ucsi: glink: fix use-after-free of ucsi on remove

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

CVE-2026-98758

The Linux kernel contains a use-after-free vulnerability in the usb: typec: ucsi: glink component. The issue occurs because the pmic_glink client is released by devres cleanup after pmic_glink_ucsi_remove() returns, allowing notification callbacks to queue work that touches freed state. Specifica...

EUVD-2026-103842

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit cdns3gadgetstart arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the...

CVE-2026-98757

The Linux kernel contains a use-after-free vulnerability in the cdns3 gadget driver. The issue originates in cdns3_gadget_exit(), which fails to wait for two specific works (pending_status_wq and aligned_buf_wq) queued on system_freezable_wq. Because the function proceeds to free endpoints, buffe...

CVE-2026-98757 usb: cdns3: fix use-after-free in cdns3_gadget_exit()

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit cdns3gadgetstart arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the...

EUVD-2026-103841

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

CVE-2026-98756

The Linux kernel contains a vulnerability in the Cadence USBSS controller (cdns3) driver. The issue is a NULL pointer dereference occurring during the probing of a two-function PCI device. Specifically, when the second function is probed while the first function has been enabled but has not yet i...

CVE-2026-98756 usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

EUVD-2026-103840

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

CVE-2026-98755

A vulnerability exists in the Linux kernel within the tty: vcc component. The vcc_send_ctl() function fails to fully zero-initialize the stack-allocated struct vio_vcc pkt structure. Specifically, the tag.stype_env field remains uninitialized before being transmitted via ldc_write(), which can re...

CVE-2026-98755 tty: vcc: zero-initialize control packet in vcc_send_ctl()

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

EUVD-2026-103839

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcccleanup vcccleanup sets port-tty to NULL without holding port-lock, racing with vccevent LDC callbacks that read port-tty under port-lock and then use tty-port. This can...

CVE-2026-98754

The Linux kernel contains a vulnerability in the tty subsystem where the vcc_cleanup() function sets port->tty to NULL without holding the port->lock . This creates a race condition with vcc_event() LDC callbacks, which read port->tty under the lock and subsequently use tty->port . Th...

CVE-2026-98754 tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcccleanup vcccleanup sets port-tty to NULL without holding port-lock, racing with vccevent LDC callbacks that read port-tty under port-lock and then use tty-port. This can...

EUVD-2026-103838

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

CVE-2026-98753

The Linux kernel contains a vulnerability in the tty_port component where the TTY_IO_ERROR flag is not restored upon activation failure. This oversight creates a race condition during tty ioctl , hangup, and open operations. If activation fails, the lack of this flag can lead to I/O attempts on p...

CVE-2026-98753 tty: tty_port: restore TTY_IO_ERROR on activation failure

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...