CVE-2026-89512

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

CVE-2026-89510

CVE-2026-89510 is a use-after-free vulnerability in the Linux kernel's RDMA/cxgb4 (Chelsio) driver. When c4iw_remove() frees the device context (ctx->dev) while the reg_work work item—queued by c4iw_uld_state_change()—is still pending or executing, c4iw_register_device() may access already-fre...

EUVD-2026-76416

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89510

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89510 RDMA/cxgb4: Cancel reg_work before freeing device on remove

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89504

CVE-2026-89504 is a use-after-free (dangling pointer) vulnerability in the Linux kernel's regulator subsystem , specifically in the as3722 driver. In as3722_get_regulator_dt_data(), a device tree node reference acquired via of_get_child_by_name() is prematurely released by an immediate of_node_pu...

EUVD-2026-76410

In the Linux kernel, the following vulnerability has been resolved: regulator: as3722getregulatordtdata: fix premature ofnodeput leaving dangling ofnode pointer In as3722getregulatordtdata, ofgetchildbyname acquires a reference on np, which is then assigned to pdev-dev.ofnode. The function...

CVE-2026-89504

In the Linux kernel, the following vulnerability has been resolved: regulator: as3722getregulatordtdata: fix premature ofnodeput leaving dangling ofnode pointer In as3722getregulatordtdata, ofgetchildbyname acquires a reference on np, which is then assigned to pdev-dev.ofnode. The function...

EUVD-2026-76381

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

CVE-2026-89475 power: supply: bq24257: fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

CVE-2026-89475

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

EUVD-2026-76379

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix powersupply reference leak bq25890fwprobe acquires a reference to a secondary charger using powersupplygetbyname, but the reference is not released on later probe failures or on driver detach. In...

CVE-2026-89473 power: supply: bq25890: Fix power_supply reference leak

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix powersupply reference leak bq25890fwprobe acquires a reference to a secondary charger using powersupplygetbyname, but the reference is not released on later probe failures or on driver detach. In...

CVE-2026-89468 power: supply: lp8788-charger: fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788chargerremove flushes chargerwork before unregistering the IRQs. An IRQ thread can queue chargerwork after flushwork has returned. The work can then run after devr...

CVE-2026-89468

This use-after-free vulnerability affects the lp8788-charger driver in the Linux kernel. During device removal, lp8788_charger_remove() flushed charger_work before unregistering IRQs, allowing an IRQ thread to queue work after the flush completed. That work could then run after devres freed the p...

EUVD-2026-76374

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788chargerremove flushes chargerwork before unregistering the IRQs. An IRQ thread can queue chargerwork after flushwork has returned. The work can then run after devr...

CVE-2026-89463 power: supply: ucs1002: fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the healthpoll delayed work, and the work reschedules itself while the chip...

CVE-2026-89453 iommu/amd: Put PCI device after handling PPR faults

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

CVE-2026-89453 iommu/amd: Put PCI device after handling PPR faults

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

CVE-2026-89453

CVE-2026-89453 is a PCI device reference count leak in the Linux kernel's iommu/amd subsystem. The function iommu_call_iopf_notifier() calls pci_get_domain_bus_and_slot() which increments the device's reference count, but neither the successful iommu_report_device_fault() path nor the abort path ...