CVE-2026-90253

In the Linux kernel Bluetooth MGMT subsystem , mesh_send_cancel() queues a pending command with a NULL destroy callback , meaning it is only freed if send_cancel() actually runs. When the entry is cancelled (e.g., by hci_cmd_sync_clear() on controller unregistration), _hci_cmd_sync_cancel_entry()...

CVE-2026-90044

CVE-2026-90044 is a Use-After-Free vulnerability in the Linux kernel USB gadget f_fs (function filesystem) module, specifically in ffs_epfile_write_iter() and ffs_epfile_read_iter(). When ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed, but for AIO oper...

CVE-2026-87860: Missing Authorization

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fixed possible use after free in pxafbtask. In the pxafbprobe function, it calls the pxafbinitfbinfo function. After that, &fbi-task is associated with pxafbtask. Moreover, within this pxafbinitfbinfo function, the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: cancels all operations upon calling hciunregisterdev. The syzbot reports that calling hcireleasedev from hcierrorreset can cause a deadlock at destroyworkqueue. This occurs because hcierrorreset is called from...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: atm: fore200e: fixed a use-after-free in tasklets during device removal When the PCA-200E or SBA-200E adapter is detached, the fore200e is deallocated. However, the txtasklet or rxtasklet may still be running or pending, leading ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/aio: Restricted kiocbsetcancelfn to I/O submitted via libaio. If kiocbsetcancelfn is called for I/O submitted via iouring, the following kernel warning appears: WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocbsetcancelfn+0x9c/0x...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: rtl8xxxu: Added cancelworksync for c2hcmdwork. The workqueue may still be running when the driver is stopped. To avoid a use-after-free, call cancelworksync in rtl8xxxustop...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: comedi: pcl818: fixed the null-ptr-deref in pcl818aicancel Syzbot identified an issue 1 in pcl818ai Cancel, which stems from the fact that in case of early device detachment via pcl818detach, subdevice dev-readsubdev may not have...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix for a use-after-free caused by irqcheckwork in flexcoppciremove. The original code uses canceldelayedwork in flexcoppci Remove, which does not guarantee that the delayed irqcheckwork has fully completed if it is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tls: Fixed a race condition in tlsswcancelworktx This issue was discovered during a code audit. After the tlsskprotoclose function is called, canceldelayedworksync can still be used from functions like Delayed ACK handler or...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fixed race between aiocancel and AIO request complete FFS-based applications can utilize the aiocancel callback to dequeue pending USB requests submitted to the UDC. There is a scenario where the FFS application...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: i3c: master: cdns: Fixed a use-after-free vulnerability in the cdnsi3cmasterprobe function due to race conditions. In the cdnsi3cmasterprobe function, &master-hjwork is bound to cdnsi3cmasterhj. And cdnsi3cmasterinterrupt can cal...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: venus: Fixed a bug related to use after free in venusremove due to a race condition. In venusprobe, core-work is bound to venussyserrorhandler, which is used to handle errors. The code uses core-syserrDone to synchronize t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939sessionactivate fail if the device is no longer registered. The syzbot still reports that unregisternetdevice: waiting for vcan0 to become free. Usage count = 2. Even after commit 93a27b5891b8 “can: j1939: a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hciconn: A null pointer dereferencing occurred in hciabortconn. hciabortconn attempts to read hciskbeventhdev-sentcmd when a connection is pending. However, hdev-sentcmd can be NULL while reqstatus remains HCIREQPEN...

Astra Linux – Vulnerability in OpenLDAP

A flaw was discovered in OpenLDAP before version 2.4.57, which led to an infinite loop in slapd due to the cancelextop Cancel operation, resulting in a denial of service...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: rds: Do not hold the sock lock when canceling work from rdstcpresetcallbacks. The syzbot is reporting a lockdep warning at rdstcpresetcallbacks 1. The related commit is ac3615e7f3cffe2a “RDS: TCP: Reduce code duplication in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Added “cancelworksync” before the module removal operation. When we remove the module that will call mpc52xxspiremove, it will free the “ms” object through spiunregistercontroller. However, the “work” stored in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvme: nvme-fc: Ensure -ioerrwork is cancelled in nvmefcdeletectrl nvmefcdeleteassociation waits for pending I/O to complete before returning. An error can cause -ioerrwork to be queued after cancelworksync has been called. Mov...