CVE-2026-89451

CVE-2026-89451 is a race condition in the Linux kernel 's iommu/sva subsystem. iommu_attach_device_pasid() installs the SVA attach handle into the group PASID lookup before iommu_sva_bind_device() returns, allowing a concurrent bind to find and reuse the handle after iommu_sva_lock is dropped. Ho...

EUVD-2026-76357

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

CVE-2026-89451 iommu/sva: Set handle->dev before the SVA handle is visible

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

CVE-2026-89451

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

CVE-2026-89451 iommu/sva: Set handle->dev before the SVA handle is visible

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

EUVD-2026-76318

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

CVE-2026-80982 net/smc: fix use-after-free in smc_rx_pipe_buf_release()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

CVE-2026-80982

CVE-2026-80982 is a use-after-free in the Linux kernel's SMC (Shared Memory Communications) network protocol (net/smc). The root cause is a race condition in smc_rx_pipe_buf_release(): it checks sk_state before acquiring the socket lock, so a concurrent smc_conn_free() can release the connection ...

CVE-2026-89099

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this...

CVE-2026-50013: Concurrent Execution using Shared Resource with Improper Synchronization

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy,...

PT-2026-90311

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.95 Description A race condition exists in the fsnotify system affecting fanotify and inotify. When a mark receives a new event bit, the system may skip recalculating the object mask if the cached aggregate already...

PT-2026-90188

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the charger-manager component of the power supply subsystem. The problem occurs because charger manager remove and the err reg extcon probe error path...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107302)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107302 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4openowner leak when concurrent nfsd4open occur The action force umountumount -f wil...

PT-2026-90251

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the svcrdma component. The svc rdma free function calls rdma destroy idsc cm id, which frees the cm id while the transport's sc rn entry remains in the device'...

PT-2026-90256

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the sunrpc component where the function create use gss proxy proc entry publishes the /proc/net/rpc/use-gss-proxy endpoint before the init gssp clnt function...

PT-2026-90405

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the nfsd component where the nfsd4 sequence function may free a session slot that is currently being processed. This occurs during a session shrink operation when se...

PT-2026-90112

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the smc rx pipe buf release function. A race condition occurs when smc rx splice provides RMB pages to a pipe while a concurrent close operation triggers...

PT-2026-90007

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this...

PT-2026-90480

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Rust implementation of the device resource management devres system. This occurs when two execution paths attempt to revoke a Devres concurrently: the driv...

PT-2026-90216

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ring-buffer component where discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf order for the free pages call. Because...