SUSE CVE-2026-89899

In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in waitforcompletionkillable. If that wait is interrupted by a signal, canceldelayedworksync...

AZL-101460 CVE-2026-89970 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

DEBIAN-CVE-2026-89899

In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in waitforcompletionkillable. If that wait is interrupted by a signal, canceldelayedworksync...

EUVD-2026-80570

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

CVE-2026-89970 nvmet-auth: Synchronize timeout work during SQ teardown

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

EUVD-2026-80499

In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in waitforcompletionkillable. If that wait is interrupted by a signal, canceldelayedworksync...

CVE-2026-89899 media: cec: disable delayed work before freeing an interrupted transmit

In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in waitforcompletionkillable. If that wait is interrupted by a signal, canceldelayedworksync...

CVE-2026-89899 media: cec: disable delayed work before freeing an interrupted transmit

In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in waitforcompletionkillable. If that wait is interrupted by a signal, canceldelayedworksync...

CVE-2026-89899

CVE-2026-89899 is a race condition in the Linux kernel's CEC (Consumer Electronics Control) media subsystem . In cec_transmit_msg_fh(), the adapter lock is dropped to wait for a blocking transmit; if that wait is interrupted by a signal, cancel_delayed_work_sync() can execute before the CEC kthre...

Linux Distros Unpatched Vulnerability : CVE-2026-89899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fixed use-after-free bugs in otx2synctstamp. The original code relies on canceldelayedwork in otx2ptpDestroy, which does not ensure that the delayed work item synctstampwork has fully completed if it was already...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Media: Tuner: xc5000: Fixed a use-after-free in xc5000release. The original code used canceldelayedwork in xc5000release, which does not guarantee that the delayed work item, timersleep, has fully completed if it was already...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net/smc: fixed a deadlock caused by canceldelayedworksyn The following LOCKDEP was detected: Workqueue: events smclgrfreework smc WARNING: a circular locking dependency was detected...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: cnic: Fixed use-after-free bugs in cnicdeletetask. The original code used canceldelayedwork in cniccmstopbnx2xHW, which does not guarantee that the delayed work item “deletetask” has fully completed if it was already running...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: rds: Do not hold the sock lock when canceling work from rdstcpresetcallbacks. The syzbot is reporting a lockdep warning at rdstcpresetcallbacks 1. The related commit is ac3615e7f3cffe2a “RDS: TCP: Reduce code duplication in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-core: flush delayed work before removing DAIs and widgets When a sound card is unbound while a PCM stream is open, a use-after-free can occur in sndsocdapmstreamevent, called from the closedelayedwork workqueue handler...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys – cancels delayed work only in case of GPIO. The gpiokeys module can accept gpios or interrupts. The module initializes delayed work only in case of gpios and is only used if the debounce timer is not used...

Linux Distros Unpatched Vulnerability : CVE-2026-89548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is...

Linux Distros Unpatched Vulnerability : CVE-2026-89475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove...

Linux Distros Unpatched Vulnerability : CVE-2026-89463

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the...