CVE-2026-74517 KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Cancel and flush the I/O APIC's delayed EOI handling work during the "pre VM destroy" phase, before vCPUs are destroyed, as processing the EOI broadcast will...

CVE-2026-74302

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory...

AZL-96341 CVE-2026-72434 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

UBUNTU-CVE-2026-72434

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

CVE-2026-72434 netfilter: ipset: make sure gc is properly stopped

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

PT-2026-72622

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, cancel delayed work sync was called while gc calls queue delayed work unconditionally which can lead not to properly shutting down the...

PT-2026-72510

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

PT-2026-73027

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tb xdp handle request runs on system wq and queues xd-state work via queue delayed work in three request handlers: PROPERTIES CHANGED REQUEST, UUID REQUEST vi...

DEBIAN-CVE-2026-68367

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: synchronize delayed setalt with teardown The ftcm setalt path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses ftcm private state and ma...

AZL-95066 CVE-2026-68367 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: synchronize delayed setalt with teardown The ftcm setalt path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses ftcm private state and ma...

CVE-2026-68312

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifsclosedeferredfile, cifsclosealldeferredfiles, and cifsclosedeferredfileunderdentry, when a pending deferred close is cancelled via...

CVE-2026-68152

In the Linux kernel, the following vulnerability has been resolved: amt: fix use-after-free in AMT delayed works When an AMT device is removed, pending delayed works can still access the freed amtdev structure, which may result in kernel crashes or memory corruption. amtdevstop cancels reqwq and...

UBUNTU-CVE-2026-68152

In the Linux kernel, the following vulnerability has been resolved: amt: fix use-after-free in AMT delayed works When an AMT device is removed, pending delayed works can still access the freed amtdev structure, which may result in kernel crashes or memory corruption. amtdevstop cancels reqwq and...

CVE-2026-68214

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832remove canceldelayedworksync is called before i2cmuxdeladapters in rtl2832remove. While the cancel waits for any running instance of i2cgatework to finish, it does not prevent the time...

UBUNTU-CVE-2026-68214

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832remove canceldelayedworksync is called before i2cmuxdeladapters in rtl2832remove. While the cancel waits for any running instance of i2cgatework to finish, it does not prevent the time...

UBUNTU-CVE-2026-68367

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: synchronize delayed setalt with teardown The ftcm setalt path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses ftcm private state and ma...

CVE-2026-68214 media: rtl2832: fix use-after-free in rtl2832_remove()

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832remove canceldelayedworksync is called before i2cmuxdeladapters in rtl2832remove. While the cancel waits for any running instance of i2cgatework to finish, it does not prevent the time...

CVE-2026-68214

The CVE-2026-68214 issue affects the Linux kernel media/rtl2832 path and causes a use-after-free during module removal when a concurrent I2C transfer via the mux adapter is in flight. The root cause is that cancel_delayed_work_sync() is invoked before i2c_mux_del_adapters(), allowing rtl2832_dese...

CVE-2026-68214 media: rtl2832: fix use-after-free in rtl2832_remove()

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832remove canceldelayedworksync is called before i2cmuxdeladapters in rtl2832remove. While the cancel waits for any running instance of i2cgatework to finish, it does not prevent the time...

EUVD-2026-55538

In the Linux kernel, the following vulnerability has been resolved: amt: fix use-after-free in AMT delayed works When an AMT device is removed, pending delayed works can still access the freed amtdev structure, which may result in kernel crashes or memory corruption. amtdevstop cancels reqwq and...