CVE-2026-89467

CVE-2026-89467 is a use-after-free vulnerability in the Linux kernel 's Qualcomm battery management driver (power: supply: qcom_battmgr). The root cause is that qcom_battmgr_pdr_notify() can keep queueing enable_work while the PMIC GLINK client remains on the client list until its devres release ...

CVE-2026-89467 power: supply: qcom_battmgr: fix use-after-free

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: fix use-after-free qcombattmgrpdrnotify queues enablework when the PMIC GLINK service comes up, and the worker recovers battmgr through containerof to issue firmware requests. The PMIC GLINK client sta...

CVE-2026-89467

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: fix use-after-free qcombattmgrpdrnotify queues enablework when the PMIC GLINK service comes up, and the worker recovers battmgr through containerof to issue firmware requests. The PMIC GLINK client sta...

EUVD-2026-76373

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: fix use-after-free qcombattmgrpdrnotify queues enablework when the PMIC GLINK service comes up, and the worker recovers battmgr through containerof to issue firmware requests. The PMIC GLINK client sta...

CVE-2026-89467 power: supply: qcom_battmgr: fix use-after-free

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: fix use-after-free qcombattmgrpdrnotify queues enablework when the PMIC GLINK service comes up, and the worker recovers battmgr through containerof to issue firmware requests. The PMIC GLINK client sta...

CVE-2026-89455 PCI: plda: Fix use-after-free of event IRQs during teardown

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown pldapcieirqdomaindeinit removes pcie-eventdomain via irqdomainremove, but the per-event IRQs mapped from that domain are requested with devmrequestirq in...

CVE-2026-89455

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown pldapcieirqdomaindeinit removes pcie-eventdomain via irqdomainremove, but the per-event IRQs mapped from that domain are requested with devmrequestirq in...

PT-2026-90183

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the qcom battmgr pdr notify function. The function queues enable work when the PMIC GLINK service starts, and the worker uses container of to recover...

PT-2026-96345

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom battmgr: fix use-after-free qcom battmgr pdr notify queues enable work when the PMIC GLINK service comes up, and the worker recovers battmgr through container of to issue firmware requests. The PMIC GLINK clie...

PT-2026-90184

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the lp8788-charger component. The lp8788 charger remove function flushes charger work before unregistering IRQs, which allows an IRQ thread to queue...

PT-2026-90480

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Rust implementation of the device resource management devres system. This occurs when two execution paths attempt to revoke a Devres concurrently: the driv...

CVE-2026-89764: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

Linux Distros Unpatched Vulnerability : CVE-2026-80818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues...

SUSE CVE-2026-80818

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

CVE-2026-80818

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

EUVD-2026-71253

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

CVE-2026-80818 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

CVE-2026-80818 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

CVE-2026-80818

CVE-2026-80818 is a use-after-free in the Linux kernel's iommu/tegra241-cmdqv driver. During a devres unwind (failed probe or unbind), the SMMU command queue is freed before arm_smmu_impl_remove() invokes tegra241_cmdqv_remove_vintf(), which issues a CMD_SYNC on the already-freed queue memory. Th...

PT-2026-85659

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMD SYNC use-after-free on teardown arm smmu impl remove is registered as a devres action in arm smmu impl probe, before arm smmu init queues allocates smmu-cmdq.q.base. On a devres unwind, whether a...