CVE-2026-98500 HID: hid-oxp: use cancel_delayed_work_sync() in remove

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use canceldelayedworksync in remove oxphidremove uses canceldelayedwork for all three delayed work items. canceldelayedwork only dequeues a pending work item without waiting for a currently executing callback to...

CVE-2026-98500

The Linux kernel contains a vulnerability in the hid-oxp driver. The oxp_hid_remove() function incorrectly uses cancel_delayed_work() for three delayed work items. Because this function only dequeues pending items without waiting for active callbacks to finish, any running callbacks—specifically ...

EUVD-2026-103740

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use canceldelayedworksync in remove oxphidremove uses canceldelayedwork for all three delayed work items. canceldelayedwork only dequeues a pending work item without waiting for a currently executing callback to...

CVE-2026-98496 net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

CVE-2026-98496

The Linux kernel contains a vulnerability in the airoha npu driver. Specifically, the airoha_npu_remove() function calls cancel_work_sync() on the wdt_work item, but the watchdog IRQ (requested via devm_request_irq()) is only freed after the .remove() function returns. This allows the airoha_npu_...

CVE-2026-98496 net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

EUVD-2026-103736

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

EUVD-2026-103730

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98490 net: openvswitch: conntrack: fix helper UAF due to extensions realloc

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98490

The Linux kernel contains a Use-After-Free (UAF) vulnerability within the net: openvswitch: conntrack component. The issue arises because a raw pointer to the extensions area is inserted into the expectations list during helper calls. If a connection is not yet confirmed, subsequent calls to *_ex...

CVE-2026-98490

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98490 net: openvswitch: conntrack: fix helper UAF due to extensions realloc

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98487 net: bridge: mdb: restart port group walk after deletion

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

EUVD-2026-103727

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

CVE-2026-98487 net: bridge: mdb: restart port group walk after deletion

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

CVE-2026-98487

The Linux kernel is affected by a slab-use-after-free vulnerability in the network bridge multicast database (mdb ) component. The issue occurs in br_mdb_flush_pgs() when it maintains a pointer-to-pointer cursor while walking mp->ports. If br_multicast_del_pg() re-enters the same MDB entry via...

CVE-2026-98483 nfc: fix use-after-free in nfc_get_local_general_bytes

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfcgetlocalgeneralbytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfcllcpfindlocal" attempted to fix a use-after-free UAF issue by invoking nfcllcplocalputlocal after accessing local-g...

CVE-2026-98483

The Linux kernel contains a use-after-free (UAF) vulnerability within the nfc subsystem, specifically in the nfc_get_local_general_bytes function. The issue was triggered when a previous fix attempted to manage reference counts by calling nfc_llcp_local_put(local), which could free the local obje...

EUVD-2026-103723

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfcgetlocalgeneralbytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfcllcpfindlocal" attempted to fix a use-after-free UAF issue by invoking nfcllcplocalputlocal after accessing local-g...

CVE-2026-98483

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfcgetlocalgeneralbytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfcllcpfindlocal" attempted to fix a use-after-free UAF issue by invoking nfcllcplocalputlocal after accessing local-g...