Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: clk: Obtain runtime PM information before traversing the tree to retrieve clksummary. Similar to the previous commit, we should ensure that all devices are resumed during runtime before printing the clksummary through debugfs...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: clk: Get runtime PM before walking the tree during disableunused. Doug reported 1 the following hung task: INFO: task swapper/0:1 was blocked for more than 122 seconds. Not tainted 5.15.149-21875-gf795ebc40eb8 1 “echo 0...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: interconnect: Fixed locking issues related to runpm vs. reclaim. For cases where iccbwset can be called in paths that may lead to deadlocks with shrinker/reclaim, such as during runpm resume, we need to separate the icc lockin...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: usb: dwc3-am62: Fixed the behavior of module unloading and reloading. When runtime PM is enabled, the module can be suspended during runtime when the .remove method is called. Call pmruntimegetsync to ensure that the module is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: clk: mediatek – Performing a runtime PM get operation on controllers during probing. The mt8183-mfgcfg component has a mutual dependency with genpd during the probing stage, which leads to a deadlock in the following call stack:...

CVE-2026-68280

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be disabled twice: once during...

CVE-2026-68280

The CVE affects the Linux kernel DRM/Bridge code for cdns-dsi. The root cause is using the deprecated UNIVERSAL_DEV_PM_OPS() macro, which handles both runtime PM and system sleep, causing DSI clocks to be disabled twice (runtime suspend and system suspend). This can trigger a WARN from the clock ...

EUVD-2026-55381

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be disabled twice: once during...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: Fixed an issue with the irq assumption regression. The code in bmc150-accel-core.c unconditionally calls bmc150accelsetinterrupt in the iiobuffersetupops. This occurs, for example, during the runtime PM resume...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qusb2: Fixed NULL pointer dereferencing during early suspends. Enabling runtime PM before attaching the QPHY instance as driver data can lead to a NULL pointer dereferencing in runtime PM callbacks that expect valid...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: media: ipu6: Fixed a RPM reference leak in error handling paths. Several error paths in ipu6pciprobe allowed code to directly jump to outipu6busdeldevices without releasing the runtime PM reference. Added pmruntimeputsync befo...

SUSE CVE-2026-64476

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disableidled3 per device When disableidled3 was introduced in vfio-pci, it directly manipulated the device power state with pcisetpowerstate. There were no refcounts to maintain or balanced operations, we could...

SUSE CVE-2026-64481

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41hda creates ALSA controls whose private data points at the cs35l41hda object. The firmware load control can also queue fwloadwork. Those controls are not removed on...

SUSE CVE-2026-64493

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mpl115: fix runtime PM leak on read error mpl115readraw takes a runtime PM reference with pmruntimegetsync before reading the processed pressure or raw temperature, but on the read error path it returns without...

SUSE CVE-2026-64494

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002readraw calls pmruntimegetsync before reading the lux value, but if gp2ap002getlux fails, it returns directly. This skips the pmruntimeputautosuspend call at the "ou...

SUSE CVE-2026-64503

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on writeraw error kxsd9writeraw takes a runtime PM reference with pmruntimegetsync but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the...

CVE-2026-64503

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on writeraw error kxsd9writeraw takes a runtime PM reference with pmruntimegetsync but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the...

CVE-2026-64493

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mpl115: fix runtime PM leak on read error mpl115readraw takes a runtime PM reference with pmruntimegetsync before reading the processed pressure or raw temperature, but on the read error path it returns without...

CVE-2026-64494

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002readraw calls pmruntimegetsync before reading the lux value, but if gp2ap002getlux fails, it returns directly. This skips the pmruntimeputautosuspend call at the "ou...

CVE-2026-64476

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disableidled3 per device When disableidled3 was introduced in vfio-pci, it directly manipulated the device power state with pcisetpowerstate. There were no refcounts to maintain or balanced operations, we could...