CVE-2026-98286

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

CVE-2026-98258 posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cputimer::firing from a tristate value to a boolean. This lost the...

CVE-2026-98258

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cputimer::firing from a tristate value to a boolean. This lost the...

CVE-2026-98256 signal: Prevent exec() race

In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in sendsignallocked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace:...

EUVD-2026-93184

In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in sendsignallocked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace:...

CVE-2026-98198

The Linux kernel contains a vulnerability in the hwmon (pwm-fan) component where the sample_timer() function can access freed memory. This occurs because the cleanup action to stop the RPM timer is registered before the ctx->tachs and ctx->pulses_per_revolution arrays are allocated; since d...

EUVD-2026-93126

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98192 wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

CVE-2026-98192 wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

CVE-2026-98192

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

Linux Distros Unpatched Vulnerability : CVE-2026-98198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution...

CVE-2026-98198: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98256: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in sendsignallocked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace:...

PT-2026-106521

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A use-after-free issue exists in the wcn36xx wifi driver. The wcn36xx dxe deinit function uses timer delete to tear down the TX ack timer, which dequeues the timer but does not wait for any...

PT-2026-106525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the brcmsmac wifi driver. The brcms free timer function calls brcms del timer, which utilizes the non-synchronous cancel delayed work to cancel delay...

PT-2026-106527

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A race condition exists in the pwm-fan driver of the hwmon subsystem. The sample timer function rearms the RPM timer and accesses the ctx-tachs and ctx-pulses per revolution arrays. Because...

PT-2026-106615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the drop monitor component during teardown paths, specifically within net dm trace off set, net dm hw monitor stop, and error unwind paths in net dm trac...

PT-2026-106643

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A NULL-pointer dereference exists in the ALSA PCM component. The snd pcm timer init function calls snd device register to add a new snd timer structure to the global timer list before...

PT-2026-106662

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the mac80211 wifi component where the radio LED is activated when the first interface is brought up, which starts the tpt trig timer. If the interface fails to come up, t...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: atm: iphase: fixed a possible use-after-free in iamoduleexit The remove function of this module calls deltimer. However, that function does not wait for the timer handler to finish. This means that the timer handler may still be...