kernel: can: bcm: thrtimer use-after-free during RX operation teardown

A use-after-free flaw was found in the Linux kernel's CAN BCM Broadcast Manager subsystem. During RX operation teardown, a concurrent receive handler can race and re-arm the throttle timer after the operation has been scheduled for deallocation. When the deallocation completes, the timer is still...

CVE-2026-10675

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675

Zephyr Project Bluetooth Mesh PB-ADV vulnerability (CVE-2026-10675) in prov_msg_recv() reschedules the provisioning watchdog timer unconditionally at the top of the function, before FCS and ADV_LINK_INVALID checks. If a provisioning attempt fails (ADV_LINK_INVALID set), a malicious, unauthenticat...

SUSE CVE-2026-63905

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The original thread stalled on Shuah Khan's request for runtime testing of...

SUSE CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

SUSE CVE-2026-64093

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

CVE-2026-64093

A flaw was found in the batman-adv component of the Linux kernel. A race condition exists where a timer can be re-armed after its associated reference has been removed during cleanup. This can occur when batadvtpsendercleanup attempts to shut down a timer, but a separate execution context re-arms...

PT-2026-62123

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pb adv.c, prov msg recv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV LINK INVALID check. Once a provisioning attempt fails, prov...

Linux MPTCP pm_del_add_timer Heap Buffer Overflow DoS

The vulnerability of the mptcppmdeladdtimer function in the net/mptcp/pm.c module of the MPTCP protocol implementation in Linux operating systems is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Malicious code in claude-code-timer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04950731ec6589eebae22166fb042e4253719f71bfd3fc2b58f28d26ede9e43c [email protected] was scanned with no findings of concern. No install-time lifecycle scripts, no outbound network calls to attacker-controlled...

MAL-2026-10892 Malicious code in claude-code-timer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04950731ec6589eebae22166fb042e4253719f71bfd3fc2b58f28d26ede9e43c [email protected] was scanned with no findings of concern. No install-time lifecycle scripts, no outbound network calls to attacker-controlled...

hdlc_ppp: sync per-proto timers before freeing hdlc state

...

Linux Distros Unpatched Vulnerability : CVE-2026-64093

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer...

SUSE CVE-2026-63803

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. That struct ppp is the hdlc-state allocation, which detachhdlcprotocol...

CVE-2026-64093

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-63905

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The original thread stalled on Shuah Khan's request for runtime testing of...