CVE-2026-98691

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...

CVE-2026-98677

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix use-after-free on unbind adsdbufferpostenable allocates sigmadelta-samplesbuf with devmkrealloc at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are...

CVE-2026-98691 thunderbolt: Tear down inactive DP tunnels when the domain is stopped

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...

EUVD-2026-103945

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...

CVE-2026-98691

The Linux kernel contains a vulnerability where the thunderbolt subsystem fails to tear down inactive DP tunnels when a domain is stopped. Specifically, tb_stop() only handles DMA tunnels, allowing DP tunnels awaiting dprx_work to remain queued. This results in callbacks running against already t...

CVE-2026-98691 thunderbolt: Tear down inactive DP tunnels when the domain is stopped

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...

CVE-2026-98690 thunderbolt: Fix domain reference leak when DPRX read is canceled

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on the work queue. If that work is cancelled that reference is leaked...

CVE-2026-98690

The Linux kernel contains a vulnerability in the thunderbolt driver where a domain reference is leaked when a DPRX read is canceled. Specifically, the tb_tunnel_one_dp() function takes a reference that is only dropped once; if tb_dp_tunnel_active() work is canceled, the reference remains leaked. ...

CVE-2026-98677 iio: adc: ad_sigma_delta: fix use-after-free on unbind

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix use-after-free on unbind adsdbufferpostenable allocates sigmadelta-samplesbuf with devmkrealloc at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are...

CVE-2026-98677

The Linux kernel contains a use-after-free vulnerability in the iio: adc: ad_sigma_delta driver. The root cause is that ad_sd_buffer_postenable() allocates sigma_delta->samples_buf using devm_krealloc() at runtime, causing its resources to be released during unbind before iio_device_unregister...

EUVD-2026-103931

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix use-after-free on unbind adsdbufferpostenable allocates sigmadelta-samplesbuf with devmkrealloc at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are...

CVE-2026-98677 iio: adc: ad_sigma_delta: fix use-after-free on unbind

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix use-after-free on unbind adsdbufferpostenable allocates sigmadelta-samplesbuf with devmkrealloc at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are...

CVE-2026-98677

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix use-after-free on unbind adsdbufferpostenable allocates sigmadelta-samplesbuf with devmkrealloc at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are...

CVE-2026-98670

The Linux kernel contains a vulnerability in the iio: adc: xilinx-xadc driver where the ZYNQ XADC alarm IRQ handler could re-arm zynq_unmask_work after the associated structure had been freed. This occurs because the IRQ was freed before the unmask worker was cancelled during unbind. The fix invo...

CVE-2026-98670 iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynqunmaskwork via scheduledelayedwork; that work is cleared by a devm callback. Register the devm callback befo...

CVE-2026-98670 iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynqunmaskwork via scheduledelayedwork; that work is cleared by a devm callback. Register the devm callback befo...

CVE-2026-98670

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynqunmaskwork via scheduledelayedwork; that work is cleared by a devm callback. Register the devm callback befo...

CVE-2026-97858

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: soc: ti: k3-socinfo: Fixed the regmap leak that occurs during probe failures. The mmio regmap allocated during the probe never gets freed. We have switched to using the device-managed allocator, so that the regmap is released...

AZL-106062 CVE-2026-98309 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Use managed KMS polling to fix UAF on unbind vc4kmsload calls drmkmshelperpollinit but the driver provides no matching drmkmshelperpollfini. The output poll work stays scheduled after unbind and runs on the freed...