CVE-2026-89869: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...

CVE-2026-89841: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...

CVE-2026-89797: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500fg: fix use-after-free on remove ab8500fgremove destroys the driver workqueue while the threaded interrupt handlers are still armed; they are devm-managed and freed only after -remove returns, so a handler th...

CVE-2026-89788: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...

PT-2026-93667

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb: typec: qcom-pmic component where the pdphy stop function disables IRQs but leaves reset work pending. If the IRQ handler schedules this work immediately befor...

CVE-2026-89791: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

ROS-20260916-73-0087

The vulnerability of the atmelhlcdcplaneatomicduplicatestate function in the drivers/gpu/drm/atmel-hlcdc/atmelhlcdcplane.c driver of the Direct Rendering Infrastructure DRI infrastructure of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this...

ROS-20260916-73-0072

The vulnerability of the fs/gfs2/bmap.c component in the Linux operating system is related to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-89922: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...

ROS-20260916-73-0009

The vulnerability of the mutexunlock function in the eventpoll component of Linux operating systems is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to trigger a service failure...

CVE-2026-89805: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Fix folio allocation fallback and use-after-put drmpagemapmigratepopulaterampfn had two issues when populating RAM PFNs with higher-order folios: 1. The higher-order vmaallocfolio/folioalloc calls did not pass...

PT-2026-93927

Name of the Vulnerable Software and Affected Versions GPAC version 26.08-DEV Description A use after free issue exists in the BIFS Handler component within the gf sg command del function located in the src/scenegraph/commands.c file. This flaw allows for local exploitation through specific...

PT-2026-93395

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the GPRS Tunneling Protocol GTP implementation. The gtp newlink function error path frees tid hash and addr hash without waiting for a Read-Copy-Update R...

PT-2026-93582

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the IIO buffer implementation. The iio dma fence implementation used kfree for its custom release process, which violates the dma fence requirement that...

CVE-2026-90022: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

PT-2026-93673

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usbtv media component where an open PCM file can remain active after a USB disconnect. This occurs because usbtv audio free utilizes snd card free when closed,...

CVE-2026-89972: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvmeallocns error path at outunlinkns removes ns from the namespace head siblings list with listdelrcu&ns-siblings but does not wait for SRCU readers before freeing the namespace...

PT-2026-93613

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NVMe subsystem where the nvme alloc ns function fails to wait for Sleepable Read-Copy-Update SRCU readers in its error path at out unlink ns. While the function...

CVE-2026-89938: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: use iiotriggerpollnested to fix remove UAF The atlas driver requests its hardware data-ready IRQ with devmrequestthreadedirq; its threaded handler queues an irqwork, atlasworkhandler, that calls...

ROS-20260916-73-0062

The vulnerability of the rt9455charger.c component in the Linux operating system is related to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to cause a service failure...