EUVD-2026-80639

In the Linux kernel, the following vulnerability has been resolved: usb-storage: eneub6250: fix race between scan work and probe eneub6250probe calls usbstorprobe2, which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls enegetcardtype, which sends a...

CVE-2026-90021 usb: gadget: f_midi: initialize work in f_midi_alloc()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...

CVE-2026-90021

In the Linux kernel , the USB gadget f_midi driver contained a bug where INIT_WORK was performed in f_midi_bind() rather than f_midi_alloc(). If f_midi_bind() was never executed, the work struct remained uninitialized, causing f_midi_free to trigger a warning in __flush_work due to work->func ...

CVE-2026-89979

CVE-2026-89979 is a race condition in the Linux kernel ALSA PCM subsystem. Non-atomic operations (hw_params, hw_free, prepare) can be in progress when another thread issues an atomic PCM trigger-start , causing state inconsistency (e.g., ODEBUG warnings reported by syzkaller ). The CVSS 3.1 score...

EUVD-2026-80579

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the concurrent state transitions between atomic PCM ops, but the checks between the non-atomic ops hwparams, hwfree and prepare and the atomic o...

EUVD-2026-80573

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answer...

PT-2026-93614

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme tcp handle c2h data function where the system fails to verify if a command requested a data read when processing a C2HData PDU. A malicious controller can...

PT-2026-93672

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the usb-storage module specifically affecting ene ub6250. The ene ub6250 probe function calls usb stor probe2, which schedules delayed scan work. Subsequently,...

Linux Distros Unpatched Vulnerability : CVE-2026-89979

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the concurrent state transitions between atomic PCM ops, but the checks...

CVE-2026-89973: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answer...

CVE-2026-89979: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the concurrent state transitions between atomic PCM ops, but the checks between the non-atomic ops hwparams, hwfree and prepare and the atomic o...

PT-2026-93662

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB gadget MIDI function where work is not properly initialized. The f midi alloc function initializes free ref to 1, but the INIT WORK process is only performed...

Linux Distros Unpatched Vulnerability : CVE-2026-90021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: KVM: x86: Added SRCU protection for reading PDPTRs in getsregs2. Added read-side protection when reading PDPTR registers in getsregs2. Reading PDPTRs may trigger access to guest memory: kvmpdptrread - svmcachereg - loadpdptrs ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amdgpu: Fixed the smatch static checker warning adev-gfx.imu.funcs could be NULL...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: erofs: The issue of generating a order = MAXORDER warning due to an intentionally crafted negative isize has been fixed. As reported by syzbot 1, the root cause is that the isize field is a signed type, and a negative isize value...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mm/khugepaged: fixed -anonvma race condition If an -anonvma is attached to the VMA, the collapseandfreepmd function requires it to be locked. Page table traversal is allowed under any of the following conditions: the mmap lock...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: macb: The call order for unregisternetdev in macbremove has been corrected. When removing a macb device, the driver calls phyexit before unregisternetdev. This results in a warning from kernfs: ------------ Cut here...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sh: cpuinfo: Fixed a warning for CONFIGCPUMASKOFFSTACK When CONFIGCPUMASKOFFSTACK and CONFIGDEBUGPERCPUMAPS are selected, cpumaxbitswarn generates a runtime warning similar to the following when showing /proc/cpuinfo. This issue...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect After the committed code below, if the MPC subflow is already in the TCPCLOSE status or has fallen back to TCP at the mptcpdisconnect time, mptcpdofastclose skips setting the sendfastclos...