50581 matches found
EUVD-2026-82034
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...
EUVD-2026-82032
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...
CVE-2026-90371 wifi: mt76: fix RXDMAD_C buffer recycling race
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...
CVE-2026-90367 wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...
CVE-2026-90367
CVE-2026-90367 is a race condition in the Linux kernel's mt76 WiFi driver, specifically affecting the mt7996 hardware. The root cause is that mt7996_mac_reset_work() parked the TX worker and disabled RX/TX NAPIs before taking dev->mt76.mutex, while __mt76_set_channel() toggles the same worker ...
EUVD-2026-82028
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...
CVE-2026-90367 wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...
EUVD-2026-82026
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by destroyworkqueue in mt76freedevice, which runs after the hw is unregister...
CVE-2026-90365 wifi: mt76: cancel reset and rc work on device unregister
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by destroyworkqueue in mt76freedevice, which runs after the hw is unregister...
CVE-2026-90365
CVE-2026-90365 affects the mt76 WiFi driver in the Linux kernel. The root cause is a workqueue ordering flaw: both mt76 drivers cancelled dump_work on device unregister but left reset_work and rc_work to be flushed only later by destroy_workqueue() in mt76_free_device(), which runs after the hard...
EUVD-2026-82021
In the Linux kernel, the following vulnerability has been resolved: regulator: core: use systemfreezablewq for init complete work scheduledelayedwork uses systemwq, which is non-freezable, allowing regulatorinitcompletework to run concurrently with system suspend. This work fires 30s after boot t...
CVE-2026-90360 regulator: core: use system_freezable_wq for init complete work
In the Linux kernel, the following vulnerability has been resolved: regulator: core: use systemfreezablewq for init complete work scheduledelayedwork uses systemwq, which is non-freezable, allowing regulatorinitcompletework to run concurrently with system suspend. This work fires 30s after boot t...
CVE-2026-90360 regulator: core: use system_freezable_wq for init complete work
In the Linux kernel, the following vulnerability has been resolved: regulator: core: use systemfreezablewq for init complete work scheduledelayedwork uses systemwq, which is non-freezable, allowing regulatorinitcompletework to run concurrently with system suspend. This work fires 30s after boot t...
CVE-2026-90360
CVE-2026-90360 affects the Linux kernel regulator core subsystem. The regulator_init_complete_work delayed work, which fires approximately 30 seconds after boot to disable unused regulators over I2C , was scheduled on system_wq —a non-freezable workqueue. This allowed it to execute concurrently w...
CVE-2026-90332 PCI: dwc: ep: Flush cached MSI write before unmapping the iATU
In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush cached MSI write before unmapping the iATU The MSI-X path already flushes any posted MSI-X write before tearing down its iATU mapping. That was added by commit c22533c66cca "PCI: dwc: ep: Flush MSI-X write...
CVE-2026-90326 blk-cgroup: fix race between policy activation and blkg destruction
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix race between policy activation and blkg destruction When switching an IO scheduler on a block device, blkcgactivatepolicy allocates blkgpolicydata pd for all blkgs attached to the queue. However, blkcgactivatepoli...
CVE-2026-90314
In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...
CVE-2026-90310
CVE-2026-90310 affects the Linux kernel 's xen/xenbus driver. A race condition exists where the xenstore watch thread (xenwatch ) can trigger xenbus_dev_changed() before the otherend_id field is initialized during device probe (e.g., on module load). The still-zeroed otherend_id is then misinterp...
EUVD-2026-81894
In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hbregion as the private data for the NEGOTIMEOUT and NEGOAPPROVE o2net handlers as soon as makeitem creates the configfs region. The...