CVE-2026-89705: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

CVE-2026-89675: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

CVE-2026-89686: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...

CVE-2026-89764: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

CVE-2026-81010: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: honor taskwork cancellation iowaitidcb may run through the fallback taskwork path when taskworkadd can no longer queue work to the originating task. The fallback runs from a kworker and iouring marks such task wor...

CVE-2026-80980: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and outofsync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smcconnection and every store to one is a read-modify-write of the other two: u...

CVE-2026-80991: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravbptpinterrupt can race with ravbptpstop and pass the clock to ptpclockevent while ptpclockunregister is freeing it. This can lead to a use-after-free. Use READONCE and WRITEONCE for...

CVE-2026-80953: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adii3cmasterprobe requests the IRQ and unmasks REGIRQPENDINGCMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A...

PT-2026-96428

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out of sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc connection and every store to one is a read-modify-write of the other two...

PT-2026-90479

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the trusted key subsystem where the trusted tpm exit function releases the TPM chip reference and frees the digest array before unregistering the trusted key type. Thi...

PT-2026-96459

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG ON in nfsd4 alloc layout stateid on racing delegation revoke nfsd4 alloc layout stateid reads fp-fi deleg file without holding fi lock when the parent stateid is a delegation. A concurrent delegation revoke via the...

PT-2026-90487

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ring-buffer component where trace buffer subbuf size is read without locking in the ring buffer read page and ring buffer read start functions. This occurs...

ROS-20260911-73-0107

The vulnerability of the USB component in Google Chrome and Microsoft Edge browsers is related to the simultaneous execution using a shared resource with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause service interruptions through a specially created HTML...

PT-2026-96554

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs exorcise daemon drops queued messages from a dying daemon without holding ecryptfs msg ctx lists mux, but ecryptfs msg ctx alloc to free requires that lock. Tak...

PT-2026-90233

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the core scheduling of the Linux kernel where the pick next task function can experience state corruption. This occurs when selections on the same core interleave due ...

PT-2026-90056

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ksmbd component during oplock break notification. The function smb2 oplock break noti reads the opinfo-conn variable without a lock and dereferences ...

PT-2026-90455

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the usb dwc3 gadget component due to a race condition. In dwc3 gadget init endpoint, the &dep-nostream work is bound with dwc3 nostream work. When a DEPE...

PT-2026-96494

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040 work requeues itself after every poll. cancel delayed work only cancels a pending instance and does not wait for a callback that is already running. If...

PT-2026-90339

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the HID mcp2221 driver. The problem occurs because incoming HID reports can race with hardware teardown during device removal or probe failure. This is...

PT-2026-90236

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the core scheduling mechanism where the pick next task function operates on sibling runqueues under a shared core-wide lock. If pick task releases the runqueue...