AZL-100208 CVE-2026-89475 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

DEBIAN-CVE-2026-89469

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via scheduledelayedwork. lp8727releaseirq currently cancels the work before freeing the...

CVE-2026-89469

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via scheduledelayedwork. lp8727releaseirq currently cancels the work before freeing the...

AZL-100229 CVE-2026-89469 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via scheduledelayedwork. lp8727releaseirq currently cancels the work before freeing the...

AZL-100365 CVE-2026-89465 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwrrdywork, maxchargingtimework and battpresencework. pwrrdywork and battpresencework can also queue maxchargingtimework, while...

CVE-2026-89463

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the healthpoll delayed work, and the work reschedules itself while the chip...

CVE-2026-89464

In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030charger: cancel workers via devm bci is devm-allocated. Two workers bci-work and bci-currentworker dereference it. twl4030bciremove disables charging and masks interrupts. It cancels neither worker. A worker...

CVE-2026-89465

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwrrdywork, maxchargingtimework and battpresencework. pwrrdywork and battpresencework can also queue maxchargingtimework, while...

DEBIAN-CVE-2026-89463

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the healthpoll delayed work, and the work reschedules itself while the chip...

AZL-100560 CVE-2026-89461 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040work requeues itself after every poll. canceldelayedwork only cancels a pending instance and does not wait for a callback that is already running. If syste...

DEBIAN-CVE-2026-89465

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwrrdywork, maxchargingtimework and battpresencework. pwrrdywork and battpresencework can also queue maxchargingtimework, while...

CVE-2026-89461

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040work requeues itself after every poll. canceldelayedwork only cancels a pending instance and does not wait for a callback that is already running. If syste...

AZL-100079 CVE-2026-89463 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the healthpoll delayed work, and the work reschedules itself while the chip...

CVE-2026-89585

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

CVE-2026-89523

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

CVE-2026-89469

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via scheduledelayedwork. lp8727releaseirq currently cancels the work before freeing the...

UBUNTU-CVE-2026-89523

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

UBUNTU-CVE-2026-89585

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

UBUNTU-CVE-2026-89463

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the healthpoll delayed work, and the work reschedules itself while the chip...

UBUNTU-CVE-2026-89461

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040work requeues itself after every poll. canceldelayedwork only cancels a pending instance and does not wait for a callback that is already running. If syste...