CVE-2026-89463

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the healthpoll delayed work, and the work reschedules itself while the chip...

CVE-2026-89461

CVE-2026-89461 affects the Linux kernel's max17040 fuel gauge power supply driver. The root cause is a race condition during system suspend: max17040_work() requeues itself after every poll, and cancel_delayed_work() only cancels a pending instance without waiting for a callback that is already e...

EUVD-2026-76367

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040work requeues itself after every poll. canceldelayedwork only cancels a pending instance and does not wait for a callback that is already running. If syste...

CVE-2026-89461 power: supply: max17040: synchronize work cancellation on suspend

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040work requeues itself after every poll. canceldelayedwork only cancels a pending instance and does not wait for a callback that is already running. If syste...

CVE-2026-89461 power: supply: max17040: synchronize work cancellation on suspend

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040work requeues itself after every poll. canceldelayedwork only cancels a pending instance and does not wait for a callback that is already running. If syste...

CVE-2026-80936 wifi: mt76: mt7925: cancel mlo_pm_work on stop

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlopmwork on stop mt7925 queues mlopmwork with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives...

PT-2026-90181

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr rdy work, max charging time work and batt presence work. pwr rdy work and batt presence work can also queue max charging time work...

PT-2026-90455

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3 gadget free endpoints due to race condition In dwc3 gadget init endpoint, &dep-nostream work is bound with dwc3 nostream work, and dwc3 gadget endpoint stream event can queue this...

PT-2026-90179

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the health poll delayed work, and the work reschedules itself while the chip...

PT-2026-90066

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlo pm work on stop mt7925 queues mlo pm work with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work...

PT-2026-90185

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727 release irq lp8727 isr func, the threaded IRQ handler, is the only caller that arms pchg-work via schedule delayed work. lp8727 release irq currently cancels the work before...

PT-2026-90239

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlo pm work If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

PT-2026-90191

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimit setup work while the threaded handler...

PT-2026-90264

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache cleaner before destroying a cache detail sunrpc destroy cache detail only cancels the global cache cleaner delayed work when cache list is empty. During per-netns teardown cache list is never empty...

SUSE CVE-2026-80753

In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point tha...

SUSE CVE-2026-72411

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crcerrwork Upon an MDIO CRC error mxl862xxcrcerrworkfn walks the DSA ports and closes the CPU port conduits: dsaswitchforeachcpuportdp, priv-ds devclosedp-conduit;...

SUSE CVE-2026-72434

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001394)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001394 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqisyncwork before freeing oinfo ocfs2globalreadinfo will initialize and schedule...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tls: Fixed a race condition in tlsswcancelworktx This issue was discovered during a code audit. After the tlsskprotoclose function is called, canceldelayedworksync can still be used from functions like Delayed ACK handler or...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ACPI: Video – Fix for a use-after-free in acpivideoswitchbrightness The switchbrightnesswork delayed work accesses device-brightness and device-backlight, which were freed by acpivideodevunregisterbacklight during device removal...