GHSA-2CG9-97GQ-9MQP Shopper: Missing authorization on product removal actions in CollectionProducts component

Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...

CVE-2026-89445

A flaw was found in the Linux kernel's iommufd selftest component. This Use-After-Free UAF vulnerability occurs when the TRIGGERIOPF function borrows an attach handle without proper synchronization during a PASID detach operation. A concurrent device fault report can then access memory that has...

AZL-100322 CVE-2026-89473 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix powersupply reference leak bq25890fwprobe acquires a reference to a secondary charger using powersupplygetbyname, but the reference is not released on later probe failures or on driver detach. In...

DEBIAN-CVE-2026-89445

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...

CVE-2026-89473 power: supply: bq25890: Fix power_supply reference leak

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix powersupply reference leak bq25890fwprobe acquires a reference to a secondary charger using powersupplygetbyname, but the reference is not released on later probe failures or on driver detach. In...

CVE-2026-89445 iommufd: Fix UAF in selftest IOPF reporting

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...

CVE-2026-89445 iommufd: Fix UAF in selftest IOPF reporting

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...

EUVD-2026-76351

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...

PT-2026-90189

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power supply reference leak bq25890 fw probe acquires a reference to a secondary charger using power supply get by name, but the reference is not released on later probe failures or on driver detach. I...

PT-2026-90161

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER IOPF borrows an attach handle from group-pasid array without synchronizing against PASID detach, then a concurrent iommu report device fault can dereference tha...

CVE-2026-80850

CVE-2026-80850 is a use-after-free in the Linux kernel's TCP-AO implementation. During tcp_v4_connect(), a race exists between initial key validation and the later L3-master resolution in tcp_ao_connect_init(). If the bound network device is detached from its VRF in that window, the only AO key i...

Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Summary The fix for CVE-2026-35595 project re-parenting privilege escalation only gates reparent operations when parentprojectid 0. A user with Write but not Admin permission on a shared child project can detach it from its parent by sending parentprojectid: 0, bypassing the Admin requirement. Th...

CVE-2026-58089 hwpmc fails to detach PMCs during exec credential transitions

When a process calls execve2 to execute a setuid or setgid image, hwpmc4 is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after...

CVE-2026-58089

FreeBSD 's hwpmc(4) driver (hardware performance monitoring counters) contains a logic flaw in its handling of execve(2) credential transitions. An inverted check meant that PMCs owned by unprivileged processes were not detached when a target process executed a setuid or setgid binary, allowing a...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the vhost-vsock device of QEMU. In the event of an error, an invalid element was not detached from the virtqueue before freeing its memory, resulting in memory leakage and other unexpected issues. This issue affects QEMU versions up to 6.2.0...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed the KASAN use-after-free Read issue in computeeffectiveprogs. Syzbot identified a use-after-free bug in computeeffectiveprogs. The reproducer creates a number of BPF links, causing a failure in the injected allocation...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: fcoe: Fixed the issue where the transport object wasn’t detached when fcoeifinit failed. The fcoeinit function calls fcoetransportattach&fcoeswtransport. However, when fcoeifinit fails, the &fcoeswtransport isn’t detache...

Astra Linux – Vulnerability in Linux 5.10, Linux

A flaw was discovered in the Linux kernel. A NULL pointer dereference may occur when the slip driver is in progress to detach at sltxtimeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/mipi-dsi: Detaching devices when removing the host Whenever the MIPI-DSI host is unregistered, the code for mipidsihostunregister loops through every device currently found on that bus and will unregister them. However, it do...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bug: NULL pointer dereferencing in the kernel, address: 0000000000000020 PGD: 0 P4D 0 Oops: 0000 1 PREEMPT SMP PTI CPU: 11 PID: 19713 Comm: ethtool Tainted: G S 6.10.0-rc7+ 7 RIP: 0010: icegetqcoalesce+0x2e/0xa0 ice RSP:...