CVE-2026-97948

A flaw was found in the Linux kernel's PowerPC Enhanced Error Handling EEH subsystem. A recursive locking issue occurs during device reset handling when an error recovery process attempts to acquire a lock it already holds. When an error is detected on an affected device, this condition causes th...

CVE-2026-98020

A flaw was found in the Linux kernel's pdscore driver. This vulnerability can lead to a denial of service DoS through a system crash. A local user with administrative privileges could trigger this issue by initiating a device reset while a firmware flash update is in progress, causing the driver ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: qat – resolves a race condition during AER recovery During the error recovery process of the PCI AER system, the kernel driver may encounter a race condition related to the freeing of the resetdata structure’s memory. If...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: phylib: fixed potential use-after-free issues. The commit bafbdd527d56 “phylib: Added support for device reset GPIO” includes a call to phydeviceresetphydev after the putdevice call in phydetach. The comment before the putdevice...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: USB: core: Prevent nested device-reset calls Automatic kernel fuzzing revealed a recursive locking violation in usb-storage. ============================================ WARNING: Possible recursive locking detected 5.18.0 3 No...

CVE-2026-89719

A flaw was found in the Linux kernel's zram module. This vulnerability occurs when the readblockstate function calculates the number of pages before acquiring a device lock. If the zram device is reset and reinitialized with a smaller disk size, the function can attempt to access memory beyond th...

DEBIAN-CVE-2026-89718

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writebackstore Patch series "zram: fix stale scan bounds after reinitialization". Both writebackstore and readblockstate derive their table scan bounds from zram-disksize before acquiring devlock...

CVE-2026-89719 zram: fix out-of-bounds access in read_block_state()

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in readblockstate readblockstate calculates nrpages before taking devlock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nrpages still describes the old...

CVE-2026-89719

CVE-2026-89719 affects the zram subsystem of the Linux kernel . The vulnerability is an out-of-bounds access in read_block_state() caused by a race condition: nr_pages is calculated before acquiring dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition...

CVE-2026-89718 zram: fix out-of-bounds access in writeback_store()

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writebackstore Patch series "zram: fix stale scan bounds after reinitialization". Both writebackstore and readblockstate derive their table scan bounds from zram-disksize before acquiring devlock...

PT-2026-90435

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the zram module. The read block state function calculates the nr pages variable before acquiring the dev lock. If the device is reset and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053428)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053428 advisory. In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd: sync all devices to wait all processes being evicted If there are more than one devic...

CVE-2026-74472

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields the driver owns, but misses -state and -ublksrvpid. A device added wit...

UBUNTU-CVE-2026-68291

In the Linux kernel, the following vulnerability has been resolved: idpf: fix maxvport related crash on allocation error during init Set adapter-maxvports only after successful allocation of vports, netdevs and vportconfig buffers. This fixes possible crashes on reset or rmmod, following failed...

EUVD-2026-55560

In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bosdescriptorsread Add a lock to the function bosdescriptorsread. This function accesses udev-bos, which could be simultaneously freed in usbresetandverifydevice, a function that is commonly called i...

Linux Distros Unpatched Vulnerability : CVE-2026-68374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: core: sysfs: add lock to bosdescriptorsread Add a lock to the function bosdescriptorsread. This function accesses udev-bos, which could be simultaneously...

CVE-2026-64476

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disableidled3 per device When disableidled3 was introduced in vfio-pci, it directly manipulated the device power state with pcisetpowerstate. There were no refcounts to maintain or balanced operations, we could...

CVE-2026-63974

A flaw was found in the Bluetooth hcisync component of the Linux kernel. When the hcidevclosesync function is called during a device reset, the system may experience queuing timeouts. This occurs because the HCICMDDRAINWORKQUEUE flag is not properly set, which can lead to system instability or a...

SUSE CVE-2026-53280

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix NULL group-domain dereference in pcidevresetiommudone Local sashiko review pointed it out that group-domain could be NULL when a default domain fails to allocate during the first probe, which can crash at...

CVE-2026-53280 iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done()

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix NULL group-domain dereference in pcidevresetiommudone Local sashiko review pointed it out that group-domain could be NULL when a default domain fails to allocate during the first probe, which can crash at...