CVE-2026-68084

The CVE concerns the Linux kernel staging: vme_user component, specifically the tsi148 bridge. The root cause is a leaked location monitor resource (lm_resources) because tsi148_remove() did not free lm_resources when unbinding or unloading, unlike other resources. The fix is to free the lm_resou...

CVE-2026-68084 staging: vme_user: fix location monitor leak in tsi148 bridge

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

UBUNTU-CVE-2026-64595

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

SUSE CVE-2026-64365

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The timer is...

EUVD-2026-39902

In the Linux kernel, the following vulnerability has been resolved: net: mana: Guard manaremove against double invocation If PM resume fails e.g., manaattach returns an error, manaprobe calls manaremove, which tears down the device and sets gd-gdmacontext = NULL and gd-driverdata = NULL. However,...

CVE-2026-31606

The CVE-2026-31606 issue affects the Linux kernel USB HID gadget driver. When a /dev/hidg* device is still open, unbind/bind operations can reinitialize a live cdev, which is unsafe and can crash the system. The core problem is calling cdev_init while the cdev is still in use; the fix is to alloc...

Azure Linux 3.0 Security Update: kernel (CVE-2024-39479)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-39479 advisory. - In the Linux kernel, the following vulnerability has been resolved: drm/i915/hwmon: Get rid of devm When bot...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: The vulnerability relates to hardening the uplink netdev access in case the device is unbound. The function mlx5uplinknetdevget retrieves the uplink netdevice pointer from mdev-mlx5eres.uplinknetdev. However, the...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992807)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992807 advisory. In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double atahostput in atatportadd In the error path in atatportadd, whe...

SUSE CVE-2025-68207

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Synchronize Dead CT worker with unbind Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation. cherry pick...

EUVD-2025-203689

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Synchronize Dead CT worker with unbind Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation. cherry pick...

CVE-2025-68207

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Synchronize Dead CT worker with unbind Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation. cherry pick...

CVE-2025-68207

CVE-2025-68207 pertains to the Linux kernel DRM-XE/GUC subsystem. The issue arises from a missing synchronization between a Dead CT worker and device unbind, allowing a previously freed resource to be reused during unbind, which can lead to resource exhaustion and potential service disruption. Th...

CVE-2025-68207 drm/xe/guc: Synchronize Dead CT worker with unbind

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Synchronize Dead CT worker with unbind Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation. cherry pick...

PT-2025-51620

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s DRM/XE/GUC subsystem where a Dead CT worker may not be properly synchronized during device unbinding. This can lead to the worker attempting to use...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990393)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990393 advisory. In the Linux kernel, the following vulnerability has been resolved: tty: goldfish: Fix freeirq on remove Pass the correct devid to freeirq to fix this splat when the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989961)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989961 advisory. In the Linux kernel, the following vulnerability has been resolved: gpio: mockup: fix NULL pointer dereference when removing debugfs We now remove the device's debug...

net/mlx5e: Harden uplink netdev access against device unbind

...

EUVD-2025-32390

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Harden uplink netdev access against device unbind The function mlx5uplinknetdevget gets the uplink netdevice pointer from mdev-mlx5eres.uplinknetdev. However, the netdevice can be removed and its pointer cleared when...

CVE-2025-39947

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Harden uplink netdev access against device unbind The function mlx5uplinknetdevget gets the uplink netdevice pointer from mdev-mlx5eres.uplinknetdev. However, the netdevice can be removed and its pointer cleared when...