Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain busreset work on device removal brcmffwcrashed and the debugfs “reset” entry both schedule drvr-busreset, whose callback recovers drvr via containerof and dereferences it. The removal path frees drvr brcmffr...

CVE-2026-99034

A flaw was found in the Linux kernel's Spreadtrum SDHCI Secure Digital Host Controller Interface driver. This flaw allows a local privileged user to cause a Denial of Service DoS by triggering improper power management cleanup during device removal. Because the driver fails to disable runtime pow...

CVE-2026-99061

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

CVE-2026-99019 scsi: ch: Do not keep references to data transfer element devices

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices chreadconfig looks up the scsidevice of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch-dt...

CVE-2026-99019

The Linux kernel contains a vulnerability in the scsi changer (ch) component where the ch_readconfig() function incorrectly maintains references to data transfer element devices . Because scsi_device_lookup() takes a reference that is never dropped, removed drives remain on the host's device list...

CVE-2026-98957

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netifnapidellocked and in pagepooldisabledirectrecycling because the driver does not disable the napi...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.12.111 and prior to 6.18.53. This vulnerability arises when the pm runtime is enabled prematurely while the probe is still pending, potentially leading to improper sequencing of device removal and power management disablement...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 2.6.13. It stems from chreadconfig failing to release references obtained via scsidevicelookup, causing scsidevice to remain unreferenced after a device removal. As a result, new devices are rejected, and low-level driver modules cannot be...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46165)

In the Linux kernel, the following vulnerability has been resolved: openvswitch: vport: fix self-deadlock on release of tunnel ports vports are used concurrently and protected by RCU, so netdevput must happen after the RCU grace period. So, either in an RCU call or after the synchronizenet. The...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: usb: renesasusbhs: fix use-after-free in ISR during device removal In usbhsremove, the driver frees resources including the pipe array while the interrupt handler usbhsinterrupt is still registered. If an interrupt fires after...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone device registration error path If thermalzonedeviceregisterwithtrips fails after registering a thermal zone device, it needs to wait for the tz-removal completion, similar to...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is initialized in iscihostalloc drivers/scsi/isci/init.c:496 and scheduled from both MSI-X and legacy interrupt handlers...

SUSE CVE-2026-98766

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wakework is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in astvhubremove, so a work item queued before or...

DEBIAN-CVE-2026-98766

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wakework is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in astvhubremove, so a work item queued before or...

CVE-2026-98766 usb: gadget: aspeed-vhub: cancel wake work on device removal

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wakework is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in astvhubremove, so a work item queued before or...

EUVD-2026-103851

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wakework is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in astvhubremove, so a work item queued before or...

CVE-2026-98766 usb: gadget: aspeed-vhub: cancel wake work on device removal

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wakework is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in astvhubremove, so a work item queued before or...

CVE-2026-98766

The Linux kernel contains a use-after-free vulnerability in the usb: gadget: aspeed-vhub component. The root cause is that wake_work is armed during the .wakeup callback but is not cancelled in ast_vhub_remove(), potentially allowing a work item to execute after the vhub and its ports are freed b...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: misc: pciendpointtest: Free IRQs before removing the device In pciendpointtestremove, freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device Memory has already been...