EUVD-2026-82071

In the Linux kernel, the following vulnerability has been resolved: spi: davinci: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestthreadedirq. During removal, spibitbangstop only unregisters th...

CVE-2026-90394

CVE-2026-90394 affects the Linux kernel 's sc2731_charger power supply driver. On device removal, the driver unregisters the USB notifier but fails to cancel queued or running info->work before the devm-allocated driver data is released, creating a use-after-free condition. The issue was disco...

CVE-2026-89797

CVE-2026-89797 is a use-after-free in the Linux kernel's power: supply: ab8500_fg driver. In ab8500_fg_remove(), the driver workqueue is destroyed while threaded interrupt handlers are still armed. Because those handlers are devm-managed and freed only after ->remove() returns, a handler that ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: For clk: imx: clk-imx8mp, the error handling in imx8mpclocksprobe has been improved. ofiomap and kzalloc have been replaced with devmofiomap and devmkzalloc. This allows for automatic release of the associated memory when the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: fixed a possible null-ptr-deref in armsmmudeviceprobe. This issue could lead to a null-ptr-deref when using ‘res’, if platformgetresource returns NULL. Therefore, move operations using ‘res’ should be performed...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: drm: bridge/panel: The cleanup of the connector occurs when the bridge is detached. If we do not call drmconnectorcleanup manually in panelbridgedetach, the connector will be cleaned up along with other DRM objects during the cal...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pmdomain: ti: Add a null pointer check to oprprmdomaininit. devmkasprintf returns a pointer to dynamically allocated memory; this pointer may be NULL in case of failure. Ensure that the allocation was successful by checking the...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: mtk-vcodec: There is a potential NULL pointer dereference issue in the SCP code. The return value of devmkzalloc needs to be checked to avoid NULL pointer dereferences. This is similar to the CVE-2022-3113 vulnerability...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-ep: Fixed incorrect variable used when calling devmrequestmemregion The rcarpcieparseoutboundranges function uses the devmrequestmemregion macro to request a required resource. A string variable located on the stack is...

Linux Distros Unpatched Vulnerability : CVE-2026-89475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove...

Linux Distros Unpatched Vulnerability : CVE-2026-89469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via...

Linux Distros Unpatched Vulnerability : CVE-2026-89474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: bq256xx: drain usbwork before freeing the charger The USB-PHY notifier queues usbwork, whose handler calls powersupplychangedbq-charger. The rese...

Linux Distros Unpatched Vulnerability : CVE-2026-89464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: twl4030charger: cancel workers via devm bci is devm-allocated. Two workers bci-work and bci-currentworker dereference it. twl4030bciremove disabl...

DEBIAN-CVE-2026-89738

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle: at91vbustimer schedules vbustimerwork, and at91vbustimerwork calls...

AZL-100706 CVE-2026-89474 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usbwork before freeing the charger The USB-PHY notifier queues usbwork, whose handler calls powersupplychangedbq-charger. The reset devm action only unregisters the notifier and was registered before...

CVE-2026-89475

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

DEBIAN-CVE-2026-89475

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

DEBIAN-CVE-2026-89474

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usbwork before freeing the charger The USB-PHY notifier queues usbwork, whose handler calls powersupplychangedbq-charger. The reset devm action only unregisters the notifier and was registered before...

DEBIAN-CVE-2026-89463

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the healthpoll delayed work, and the work reschedules itself while the chip...

CVE-2026-89463

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the healthpoll delayed work, and the work reschedules itself while the chip...